All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 4.17 000/336] 4.17.12-stable review
@ 2018-08-01 16:45 Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 001/336] spi: spi-s3c64xx: Fix system resume support Greg Kroah-Hartman
                   ` (311 more replies)
  0 siblings, 312 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.17.12 release.
There are 336 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri Aug  3 16:49:21 UTC 2018.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.17.12-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.17.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.17.12-rc1

Erik Schmauss <erik.schmauss@intel.com>
    ACPICA: AML Parser: ignore control method status in module-level code

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI / LPSS: Avoid PM quirks on suspend and resume from hibernation

Lawrence Brakmo <brakmo@fb.com>
    tcp: ack immediately when a cwr packet arrives

Eric Dumazet <edumazet@google.com>
    tcp: add one more quick ack after after ECN events

Yousuk Seung <ysseung@google.com>
    tcp: refactor tcp_ecn_check_ce to remove sk type cast

Eric Dumazet <edumazet@google.com>
    tcp: do not aggressively quick ack after ECN events

Eric Dumazet <edumazet@google.com>
    tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode

Eric Dumazet <edumazet@google.com>
    tcp: do not force quickack when receiving out-of-order packets

Dmitry Safonov <dima@arista.com>
    netlink: Don't shift with UB on nlk->ngroups

Dmitry Safonov <dima@arista.com>
    netlink: Do not subscribe to non-existent groups

Tariq Toukan <tariqt@mellanox.com>
    net: rollback orig value on failure of dev_qdisc_change_tx_queue_len

Arjun Vynipadath <arjun@chelsio.com>
    cxgb4: Added missing break in ndo_udp_tunnel_{add/del}

Xiao Liang <xiliang@redhat.com>
    xen-netfront: wait xenbus state change when load module manually

Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    virtio_net: Fix incosistent received bytes counter

Neal Cardwell <ncardwell@google.com>
    tcp_bbr: fix bw probing to raise in-flight data for very small BDPs

Avinash Repaka <avinash.repaka@oracle.com>
    RDS: RDMA: Fix the NULL-ptr deref in rds_ib_get_mr

Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
    NET: stmmac: align DMA stuff to largest cache line length

Anton Vasilyev <vasilyev@ispras.ru>
    net: mdio-mux: bcm-iproc: fix wrong getter and setter pair

Stefan Wahren <stefan.wahren@i2se.com>
    net: lan78xx: fix rx handling before first packet is send

tangpengpeng <tangpengpeng@higon.com>
    net: fix amd-xgbe flow-control issue

Gal Pressman <pressmangal@gmail.com>
    net: ena: Fix use of uninitialized DMA address bits field

Jakub Kicinski <jakub.kicinski@netronome.com>
    netdevsim: don't leak devlink resources

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    ipv4: remove BUG_ON() from fib_compute_spec_dst

Michal Vokáč <vokac.m@gmail.com>
    net: dsa: qca8k: Allow overwriting CPU port setting

Michal Vokáč <vokac.m@gmail.com>
    net: dsa: qca8k: Add QCA8334 binding documentation

Michal Vokáč <vokac.m@gmail.com>
    net: dsa: qca8k: Enable RXMAC when bringing up a port

Michal Vokáč <vokac.m@gmail.com>
    net: dsa: qca8k: Force CPU port to its highest bandwidth

Leon Romanovsky <leon@kernel.org>
    RDMA/uverbs: Protect from attempts to create flows on unsupported QP

Masahiro Yamada <yamada.masahiro@socionext.com>
    gpio: uniphier: set legitimate irq trigger type in .to_irq hook

Linus Walleij <linus.walleij@linaro.org>
    gpio: of: Handle fixed regulator flags properly

Theodore Ts'o <tytso@mit.edu>
    ext4: fix check to prevent initializing reserved inodes

Theodore Ts'o <tytso@mit.edu>
    ext4: check for allocation block validity with block group locked

Theodore Ts'o <tytso@mit.edu>
    ext4: fix inline data updates with checksums enabled

Theodore Ts'o <tytso@mit.edu>
    ext4: fix false negatives *and* false positives in ext4_check_descriptors()

Linus Torvalds <torvalds@linux-foundation.org>
    squashfs: be more careful about metadata corruption

Theodore Ts'o <tytso@mit.edu>
    random: mix rdrand with entropy sent in from userspace

Wolfram Sang <wsa+renesas@sang-engineering.com>
    i2c: rcar: handle RXDMA HW behaviour on Gen3

James Smart <jsmart2021@gmail.com>
    nvmet-fc: fix target sgl list on large transfers

Greg Edwards <gedwards@ddn.com>
    block: reset bi_iter.bi_done after splitting bio

Martin Wilck <mwilck@suse.com>
    blkdev: __blkdev_direct_IO_simple: fix leak in error case

Martin Wilck <mwilck@suse.com>
    block: bio_iov_iter_get_pages: fix size of last iovec

Felix Kuehling <Felix.Kuehling@amd.com>
    drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    drm/dp/mst: Fix off-by-one typo when dump payload table

Ville Syrjälä <ville.syrjala@linux.intel.com>
    drm/atomic-helper: Drop plane->fb references only for drm_atomic_helper_shutdown()

José Roberto de Souza <jose.souza@intel.com>
    drm: Add DP PSR2 sink enable bit

Fabio Estevam <fabio.estevam@nxp.com>
    ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl

Kirill Marinushkin <k.marinushkin@gmail.com>
    ASoC: topology: Add missing clock gating parameter when parsing hw_configs

Kirill Marinushkin <k.marinushkin@gmail.com>
    ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format()

Masahisa KOJIMA <masahisa.kojima@linaro.org>
    net: socionext: reset hardware in ndo_stop

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: si470x: fix __be16 annotations

Hans Verkuil <hverkuil@xs4all.nl>
    media: cec: fix smatch error

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: atomisp: compat32: fix __user annotations

Bjorn Helgaas <bhelgaas@google.com>
    PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR

Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
    scsi: cxlflash: Avoid clobbering context control register value

Uma Krishnan <ukrishn@linux.vnet.ibm.com>
    scsi: cxlflash: Synchronize reset and remove ops

Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
    scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs

Xose Vazquez Perez <xose.vazquez@gmail.com>
    scsi: scsi_dh: replace too broad "TP9" string with the exact models

Philippe CORNU <philippe.cornu@st.com>
    drm/stm: ltdc: fix warning in ltdc_crtc_update_clut()

Thomas Hebb <tommyhebb@gmail.com>
    ath10k: search all IEs for variant before falling back

Douglas Anderson <dianders@chromium.org>
    regulator: Don't return or expect -errno from of_map_mode()

Suman Anna <s-anna@ti.com>
    media: omap3isp: fix unbalanced dma_iommu_mapping

Sean Young <sean@mess.org>
    media: rc: mce_kbd decoder: low timeout values cause double keydowns

Arnd Bergmann <arnd@arndb.de>
    y2038: ipc: Use ktime_get_real_seconds consistently

Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
    crypto: authenc - don't leak pointers to authenc keys

Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
    crypto: authencesn - don't leak pointers to authenc keys

Dominik Bozek <dominikx.bozek@intel.com>
    usb: hub: Don't wait for connect state at resume for powered-off ports

Michal Simek <michal.simek@xilinx.com>
    microblaze: Fix simpleImage format generation

Andrey Smirnov <andrew.smirnov@gmail.com>
    soc: imx: gpcv2: Do not pass static memory as platform data

Douglas Anderson <dianders@chromium.org>
    serial: core: Make sure compiler barfs for 16-byte earlycon names

Sergio Paracuellos <sergio.paracuellos@gmail.com>
    staging: ks7010: fix error handling in ks7010_upload_firmware

NeilBrown <neilb@suse.com>
    staging: lustre: ldlm: free resource when ldlm_lock_create() fails.

James Simmons <jsimmons@infradead.org>
    staging: lustre: llite: correct removexattr detection

Stefan Wahren <stefan.wahren@i2se.com>
    staging: vchiq_core: Fix missing semaphore release in error case

Mario Limonciello <mario.limonciello@dell.com>
    platform/x86: dell-smbios: Match on www.dell.com in OEM strings too

Tomasz Figa <tfiga@chromium.org>
    drm/rockchip: analogix_dp: Do not call Analogix code before bind

Ondrej Mosnáček <omosnace@redhat.com>
    audit: allow not equal op for audit by executable

Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
    rsi: fix nommu_map_sg overflow kernel panic

Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
    rsi: Fix 'invalid vdd' warning in mmc

Chris Novakovic <chris@chrisn.me.uk>
    ipconfig: Correctly initialise ic_nameservers

Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
    drm/gma500: fix psb_intel_lvds_mode_valid()'s return type

Gustavo A. R. Silva <gustavo@embeddedor.com>
    qtnfmac: pearl: pcie: fix memory leak in qtnf_fw_work_handler

Vinicius Costa Gomes <vinicius.gomes@intel.com>
    igb: Fix queue selection on MAC filters on i210

Charles Keepax <ckeepax@opensource.cirrus.com>
    ASoC: compress: Only call free for components which have been opened

Enric Balletbo i Serra <enric.balletbo@collabora.com>
    arm64: defconfig: Enable Rockchip io-domain driver

Fabio Estevam <fabio.estevam@nxp.com>
    ASoC: fsl_ssi: Use u32 variable type when using regmap_read()

Wei Xu <wxu@cnexlabs.com>
    nvme: lightnvm: add granby support

Dmitry Osipenko <digetx@gmail.com>
    memory: tegra: Apply interrupts mask per SoC

Dmitry Osipenko <digetx@gmail.com>
    memory: tegra: Do not handle spurious interrupts

Tamizh Chelvam <tamizhr@codeaurora.org>
    ath10k: fix kernel panic while reading tpc_stats

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    delayacct: Use raw_spinlocks

Thomas Gleixner <tglx@linutronix.de>
    stop_machine: Use raw spinlocks

Wolfram Sang <wsa+renesas@sang-engineering.com>
    backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction

Felix Fietkau <nbd@nbd.name>
    mt76: add rcu locking around tx scheduling

Jacob Keller <jacob.e.keller@intel.com>
    i40e: avoid overflow in i40e_ptp_adjfreq()

Jakub Pawlak <jakub.pawlak@intel.com>
    i40e: Add advertising 10G LR mode

Kirill Tkhai <ktkhai@virtuozzo.com>
    fasync: Fix deadlock between task-context and interrupt-context kill_fasync()

Yixun Lan <yixun.lan@amlogic.com>
    dt-bindings: net: meson-dwmac: new compatible name for AXG SoC

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: Fixes the out of bounds access in hclge_map_tqp

Alexey Khoroshilov <khoroshilov@ispras.ru>
    spi: meson-spicc: Fix error handling in meson_spicc_probe()

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC

Tobin C. Harding <me@tobin.cc>
    mmc: pwrseq: Use kmalloc_array instead of stack VLA

Shawn Lin <shawn.lin@rock-chips.com>
    mmc: dw_mmc: update actual clock for mmc debugfs

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: hda/ca0132: fix build failure when a local macro is defined

Ido Schimmel <idosch@mellanox.com>
    mlxsw: spectrum_router: Return an error for non-default FIB rules

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: check cap_resource only for data blocks

Kishon Vijay Abraham I <kishon@ti.com>
    mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg

Satendra Singh Thakur <satendra.t@samsung.com>
    drm/atomic: Handling the case when setting old crtc for plane

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    mt76x2: fix avg_rssi estimation

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: siano: get rid of __le32/__le16 cast warnings

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: em28xx: fix a regression with HVR-950

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: avoid fsync() failure caused by EAGAIN in writepage()

Jakub Kicinski <jakub.kicinski@netronome.com>
    bpf: fix references to free_bpf_prog_info() in comments

Changbin Du <changbin.du@intel.com>
    regulator: add dummy function of_find_regulator_by_node

Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    thermal: exynos: fix setting rising_threshold for Exynos5433

Doug Oucharek <dougso@me.com>
    staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5

Doug Oucahrek <dougso@me.com>
    staging: lustre: o2iblnd: fix race at kiblnd_connect_peer

Takashi Iwai <tiwai@suse.de>
    dma-direct: try reallocation with GFP_DMA32 if possible

Chad Dupuis <chad.dupuis@cavium.com>
    scsi: qedf: Set the UNLOADING flag when removing a vport

Viresh Kumar <viresh.kumar@linaro.org>
    soc/tegra: pmc: Don't allocate struct tegra_powergate on stack

Xiang Chen <chenxiang66@hisilicon.com>
    scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw

Dan Carpenter <dan.carpenter@oracle.com>
    scsi: megaraid: silence a static checker bug

Wenwen Wang <wang6495@umn.edu>
    scsi: 3w-xxxx: fix a missing-check bug

Wenwen Wang <wang6495@umn.edu>
    scsi: 3w-9xxx: fix a missing-check bug

Christian Gromm <christian.gromm@microchip.com>
    staging: most: cdev: fix chrdev_region leak

Ram Pai <linuxram@us.ibm.com>
    mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Always forward VF MAC address to the PF.

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only.

Antoine Tenart <antoine.tenart@bootlin.com>
    net: phy: sfp: handle cases where neither BR, min nor BR, max is given

Thomas Richter <tmricht@linux.ibm.com>
    perf: fix invalid bit in diagnostic entry

Thomas Richter <tmricht@linux.ibm.com>
    s390/cpum_sf: Add data entry sizes to sampling trailer entry

Sean Lanigan <sean@lano.id.au>
    brcmfmac: Add support for bcm43364 wireless chipset

Jane Wan <Jane.Wan@nokia.com>
    mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages

Brad Love <brad@nextdimension.cc>
    media: em28xx: Fix DualHD broken second tuner

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: renesas-ceu: Set mbus_fmt on subdev operations

Brad Love <brad@nextdimension.cc>
    media: saa7164: Fix driver name in debug output

Sami Tolvanen <samitolvanen@google.com>
    media: media-device: fix ioctl function types

Hans de Goede <hdegoede@redhat.com>
    ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2

Damien Le Moal <damien.lemoal@wdc.com>
    libata: Fix command retry decision

Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()

Florian Fainelli <f.fainelli@gmail.com>
    net: phy: phylink: Release link GPIO

Marc Zyngier <marc.zyngier@arm.com>
    dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA

DaeRyong Jeong <threeearcat@gmail.com>
    tty: Fix data race in tty_insert_flip_string_fixed_flag

Jacob Keller <jacob.e.keller@intel.com>
    i40e: free the skb after clearing the bitlock

Rob Herring <robh@kernel.org>
    ARM: dts: imx53: Fix LDB OF graph warning

Mathieu Malaterre <malat@debian.org>
    nvmem: properly handle returned value nvmem_reg_read

Geert Uytterhoeven <geert+renesas@glider.be>
    ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node

Geert Uytterhoeven <geert+renesas@glider.be>
    ARM: dts: emev2: Add missing interrupt-affinity to PMU node

Patrice Chotard <patrice.chotard@st.com>
    ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage

Patrice Chotard <patrice.chotard@st.com>
    ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage

Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
    rsi: Add null check for virtual interfaces in wowlan config

Thor Thayer <thor.thayer@linux.intel.com>
    EDAC, altera: Fix ARM64 build warning

Dmitry Torokhov <dtor@chromium.org>
    HID: i2c-hid: check if device is there before really probing

Jonathan Neuschäfer <j.neuschaefer@gmx.net>
    powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by Starlet

Ben Hutchings <ben@decadent.org.uk>
    IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS

Leo (Sunpeng) Li <sunpeng.li@amd.com>
    drm/amd/display: Fix dim display on DCE11

Samuel Li <Samuel.Li@amd.com>
    drm/amdgpu: Remove VRAM from shared bo domains.

Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
    drm/radeon: fix mode_valid's return type

Shirish S <shirish.s@amd.com>
    drm/amd/display: remove need of modeset flag for overlay planes (V2)

Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    arm64: dts: renesas: salvator-common: use audio-graph-card for Sound

Terry Junge <terry.junge@plantronics.com>
    HID: hid-plantronics: Re-resend Update to map button for PTT products

Will Deacon <will.deacon@arm.com>
    arm64: cmpwait: Clear event register before arming exclusive monitor

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: staging: atomisp: Comment out several unused sensor resolutions

Mauro Carvalho Chehab <mchehab@kernel.org>
    media: atomisp: ov2680: don't declare unused vars

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: Fix for fiber link up problem

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback

Grygorii Strashko <grygorii.strashko@ti.com>
    net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value

Mathieu Malaterre <malat@debian.org>
    clocksource: Move inline keyword to the beginning of function declarations

Oza Pawandeep <poza@codeaurora.org>
    PCI/DPC: Clear interrupt status in interrupt handler top half

Colin Ian King <colin.king@canonical.com>
    media: smiapp: fix timeout checking in smiapp_read_nvm

Thierry Reding <treding@nvidia.com>
    gpu: host1x: Acquire a reference to the IOVA cache

Emil Tantilov <emil.s.tantilov@intel.com>
    ixgbevf: fix MAC address changes through ixgbevf_set_mac()

Yufen Yu <yuyufen@huawei.com>
    md: fix NULL dereference of mddev->pers in remove_and_add_spares()

Gioh Kim <gi-oh.kim@profitbricks.com>
    md/raid1: add error handling of read error from FailFast device

Anson Huang <Anson.Huang@nxp.com>
    regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops

Takashi Iwai <tiwai@suse.de>
    ALSA: emu10k1: Rate-limit error messages about page errors

Alexandre Belloni <alexandre.belloni@bootlin.com>
    rtc: tps65910: fix possible race condition

Alexandre Belloni <alexandre.belloni@bootlin.com>
    rtc: vr41xx: fix possible race condition

Alexandre Belloni <alexandre.belloni@bootlin.com>
    rtc: tps6586x: fix possible race condition

Vic Wei <vwei@codeaurora.org>
    Bluetooth: btusb: add ID for LiteOn 04ca:301a

Ben Skeggs <bskeggs@redhat.com>
    drm/nouveau/fifo/gk104-: poll for runlist update completion

Ben Skeggs <bskeggs@redhat.com>
    drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl

Ben Skeggs <bskeggs@redhat.com>
    drm/nouveau: remove fence wait code from deferred client work handler

Jens Remus <jremus@linux.ibm.com>
    scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger

Maya Erez <merez@codeaurora.org>
    scsi: ufs: fix exception event handling

Subhash Jadavani <subhashj@codeaurora.org>
    scsi: ufs: ufshcd: fix possible unclocked register access

Maxime Chevallier <maxime.chevallier@bootlin.com>
    net: mvpp2: Add missing VLAN tag detection

Eric Biggers <ebiggers@google.com>
    fscrypt: use unbound workqueue for decryption

Xi Wang <wangxi11@huawei.com>
    net: hns3: Fix for hns3 module is loaded multiple times problem

Xi Wang <wangxi11@huawei.com>
    net: hns3: Fix the missing client list node initialization

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: Fix for CMDQ and Misc. interrupt init order problem

Tony Lindgren <tony@atomide.com>
    spi: Add missing pm_runtime_put_noidle() after failed get

Mark Rutland <mark.rutland@arm.com>
    drivers/perf: arm-ccn: don't log to dmesg in event_init

Wolfram Sang <wsa+renesas@sang-engineering.com>
    watchdog: renesas-wdt: Add support for the R8A77965 WDT

Mimi Zohar <zohar@linux.vnet.ibm.com>
    ima: based on policy verify firmware signatures (pre-allocated buffer)

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    mt76x2: apply coverage class on slot time too

Xinming Hu <huxm@marvell.com>
    mwifiex: correct histogram data with appropriate index

Michal Vokáč <vokac.m@gmail.com>
    net: dsa: qca8k: Add support for QCA8334 switch

Mika Westerberg <mika.westerberg@linux.intel.com>
    PCI: pciehp: Request control of native hotplug only if supported

Sandipan Das <sandipan@linux.vnet.ibm.com>
    bpf: powerpc64: pad function address loads with NOPs

Sandipan Das <sandipan@linux.vnet.ibm.com>
    bpf: fix multi-function JITed dump obtained via syscall

Christian Lamparter <chunkeey@gmail.com>
    pinctrl: msm: fix gpio-hog related boot issues

Julia Lawall <Julia.Lawall@lip6.fr>
    pinctrl: at91-pio4: add missing of_node_put

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/8xx: fix invalid register expression in head_8xx.S

Geert Uytterhoeven <geert+renesas@glider.be>
    spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC

Dan Carpenter <dan.carpenter@oracle.com>
    KVM: x86: prevent integer overflows in KVM_MEMORY_ENCRYPT_REG_REGION

Mathieu Malaterre <malat@debian.org>
    powerpc: Add __printf verification to prom_printf

Mathieu Malaterre <malat@debian.org>
    powerpc/powermac: Mark variable x as unused

Mathieu Malaterre <malat@debian.org>
    powerpc/powermac: Add missing prototype for note_bootable_part()

Mathieu Malaterre <malat@debian.org>
    powerpc/chrp/time: Make some functions static, add missing header include

Mathieu Malaterre <malat@debian.org>
    powerpc/32: Add a missing include header

Patrick Bellasi <patrick.bellasi@arm.com>
    sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for Bahamas

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for Bermuda

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for Serbia

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for Tanzania

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for Uganda

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for APL2_FCCA

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for APL13_WORLD

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for ETSI8_WORLD

Sven Eckelmann <sven.eckelmann@openmesh.com>
    ath: Add regulatory mapping for FCC3_ETSIC

Keith Busch <keith.busch@intel.com>
    nvme-pci: Fix AER reset handling

Jianchao Wang <jianchao.w.wang@oracle.com>
    nvme-rdma: stop admin queue before freeing it

Alex Elder <elder@linaro.org>
    soc: qcom: smem: byte swap values properly

Alex Elder <elder@linaro.org>
    soc: qcom: smem: fix qcom_smem_set_global_partition()

Alex Elder <elder@linaro.org>
    soc: qcom: qmi: fix a buffer sizing bug

Christoph Hellwig <hch@lst.de>
    PCI: Prevent sysfs disable of device while driver is attached

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    PM / wakeup: Make s2idle_lock a RAW_SPINLOCK

Scott Wood <swood@redhat.com>
    x86/microcode: Make the late update update_lock a raw lock for RT

Qu Wenruo <wqu@suse.com>
    btrfs: qgroup: Finish rescan when hit the last leaf of extent tree

David Sterba <dsterba@suse.com>
    btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups

Omar Sandoval <osandov@fb.com>
    Btrfs: don't BUG_ON() in btrfs_truncate_inode_items()

Omar Sandoval <osandov@fb.com>
    Btrfs: don't return ino to ino cache if inode item removal fails

Hans Verkuil <hans.verkuil@cisco.com>
    media: videobuf2-core: don't call memop 'finish' when queueing

Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    media: cec-pin-error-inj: avoid a false-positive Spectre detection

Ezequiel Garcia <ezequiel@collabora.com>
    media: tw686x: Fix incorrect vb2_mem_ops GFP flags

Fuyun Liang <liangfuyun1@huawei.com>
    net: hns3: Fixes the init of the VALID BD info in the descriptor

Lijun Ou <oulijun@huawei.com>
    net: hns3: Fixes initalization of RoCE handle and makes it conditional

Eyal Reizer <eyalreizer@gmail.com>
    wlcore: sdio: check for valid platform device data before suspend

Ganapathi Bhat <gbhat@marvell.com>
    mwifiex: handle race during mwifiex_usb_disconnect

Vincent Palatin <vpalatin@chromium.org>
    mfd: cros_ec: Fail early if we cannot identify the EC

Kai Chieh Chuang <kaichieh.chuang@mediatek.com>
    ASoC: dpcm: fix BE dai not hw_free and shutdown

Jian-Hong Pan <jian-hong@endlessm.com>
    Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011

Arnd Bergmann <arnd@arndb.de>
    drivers/bus: arm-cci: fix build warnings

Mikita Lipski <mikita.lipski@amd.com>
    drm/amd/display: Do not program interrupt status on disabled crtc

Thierry Escande <thierry.escande@linaro.org>
    Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning

Gregory Greenman <gregory.greenman@intel.com>
    iwlwifi: mvm: open BA session only when sta is authorized

Shaul Triebitz <shaul.triebitz@intel.com>
    iwlwifi: pcie: fix race in Rx buffer allocator

Ethan Lien <ethanlien@synology.com>
    btrfs: balance dirty metadata pages in btrfs_finish_ordered_io

Jan Kiszka <jan.kiszka@siemens.com>
    PCI: Fix devm_pci_alloc_host_bridge() memory leak

Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
    qtnfmac: fix invalid STA state on EAPOL failure

Anders Roxell <anders.roxell@linaro.org>
    selftests/filesystems: devpts_pts included wrong header

Shuah Khan (Samsung OSG) <shuah@kernel.org>
    selftests: filesystems: return Kselftest Skip code for skipped tests

Shuah Khan (Samsung OSG) <shuah@kernel.org>
    selftests: intel_pstate: return Kselftest Skip code for skipped tests

Shuah Khan (Samsung OSG) <shuah@kernel.org>
    selftests: kvm: return Kselftest Skip code for skipped tests

Shuah Khan (Samsung OSG) <shuah@kernel.org>
    selftests: memfd: return Kselftest Skip code for skipped tests

Daniel Díaz <daniel.diaz@linaro.org>
    selftests/intel_pstate: Improve test, minor fixes

Kan Liang <kan.liang@intel.com>
    perf/x86/intel/uncore: Correct fixed counter index check for NHM

Kan Liang <kan.liang@intel.com>
    perf/x86/intel/uncore: Correct fixed counter index check in generic code

Michael Grzeschik <m.grzeschik@pengutronix.de>
    usbip: dynamically allocate idev by nports found in sysfs

Shuah Khan (Samsung OSG) <shuah@kernel.org>
    usbip: usbip_detach: Fix memory, udev context and udev leak

Filippo Muzzini <filippo.muzzini@outlook.it>
    block, bfq: remove wrong lock in bfq_requests_merged

Chao Yu <yuchao0@huawei.com>
    f2fs: fix race in between GC and atomic open

Chao Yu <yuchao0@huawei.com>
    f2fs: fix to detect failure of dquot_initialize

Yunlei He <heyunlei@huawei.com>
    f2fs: fix missing clear FI_NO_PREALLOC in some error case

Sahitya Tummala <stummala@codeaurora.org>
    f2fs: Fix deadlock in shutdown ioctl

Chao Yu <yuchao0@huawei.com>
    f2fs: fix to wait page writeback during revoking atomic write

Chao Yu <yuchao0@huawei.com>
    f2fs: fix to don't trigger writeback during recovery

Chao Yu <yuchao0@huawei.com>
    f2fs: don't drop dentry pages after fs shutdown

Chao Yu <yuchao0@huawei.com>
    f2fs: fix error path of move_data_page

Anatoly Pugachev <matorola@gmail.com>
    disable loading f2fs module on PAGE_SIZE > 4KB

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS: Fix up nfs_post_op_update_inode() to force ctime updates

Trond Myklebust <trond.myklebust@hammerspace.com>
    pnfs: Don't release the sequence slot until we've processed layoutget on open

Alexey Kodanev <alexey.kodanev@oracle.com>
    netfilter: nf_tables: check msg_type before nft_trans_set(trans)

Javier González <javier@cnexlabs.com>
    lightnvm: pblk: warn in case of corrupted write buffer

Igor Konopko <igor.j.konopko@intel.com>
    lightnvm: proper error handling for pblk_bio_add_pages

Igor Konopko <igor.j.konopko@intel.com>
    lightnvm: fix partial read error path

Leon Romanovsky <leon@kernel.org>
    RDMA/mad: Convert BUG_ONs to error flows

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: Fix for service_task not running problem after resetting

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: Fix for phy not link up problem after resetting

Paul Cercueil <paul@crapouillou.net>
    clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle

Mike Looijmans <mike.looijmans@topic.nl>
    clk-si544: Properly round requested frequency to nearest match

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s: Fix compiler store ordering to SLB shadow area

Stewart Smith <stewart@linux.ibm.com>
    hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()

Sam Bobroff <sbobroff@linux.ibm.com>
    powerpc/eeh: Fix use-after-release of EEH driver

Michal Suchanek <msuchanek@suse.de>
    powerpc/64s: Add barrier_nospec

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/lib: Adjust .balign inside string functions for PPC32

Cong Wang <xiyou.wangcong@gmail.com>
    infiniband: fix a possible use-after-free bug

Benjamin Poirier <bpoirier@suse.com>
    e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes

Luis Henriques <lhenriques@suse.com>
    ceph: fix use-after-free in ceph_statfs()

Chengguang Xu <cgxu519@gmx.com>
    ceph: fix alignment of rasize

Wang YanQing <udknight@gmail.com>
    bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}

Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
    printk: drop in_nmi check from printk_safe_flush_on_panic()

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: arch: sh: migor: Fix TW9910 PDN gpio

Marco Felsch <m.felsch@pengutronix.de>
    watchdog: da9063: Fix updating timeout value

Laurentiu Tudor <laurentiu.tudor@nxp.com>
    irqchip/ls-scfg-msi: Map MSIs in the iommu

Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    netfilter: ipset: List timing out entries with "timeout 1" instead of zero

Florent Fourcot <florent.fourcot@wifirst.fr>
    netfilter: ipset: forbid family for hash:mac sets

Jiri Olsa <jolsa@kernel.org>
    perf tools: Fix pmu events parsing rule

Xi Wang <wangxi11@huawei.com>
    net: hns3: Fix for VF mailbox cannot receiving PF response

David Howells <dhowells@redhat.com>
    rxrpc: Fix terminal retransmission connection ID to include the channel

Alexandre Belloni <alexandre.belloni@bootlin.com>
    rtc: ensure rtc_set_alarm fails when alarms are not supported

Mathieu Malaterre <malat@debian.org>
    mm/slub.c: add __printf verification to slab_err()

Chintan Pandya <cpandya@codeaurora.org>
    mm: vmalloc: avoid racy handling of debugobjects in vunmap

Huang Ying <ying.huang@intel.com>
    mm: /proc/pid/pagemap: hide swap entries from unprivileged users

Aaron Lu <aaron.lu@intel.com>
    mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    kernel/hung_task.c: show all hung tasks before panic

Alex Williamson <alex.williamson@redhat.com>
    vfio/type1: Fix task tracking for QEMU vCPU hotplug

Alex Williamson <alex.williamson@redhat.com>
    vfio/mdev: Check globally for duplicate devices

Geert Uytterhoeven <geert+renesas@glider.be>
    vfio: platform: Fix reset module leak in error path

Scott Mayhew <smayhew@redhat.com>
    nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo

Andrew Elble <aweits@rit.edu>
    nfsd: fix error handling in nfs4_set_delegation()

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY

Zhouyang Jia <jiazhouyang09@gmail.com>
    ALSA: fm801: add error handling for snd_ctl_add

Zhouyang Jia <jiazhouyang09@gmail.com>
    ALSA: emu10k1: add error handling for snd_ctl_add

Alexander Duyck <alexander.h.duyck@intel.com>
    ixgbe: Fix setting of TC configuration for macvlan case

Olga Kornievskaia <olga.kornievskaia@gmail.com>
    skip LAYOUTRETURN if layout is invalid

Stephen Hemminger <stephen@networkplumber.org>
    hv_netvsc: fix network namespace issues with VF support

Juergen Gross <jgross@suse.com>
    xen/netfront: raise max number of slots in xennet_get_responses()

Kenneth Feng <kenneth.feng@amd.com>
    drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2)

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    mm: check for SIGKILL inside dup_mmap() loop

Mark Rutland <mark.rutland@arm.com>
    kcov: ensure irq code sees a valid area

Petr Machata <petrm@mellanox.com>
    mlxsw: spectrum_switchdev: Fix port_vlan refcounting

Clint Taylor <clinton.a.taylor@intel.com>
    drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.

Johannes Weiner <hannes@cmpxchg.org>
    arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups

Steven Rostedt (VMware) <rostedt@goodmis.org>
    tracing: Quiet gcc warning about maybe unused link variable

Artem Savkov <asavkov@redhat.com>
    tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure

Snild Dolkow <snild@sony.com>
    kthread, tracing: Don't expose half-written comm when creating kthreads

Steven Rostedt (VMware) <rostedt@goodmis.org>
    tracing: Fix possible double free in event_enable_trigger_func()

Steven Rostedt (VMware) <rostedt@goodmis.org>
    tracing: Fix double free of event_trigger_data

Tejun Heo <tj@kernel.org>
    delayacct: fix crash in delayacct_blkio_end() after delayacct init failure

Shakeel Butt <shakeelb@google.com>
    kvm, mm: account shadow page tables to kmemcg

Dave Jiang <dave.jiang@intel.com>
    mm: disallow mappings that conflict for devm_memremap_pages()

KT Liao <kt.liao@emc.com.tw>
    Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST

Chen-Yu Tsai <wens@csie.org>
    Input: i8042 - add Lenovo LaVie Z to the i8042 reset list

Donald Shanty III <dshanty@protonmail.com>
    Input: elan_i2c - add ACPI ID for lenovo ideapad 330

Marek Szyprowski <m.szyprowski@samsung.com>
    spi: spi-s3c64xx: Fix system resume support


-------------

Diffstat:

 .../devicetree/bindings/net/dsa/qca8k.txt          |  23 +++-
 .../devicetree/bindings/net/meson-dwmac.txt        |   1 +
 .../devicetree/bindings/pinctrl/meson,pinctrl.txt  |   2 +
 .../devicetree/bindings/watchdog/renesas-wdt.txt   |   1 +
 Documentation/vfio-mediated-device.txt             |   5 +
 Makefile                                           |   4 +-
 arch/arm/boot/dts/emev2.dtsi                       |   5 +-
 arch/arm/boot/dts/imx53-ppd.dts                    |   2 -
 arch/arm/boot/dts/imx53.dtsi                       |   8 ++
 arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi     |   1 -
 arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi     |   1 -
 arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi     |   1 -
 arch/arm/boot/dts/imx6qdl-wandboard.dtsi           |   8 ++
 arch/arm/boot/dts/sh73a0.dtsi                      |   5 +-
 arch/arm/boot/dts/stih407-pinctrl.dtsi             |  10 +-
 arch/arm/boot/dts/stih410.dtsi                     |  18 +--
 arch/arm/net/bpf_jit_32.c                          |  10 +-
 arch/arm64/boot/dts/renesas/salvator-common.dtsi   |  38 +++---
 arch/arm64/configs/defconfig                       |   2 +
 arch/arm64/include/asm/cmpxchg.h                   |   4 +-
 arch/arm64/mm/init.c                               |   4 +-
 arch/microblaze/boot/Makefile                      |  10 +-
 arch/powerpc/include/asm/barrier.h                 |  15 +++
 arch/powerpc/include/asm/cache.h                   |   3 +
 arch/powerpc/include/asm/pkeys.h                   |   2 +
 arch/powerpc/kernel/eeh_driver.c                   |  28 +++--
 arch/powerpc/kernel/head_8xx.S                     |   2 +-
 arch/powerpc/kernel/pci_32.c                       |   1 +
 arch/powerpc/kernel/prom_init.c                    | 114 +++++++++---------
 arch/powerpc/lib/string.S                          |   7 +-
 arch/powerpc/mm/slb.c                              |   8 +-
 arch/powerpc/net/bpf_jit_comp64.c                  |  34 ++++--
 arch/powerpc/platforms/chrp/time.c                 |   6 +-
 arch/powerpc/platforms/embedded6xx/hlwd-pic.c      |   5 +
 arch/powerpc/platforms/powermac/bootx_init.c       |   4 +-
 arch/powerpc/platforms/powermac/setup.c            |   1 +
 arch/s390/include/asm/cpu_mf.h                     |   6 +-
 arch/sh/boards/mach-migor/setup.c                  |   2 +-
 arch/x86/events/intel/uncore.c                     |   2 +-
 arch/x86/events/intel/uncore_nhmex.c               |   2 +-
 arch/x86/kernel/cpu/microcode/core.c               |   6 +-
 arch/x86/kvm/mmu.c                                 |   2 +-
 arch/x86/kvm/svm.c                                 |   8 +-
 block/bfq-iosched.c                                |   2 -
 block/bio.c                                        |  19 ++-
 crypto/authenc.c                                   |   1 +
 crypto/authencesn.c                                |   1 +
 drivers/acpi/acpi_lpss.c                           |  32 +++--
 drivers/acpi/acpica/psloop.c                       |  19 +--
 drivers/acpi/pci_root.c                            |   4 +-
 drivers/ata/libata-eh.c                            |  12 +-
 drivers/bluetooth/btusb.c                          |   4 +
 drivers/bluetooth/hci_qca.c                        |   2 +-
 drivers/char/random.c                              |  10 +-
 drivers/clk/clk-si544.c                            |   1 +
 drivers/clk/ingenic/jz4770-cgu.c                   |   3 +-
 drivers/edac/altera_edac.c                         |   2 +-
 drivers/gpio/gpio-uniphier.c                       |   6 +-
 drivers/gpio/gpiolib-of.c                          |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c             |  17 +--
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |   8 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   8 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c  |   3 +
 .../amd/display/dc/dce110/dce110_hw_sequencer.c    |   4 +-
 drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c   |   7 +-
 drivers/gpu/drm/drm_atomic.c                       |   4 +-
 drivers/gpu/drm/drm_atomic_helper.c                |  78 ++++++------
 drivers/gpu/drm/drm_dp_mst_topology.c              |   9 +-
 drivers/gpu/drm/gma500/psb_intel_drv.h             |   2 +-
 drivers/gpu/drm/gma500/psb_intel_lvds.c            |   2 +-
 drivers/gpu/drm/i915/i915_drv.h                    |   1 +
 drivers/gpu/drm/i915/intel_ddi.c                   |  13 +-
 drivers/gpu/drm/i915/intel_display.c               |  21 +++-
 drivers/gpu/drm/i915/intel_drv.h                   |   3 +-
 drivers/gpu/drm/nouveau/nouveau_dma.c              |  10 +-
 drivers/gpu/drm/nouveau/nouveau_dma.h              |   5 +-
 drivers/gpu/drm/nouveau/nouveau_drm.c              |  30 +++--
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  19 ++-
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c   |   8 +-
 drivers/gpu/drm/radeon/radeon_connectors.c         |  10 +-
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c    |   9 ++
 drivers/gpu/drm/stm/ltdc.c                         |   3 -
 drivers/gpu/host1x/dev.c                           |  11 +-
 drivers/hid/hid-plantronics.c                      |   6 +-
 drivers/hid/i2c-hid/i2c-hid.c                      |   8 ++
 drivers/i2c/busses/i2c-rcar.c                      |  54 ++++++++-
 drivers/infiniband/core/mad.c                      |  11 +-
 drivers/infiniband/core/ucma.c                     |   6 +-
 drivers/infiniband/core/uverbs_cmd.c               |   5 +
 drivers/infiniband/sw/rdmavt/Kconfig               |   2 +-
 drivers/infiniband/sw/rxe/Kconfig                  |   1 +
 drivers/input/mouse/elan_i2c_core.c                |   2 +
 drivers/input/serio/i8042-x86ia64io.h              |   7 ++
 drivers/irqchip/irq-ls-scfg-msi.c                  |   3 +
 drivers/lightnvm/pblk-core.c                       |   6 +-
 drivers/lightnvm/pblk-rb.c                         |   5 +-
 drivers/lightnvm/pblk-read.c                       |   8 +-
 drivers/md/md.c                                    |   3 +
 drivers/md/raid1.c                                 |   2 +
 drivers/media/cec/cec-pin-error-inj.c              |  33 ++---
 drivers/media/common/siano/smsendian.c             |  14 +--
 drivers/media/common/videobuf2/videobuf2-core.c    |   9 +-
 drivers/media/i2c/smiapp/smiapp-core.c             |  11 +-
 drivers/media/media-device.c                       |  21 ++--
 drivers/media/pci/saa7164/saa7164-fw.c             |   3 +-
 drivers/media/pci/tw686x/tw686x-video.c            |   3 +-
 drivers/media/platform/omap3isp/isp.c              |   7 +-
 drivers/media/platform/rcar_jpu.c                  |   4 +-
 drivers/media/platform/renesas-ceu.c               |  20 ++-
 drivers/media/radio/si470x/radio-si470x-i2c.c      |   6 +-
 drivers/media/rc/ir-mce_kbd-decoder.c              |  12 +-
 drivers/media/usb/em28xx/em28xx-dvb.c              |   4 +-
 drivers/memory/tegra/mc.c                          |  22 +---
 drivers/memory/tegra/mc.h                          |   9 ++
 drivers/memory/tegra/tegra114.c                    |   2 +
 drivers/memory/tegra/tegra124.c                    |   6 +
 drivers/memory/tegra/tegra210.c                    |   3 +
 drivers/memory/tegra/tegra30.c                     |   2 +
 drivers/mfd/cros_ec.c                              |   6 +-
 drivers/mmc/core/pwrseq_simple.c                   |  14 ++-
 drivers/mmc/host/dw_mmc.c                          |   4 +
 drivers/mmc/host/sdhci-omap.c                      |  17 ++-
 drivers/mtd/nand/raw/fsl_ifc_nand.c                |  17 +--
 drivers/net/dsa/qca8k.c                            |  52 +++++++-
 drivers/net/dsa/qca8k.h                            |   7 +-
 drivers/net/ethernet/amazon/ena/ena_com.c          |   1 +
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   5 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c    |   3 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c    |   2 +
 drivers/net/ethernet/hisilicon/hns3/hnae3.c        |   1 +
 drivers/net/ethernet/hisilicon/hns3/hnae3.h        |   2 +
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |   5 +
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h    |   2 +
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  17 +--
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h    |   2 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  |  28 +++--
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h  |   2 +-
 drivers/net/ethernet/intel/e1000e/netdev.c         |  15 +--
 drivers/net/ethernet/intel/i40e/i40e.h             |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c     |   4 +-
 drivers/net/ethernet/intel/i40e/i40e_ptp.c         |  48 +++++---
 drivers/net/ethernet/intel/igb/igb_main.c          |   9 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c       |   8 ++
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |   8 --
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c  |   1 +
 drivers/net/ethernet/marvell/mvpp2.c               |   3 +
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |  14 +--
 .../ethernet/mellanox/mlxsw/spectrum_switchdev.c   |   4 +-
 drivers/net/ethernet/socionext/netsec.c            |  23 ++--
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   2 +-
 drivers/net/ethernet/ti/cpsw-phy-sel.c             |   8 +-
 drivers/net/hyperv/hyperv_net.h                    |   2 +
 drivers/net/hyperv/netvsc_drv.c                    |  43 +++----
 drivers/net/netdevsim/devlink.c                    |   1 +
 drivers/net/phy/mdio-mux-bcm-iproc.c               |   2 +-
 drivers/net/phy/phylink.c                          |   2 +
 drivers/net/phy/sfp-bus.c                          |   7 ++
 drivers/net/usb/lan78xx.c                          |   2 +
 drivers/net/virtio_net.c                           |  41 ++++---
 drivers/net/wireless/ath/ath10k/core.c             | 134 +++++++++++----------
 drivers/net/wireless/ath/ath10k/debug.c            |   8 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |   6 +
 drivers/net/wireless/ath/ath10k/wmi.h              |   2 +-
 drivers/net/wireless/ath/regd.h                    |   5 +
 drivers/net/wireless/ath/regd_common.h             |  13 ++
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |   1 +
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs.c        |  38 +++---
 drivers/net/wireless/intel/iwlwifi/mvm/rs.h        |   7 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c       |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.h       |  10 +-
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c       |   2 +
 drivers/net/wireless/marvell/mwifiex/usb.c         |   3 +
 drivers/net/wireless/marvell/mwifiex/util.c        |   8 +-
 drivers/net/wireless/mediatek/mt76/mt76x2_init.c   |   3 +
 drivers/net/wireless/mediatek/mt76/mt76x2_main.c   |   3 +-
 drivers/net/wireless/mediatek/mt76/mt76x2_phy.c    |   6 +-
 drivers/net/wireless/mediatek/mt76/tx.c            |   2 +
 drivers/net/wireless/quantenna/qtnfmac/cfg80211.c  |  21 ++--
 drivers/net/wireless/quantenna/qtnfmac/event.c     |   8 +-
 .../net/wireless/quantenna/qtnfmac/pearl/pcie.c    |   4 +
 drivers/net/wireless/rsi/rsi_91x_hal.c             |  35 +++---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c        |   7 +-
 drivers/net/wireless/rsi/rsi_91x_sdio.c            |  23 ++--
 drivers/net/wireless/rsi/rsi_sdio.h                |   2 +-
 drivers/net/wireless/ti/wlcore/sdio.c              |   5 +
 drivers/net/xen-netfront.c                         |  10 +-
 drivers/nvme/host/pci.c                            |  16 ++-
 drivers/nvme/host/rdma.c                           |  10 +-
 drivers/nvme/target/fc.c                           |  44 +++++--
 drivers/nvmem/core.c                               |   7 ++
 drivers/pci/pci-sysfs.c                            |  15 ++-
 drivers/pci/pcie/aspm.c                            |   9 ++
 drivers/pci/pcie/dpc.c                             |   5 +-
 drivers/pci/probe.c                                |   4 +-
 drivers/perf/arm-cci.c                             |   6 +-
 drivers/perf/arm-ccn.c                             |  20 +--
 drivers/pinctrl/pinctrl-at91-pio4.c                |   4 +-
 drivers/pinctrl/qcom/pinctrl-msm.c                 |  23 +++-
 drivers/platform/x86/dell-smbios-base.c            |   5 +-
 drivers/regulator/cpcap-regulator.c                |   2 +-
 drivers/regulator/internal.h                       |   9 +-
 drivers/regulator/of_regulator.c                   |  13 +-
 drivers/regulator/pfuze100-regulator.c             |   1 +
 drivers/regulator/twl-regulator.c                  |   2 +-
 drivers/rtc/interface.c                            |   5 +
 drivers/rtc/rtc-tps6586x.c                         |  14 ++-
 drivers/rtc/rtc-tps65910.c                         |  12 +-
 drivers/rtc/rtc-vr41xx.c                           |   9 +-
 drivers/s390/scsi/zfcp_dbf.c                       |   2 +
 drivers/scsi/3w-9xxx.c                             |   5 +
 drivers/scsi/3w-xxxx.c                             |   3 +
 drivers/scsi/cxlflash/main.c                       |  11 +-
 drivers/scsi/cxlflash/sislite.h                    |   1 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  11 +-
 drivers/scsi/megaraid.c                            |   3 +
 drivers/scsi/megaraid/megaraid_sas_fusion.c        |   3 +
 drivers/scsi/qedf/qedf_main.c                      |  10 ++
 drivers/scsi/scsi_dh.c                             |   5 +-
 drivers/scsi/ufs/ufshcd.c                          |  28 ++++-
 drivers/soc/imx/gpcv2.c                            |  22 ++--
 drivers/soc/qcom/qmi_interface.c                   |   5 +-
 drivers/soc/qcom/smem.c                            |  27 +++--
 drivers/soc/tegra/pmc.c                            |  20 +--
 drivers/spi/spi-meson-spicc.c                      |  11 +-
 drivers/spi/spi-s3c64xx.c                          |   4 +-
 drivers/spi/spi-sh-msiof.c                         |   6 +-
 drivers/spi/spi.c                                  |   1 +
 drivers/staging/ks7010/ks7010_sdio.c               |   3 +
 .../staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c    |   2 +-
 .../staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c |  30 ++---
 drivers/staging/lustre/lustre/ldlm/ldlm_lock.c     |   6 +-
 drivers/staging/lustre/lustre/llite/xattr.c        |   6 +-
 drivers/staging/media/atomisp/i2c/atomisp-ov2680.c |   6 +-
 drivers/staging/media/atomisp/i2c/gc2235.h         |   9 +-
 drivers/staging/media/atomisp/i2c/ov2680.h         |   5 +-
 drivers/staging/media/atomisp/i2c/ov2722.h         |   6 +
 drivers/staging/media/atomisp/i2c/ov5693/ov5693.h  |  18 ++-
 .../atomisp/pci/atomisp2/atomisp_compat_ioctl32.c  |  49 ++++----
 drivers/staging/most/cdev/cdev.c                   |   6 +-
 .../vc04_services/interface/vchiq_arm/vchiq_core.c |   1 +
 drivers/thermal/samsung/exynos_tmu.c               |   1 +
 drivers/tty/hvc/hvc_opal.c                         |   1 -
 drivers/tty/pty.c                                  |   3 +
 drivers/usb/core/hub.c                             |   4 +
 drivers/vfio/mdev/mdev_core.c                      | 102 ++++++----------
 drivers/vfio/mdev/mdev_private.h                   |   2 +-
 drivers/vfio/platform/vfio_platform_common.c       |  15 ++-
 drivers/vfio/vfio_iommu_type1.c                    |  73 +++++++----
 drivers/video/backlight/pwm_bl.c                   |   6 +-
 drivers/watchdog/da9063_wdt.c                      |  17 ++-
 fs/block_dev.c                                     |   9 +-
 fs/btrfs/inode.c                                   |  33 +++--
 fs/btrfs/qgroup.c                                  |  19 +++
 fs/btrfs/tree-log.c                                |  10 +-
 fs/ceph/super.c                                    |  13 +-
 fs/crypto/crypto.c                                 |  11 +-
 fs/ext4/balloc.c                                   |   3 +
 fs/ext4/ialloc.c                                   |   8 +-
 fs/ext4/inline.c                                   |  19 +--
 fs/ext4/inode.c                                    |  16 ++-
 fs/ext4/super.c                                    |  13 +-
 fs/f2fs/data.c                                     |  14 ++-
 fs/f2fs/f2fs.h                                     |   8 +-
 fs/f2fs/file.c                                     |  20 ++-
 fs/f2fs/gc.c                                       |  11 +-
 fs/f2fs/segment.c                                  |   5 +
 fs/f2fs/super.c                                    |   6 +
 fs/fcntl.c                                         |  15 ++-
 fs/nfs/inode.c                                     |   3 +-
 fs/nfs/nfs4proc.c                                  |  14 ++-
 fs/nfs/pnfs.c                                      |   6 +-
 fs/nfsd/nfs4state.c                                |   5 +-
 fs/nfsd/nfs4xdr.c                                  |   2 +
 fs/proc/task_mmu.c                                 |  30 +++--
 fs/squashfs/cache.c                                |   3 +
 fs/squashfs/file.c                                 |   8 +-
 fs/squashfs/fragment.c                             |   4 +-
 fs/squashfs/squashfs_fs.h                          |   6 +
 include/drm/drm_dp_helper.h                        |   1 +
 include/linux/delayacct.h                          |   4 +-
 include/linux/dma-iommu.h                          |   1 +
 include/linux/fs.h                                 |   2 +-
 include/linux/memcontrol.h                         |  23 +++-
 include/linux/mm.h                                 |   9 +-
 include/linux/mmc/sdio_ids.h                       |   1 +
 include/linux/netfilter/ipset/ip_set_timeout.h     |  10 +-
 include/linux/regulator/consumer.h                 |   1 +
 include/linux/serial_core.h                        |   3 +-
 include/net/tcp.h                                  |   2 +-
 include/soc/tegra/mc.h                             |   2 +
 include/uapi/sound/asoc.h                          |  23 +++-
 ipc/msg.c                                          |   6 +-
 ipc/sem.c                                          |   6 +-
 kernel/auditfilter.c                               |   2 +-
 kernel/auditsc.c                                   |   2 +
 kernel/bpf/syscall.c                               |  37 +++++-
 kernel/bpf/verifier.c                              |   4 +-
 kernel/delayacct.c                                 |  17 +--
 kernel/fork.c                                      |   8 ++
 kernel/hung_task.c                                 |  11 +-
 kernel/kcov.c                                      |   3 +-
 kernel/kthread.c                                   |   8 +-
 kernel/memremap.c                                  |  18 ++-
 kernel/power/suspend.c                             |  14 +--
 kernel/printk/printk_safe.c                        |   2 +-
 kernel/sched/cpufreq_schedutil.c                   |  17 ++-
 kernel/stop_machine.c                              |  24 ++--
 kernel/time/clocksource.c                          |   4 +-
 kernel/trace/trace_events_trigger.c                |  18 ++-
 kernel/trace/trace_kprobe.c                        |  15 ++-
 lib/dma-direct.c                                   |   7 ++
 mm/slub.c                                          |   2 +-
 mm/vmalloc.c                                       |   3 +-
 net/core/dev.c                                     |  17 +--
 net/ipv4/fib_frontend.c                            |   4 +-
 net/ipv4/ipconfig.c                                |  13 ++
 net/ipv4/tcp_bbr.c                                 |   4 +
 net/ipv4/tcp_dctcp.c                               |   4 +-
 net/ipv4/tcp_input.c                               |  57 +++++----
 net/netfilter/ipset/ip_set_hash_gen.h              |   5 +-
 net/netfilter/nf_tables_api.c                      |  11 +-
 net/netlink/af_netlink.c                           |   5 +
 net/rds/ib_frmr.c                                  |   5 +
 net/rds/ib_mr.h                                    |   3 +-
 net/rds/ib_rdma.c                                  |  21 ++--
 net/rds/rdma.c                                     |  13 +-
 net/rds/rds.h                                      |   5 +-
 net/rds/send.c                                     |  12 +-
 net/rxrpc/conn_event.c                             |   2 +-
 security/integrity/ima/ima_main.c                  |   1 +
 sound/pci/emu10k1/emupcm.c                         |   4 +-
 sound/pci/emu10k1/memory.c                         |   6 +-
 sound/pci/fm801.c                                  |  16 ++-
 sound/pci/hda/patch_ca0132.c                       |   8 +-
 sound/soc/fsl/fsl_ssi.c                            |   3 +-
 sound/soc/soc-compress.c                           |  52 ++++----
 sound/soc/soc-pcm.c                                |   6 +-
 sound/soc/soc-topology.c                           |  19 ++-
 sound/usb/pcm.c                                    |   2 +-
 tools/perf/util/parse-events.y                     |  14 ++-
 tools/testing/selftests/filesystems/Makefile       |   1 +
 tools/testing/selftests/filesystems/devpts_pts.c   |  13 +-
 tools/testing/selftests/intel_pstate/run.sh        |  29 +++--
 tools/testing/selftests/kvm/lib/assert.c           |   9 +-
 tools/testing/selftests/kvm/vmx_tsc_adjust_test.c  |   2 +
 tools/testing/selftests/memfd/run_tests.sh         |  14 ++-
 tools/usb/usbip/libsrc/vhci_driver.c               |  32 +++--
 tools/usb/usbip/libsrc/vhci_driver.h               |   3 +-
 tools/usb/usbip/src/usbip_detach.c                 |   9 +-
 351 files changed, 2495 insertions(+), 1300 deletions(-)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 001/336] spi: spi-s3c64xx: Fix system resume support
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski,
	Krzysztof Kozlowski, Mark Brown, Sudip Mukherjee

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Szyprowski <m.szyprowski@samsung.com>

commit e935dba111621bd6a0c5d48e6511a4d9885103b4 upstream.

Since Linux v4.10 release (commit 1d9174fbc55e "PM / Runtime: Defer
resuming of the device in pm_runtime_force_resume()"),
pm_runtime_force_resume() function doesn't runtime resume device if it was
not runtime active before system suspend. Thus, driver should not do any
register access after pm_runtime_force_resume() without checking the
runtime status of the device. To fix this issue, simply move
s3c64xx_spi_hwinit() call to s3c64xx_spi_runtime_resume() to ensure that
hardware is always properly initialized. This fixes Synchronous external
abort issue on system suspend/resume cycle on newer Exynos SoCs.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-s3c64xx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1260,8 +1260,6 @@ static int s3c64xx_spi_resume(struct dev
 	if (ret < 0)
 		return ret;
 
-	s3c64xx_spi_hwinit(sdd, sdd->port_id);
-
 	return spi_master_resume(master);
 }
 #endif /* CONFIG_PM_SLEEP */
@@ -1299,6 +1297,8 @@ static int s3c64xx_spi_runtime_resume(st
 	if (ret != 0)
 		goto err_disable_src_clk;
 
+	s3c64xx_spi_hwinit(sdd, sdd->port_id);
+
 	return 0;
 
 err_disable_src_clk:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 001/336] spi: spi-s3c64xx: Fix system resume support Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 003/336] Input: i8042 - add Lenovo LaVie Z to the i8042 reset list Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Donald Shanty III, Dmitry Torokhov

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donald Shanty III <dshanty@protonmail.com>

commit 938f45008d8bc391593c97508bc798cc95a52b9b upstream.

This allows Elan driver to bind to the touchpad found in Lenovo Ideapad 330
series laptops.

Signed-off-by: Donald Shanty III <dshanty@protonmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/elan_i2c_core.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1264,6 +1264,7 @@ static const struct acpi_device_id elan_
 	{ "ELAN0611", 0 },
 	{ "ELAN0612", 0 },
 	{ "ELAN0618", 0 },
+	{ "ELAN061D", 0 },
 	{ "ELAN1000", 0 },
 	{ }
 };



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 003/336] Input: i8042 - add Lenovo LaVie Z to the i8042 reset list
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 001/336] spi: spi-s3c64xx: Fix system resume support Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 004/336] Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Dmitry Torokhov

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <wens@csie.org>

commit 384cf4285b34e08917e3e66603382f2b0c4f6e1b upstream.

The Lenovo LaVie Z laptop requires i8042 to be reset in order to
consistently detect its Elantech touchpad. The nomux and kbdreset
quirks are not sufficient.

It's possible the other LaVie Z models from NEC require this as well.

Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -527,6 +527,13 @@ static const struct dmi_system_id __init
 			DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
 		},
 	},
+	{
+		/* Lenovo LaVie Z */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+		},
+	},
 	{ }
 };
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 004/336] Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 003/336] Input: i8042 - add Lenovo LaVie Z to the i8042 reset list Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 005/336] mm: disallow mappings that conflict for devm_memremap_pages() Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, KT Liao, Anant Shende, Dmitry Torokhov

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: KT Liao <kt.liao@emc.com.tw>

commit 6f88a6439da5d94de334a341503bc2c7f4a7ea7f upstream.

Add ELAN0622 to ACPI mapping table to support Elan touchpad found in
Ideapad 330-15AST.

Signed-off-by: KT Liao <kt.liao@emc.com.tw>
Reported-by: Anant Shende <anantshende@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/elan_i2c_core.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1265,6 +1265,7 @@ static const struct acpi_device_id elan_
 	{ "ELAN0612", 0 },
 	{ "ELAN0618", 0 },
 	{ "ELAN061D", 0 },
+	{ "ELAN0622", 0 },
 	{ "ELAN1000", 0 },
 	{ }
 };



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 005/336] mm: disallow mappings that conflict for devm_memremap_pages()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 004/336] Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 007/336] delayacct: fix crash in delayacct_blkio_end() after delayacct init failure Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dave Jiang, Dan Williams,
	Robert Elliott, Jeff Moyer, Matthew Wilcox, Andrew Morton,
	Linus Torvalds

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Jiang <dave.jiang@intel.com>

commit 15d36fecd0bdc7510b70a0e5ec6671140b3fce0c upstream.

When pmem namespaces created are smaller than section size, this can
cause an issue during removal and gpf was observed:

  general protection fault: 0000 1 SMP PTI
  CPU: 36 PID: 3941 Comm: ndctl Tainted: G W 4.14.28-1.el7uek.x86_64 #2
  task: ffff88acda150000 task.stack: ffffc900233a4000
  RIP: 0010:__put_page+0x56/0x79
  Call Trace:
    devm_memremap_pages_release+0x155/0x23a
    release_nodes+0x21e/0x260
    devres_release_all+0x3c/0x48
    device_release_driver_internal+0x15c/0x207
    device_release_driver+0x12/0x14
    unbind_store+0xba/0xd8
    drv_attr_store+0x27/0x31
    sysfs_kf_write+0x3f/0x46
    kernfs_fop_write+0x10f/0x18b
    __vfs_write+0x3a/0x16d
    vfs_write+0xb2/0x1a1
    SyS_write+0x55/0xb9
    do_syscall_64+0x79/0x1ae
    entry_SYSCALL_64_after_hwframe+0x3d/0x0

Add code to check whether we have a mapping already in the same section
and prevent additional mappings from being created if that is the case.

Link: http://lkml.kernel.org/r/152909478401.50143.312364396244072931.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Robert Elliott <elliott@hpe.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/memremap.c |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -348,10 +348,27 @@ void *devm_memremap_pages(struct device
 	unsigned long pfn, pgoff, order;
 	pgprot_t pgprot = PAGE_KERNEL;
 	int error, nid, is_ram;
+	struct dev_pagemap *conflict_pgmap;
 
 	align_start = res->start & ~(SECTION_SIZE - 1);
 	align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
 		- align_start;
+	align_end = align_start + align_size - 1;
+
+	conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_start), NULL);
+	if (conflict_pgmap) {
+		dev_WARN(dev, "Conflicting mapping in same section\n");
+		put_dev_pagemap(conflict_pgmap);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_end), NULL);
+	if (conflict_pgmap) {
+		dev_WARN(dev, "Conflicting mapping in same section\n");
+		put_dev_pagemap(conflict_pgmap);
+		return ERR_PTR(-ENOMEM);
+	}
+
 	is_ram = region_intersects(align_start, align_size,
 		IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);
 
@@ -371,7 +388,6 @@ void *devm_memremap_pages(struct device
 
 	mutex_lock(&pgmap_lock);
 	error = 0;
-	align_end = align_start + align_size - 1;
 
 	foreach_order_pgoff(res, order, pgoff) {
 		error = __radix_tree_insert(&pgmap_radix,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 007/336] delayacct: fix crash in delayacct_blkio_end() after delayacct init failure
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 005/336] mm: disallow mappings that conflict for devm_memremap_pages() Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 008/336] tracing: Fix double free of event_trigger_data Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tejun Heo, Dave Jones, Andrew Morton,
	Josh Snyder, Linus Torvalds

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit b512719f771a82180211c9a315b8a7f628832b3d upstream.

While forking, if delayacct init fails due to memory shortage, it
continues expecting all delayacct users to check task->delays pointer
against NULL before dereferencing it, which all of them used to do.

Commit c96f5471ce7d ("delayacct: Account blkio completion on the correct
task"), while updating delayacct_blkio_end() to take the target task
instead of always using %current, made the function test NULL on
%current->delays and then continue to operated on @p->delays.  If
%current succeeded init while @p didn't, it leads to the following
crash.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: __delayacct_blkio_end+0xc/0x40
 PGD 8000001fd07e1067 P4D 8000001fd07e1067 PUD 1fcffbb067 PMD 0
 Oops: 0000 [#1] SMP PTI
 CPU: 4 PID: 25774 Comm: QIOThread0 Not tainted 4.16.0-9_fbk1_rc2_1180_g6b593215b4d7 #9
 RIP: 0010:__delayacct_blkio_end+0xc/0x40
 Call Trace:
  try_to_wake_up+0x2c0/0x600
  autoremove_wake_function+0xe/0x30
  __wake_up_common+0x74/0x120
  wake_up_page_bit+0x9c/0xe0
  mpage_end_io+0x27/0x70
  blk_update_request+0x78/0x2c0
  scsi_end_request+0x2c/0x1e0
  scsi_io_completion+0x20b/0x5f0
  blk_mq_complete_request+0xa2/0x100
  ata_scsi_qc_complete+0x79/0x400
  ata_qc_complete_multiple+0x86/0xd0
  ahci_handle_port_interrupt+0xc9/0x5c0
  ahci_handle_port_intr+0x54/0xb0
  ahci_single_level_irq_intr+0x3b/0x60
  __handle_irq_event_percpu+0x43/0x190
  handle_irq_event_percpu+0x20/0x50
  handle_irq_event+0x2a/0x50
  handle_edge_irq+0x80/0x1c0
  handle_irq+0xaf/0x120
  do_IRQ+0x41/0xc0
  common_interrupt+0xf/0xf

Fix it by updating delayacct_blkio_end() check @p->delays instead.

Link: http://lkml.kernel.org/r/20180724175542.GP1934745@devbig577.frc2.facebook.com
Fixes: c96f5471ce7d ("delayacct: Account blkio completion on the correct task")
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Dave Jones <dsj@fb.com>
Debugged-by: Dave Jones <dsj@fb.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Josh Snyder <joshs@netflix.com>
Cc: <stable@vger.kernel.org>	[4.15+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/delayacct.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start
 
 static inline void delayacct_blkio_end(struct task_struct *p)
 {
-	if (current->delays)
+	if (p->delays)
 		__delayacct_blkio_end(p);
 	delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 008/336] tracing: Fix double free of event_trigger_data
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 007/336] delayacct: fix crash in delayacct_blkio_end() after delayacct init failure Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 009/336] tracing: Fix possible double free in event_enable_trigger_func() Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Masami Hiramatsu,
	Steven Rostedt (VMware)

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit 1863c387259b629e4ebfb255495f67cd06aa229b upstream.

Running the following:

 # cd /sys/kernel/debug/tracing
 # echo 500000 > buffer_size_kb
[ Or some other number that takes up most of memory ]
 # echo snapshot > events/sched/sched_switch/trigger

Triggers the following bug:

 ------------[ cut here ]------------
 kernel BUG at mm/slub.c:296!
 invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
 CPU: 6 PID: 6878 Comm: bash Not tainted 4.18.0-rc6-test+ #1066
 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016
 RIP: 0010:kfree+0x16c/0x180
 Code: 05 41 0f b6 72 51 5b 5d 41 5c 4c 89 d7 e9 ac b3 f8 ff 48 89 d9 48 89 da 41 b8 01 00 00 00 5b 5d 41 5c 4c 89 d6 e9 f4 f3 ff ff <0f> 0b 0f 0b 48 8b 3d d9 d8 f9 00 e9 c1 fe ff ff 0f 1f 40 00 0f 1f
 RSP: 0018:ffffb654436d3d88 EFLAGS: 00010246
 RAX: ffff91a9d50f3d80 RBX: ffff91a9d50f3d80 RCX: ffff91a9d50f3d80
 RDX: 00000000000006a4 RSI: ffff91a9de5a60e0 RDI: ffff91a9d9803500
 RBP: ffffffff8d267c80 R08: 00000000000260e0 R09: ffffffff8c1a56be
 R10: fffff0d404543cc0 R11: 0000000000000389 R12: ffffffff8c1a56be
 R13: ffff91a9d9930e18 R14: ffff91a98c0c2890 R15: ffffffff8d267d00
 FS:  00007f363ea64700(0000) GS:ffff91a9de580000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 000055c1cacc8e10 CR3: 00000000d9b46003 CR4: 00000000001606e0
 Call Trace:
  event_trigger_callback+0xee/0x1d0
  event_trigger_write+0xfc/0x1a0
  __vfs_write+0x33/0x190
  ? handle_mm_fault+0x115/0x230
  ? _cond_resched+0x16/0x40
  vfs_write+0xb0/0x190
  ksys_write+0x52/0xc0
  do_syscall_64+0x5a/0x160
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
 RIP: 0033:0x7f363e16ab50
 Code: 73 01 c3 48 8b 0d 38 83 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 79 db 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e e3 01 00 48 89 04 24
 RSP: 002b:00007fff9a4c6378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
 RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f363e16ab50
 RDX: 0000000000000009 RSI: 000055c1cacc8e10 RDI: 0000000000000001
 RBP: 000055c1cacc8e10 R08: 00007f363e435740 R09: 00007f363ea64700
 R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000009
 R13: 0000000000000001 R14: 00007f363e4345e0 R15: 00007f363e4303c0
 Modules linked in: ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq snd_seq_device i915 snd_pcm snd_timer i2c_i801 snd soundcore i2c_algo_bit drm_kms_helper
86_pkg_temp_thermal video kvm_intel kvm irqbypass wmi e1000e
 ---[ end trace d301afa879ddfa25 ]---

The cause is because the register_snapshot_trigger() call failed to
allocate the snapshot buffer, and then called unregister_trigger()
which freed the data that was passed to it. Then on return to the
function that called register_snapshot_trigger(), as it sees it
failed to register, it frees the trigger_data again and causes
a double free.

By calling event_trigger_init() on the trigger_data (which only ups
the reference counter for it), and then event_trigger_free() afterward,
the trigger_data would not get freed by the registering trigger function
as it would only up and lower the ref count for it. If the register
trigger function fails, then the event_trigger_free() called after it
will free the trigger data normally.

Link: http://lkml.kernel.org/r/20180724191331.738eb819@gandalf.local.home

Cc: stable@vger.kerne.org
Fixes: 93e31ffbf417 ("tracing: Add 'snapshot' event trigger command")
Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_events_trigger.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -681,6 +681,8 @@ event_trigger_callback(struct event_comm
 		goto out_free;
 
  out_reg:
+	/* Up the trigger_data count to make sure reg doesn't free it on failure */
+	event_trigger_init(trigger_ops, trigger_data);
 	ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
 	/*
 	 * The above returns on success the # of functions enabled,
@@ -688,11 +690,13 @@ event_trigger_callback(struct event_comm
 	 * Consider no functions a failure too.
 	 */
 	if (!ret) {
+		cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
 		ret = -ENOENT;
-		goto out_free;
-	} else if (ret < 0)
-		goto out_free;
-	ret = 0;
+	} else if (ret > 0)
+		ret = 0;
+
+	/* Down the counter of trigger_data or free it if not used anymore */
+	event_trigger_free(trigger_ops, trigger_data);
  out:
 	return ret;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 009/336] tracing: Fix possible double free in event_enable_trigger_func()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 008/336] tracing: Fix double free of event_trigger_data Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 010/336] kthread, tracing: Dont expose half-written comm when creating kthreads Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware)

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit 15cc78644d0075e76d59476a4467e7143860f660 upstream.

There was a case that triggered a double free in event_trigger_callback()
due to the called reg() function freeing the trigger_data and then it
getting freed again by the error return by the caller. The solution there
was to up the trigger_data ref count.

Code inspection found that event_enable_trigger_func() has the same issue,
but is not as easy to trigger (requires harder to trigger failures). It
needs to be solved slightly different as it needs more to clean up when the
reg() function fails.

Link: http://lkml.kernel.org/r/20180725124008.7008e586@gandalf.local.home

Cc: stable@vger.kernel.org
Fixes: 7862ad1846e99 ("tracing: Add 'enable_event' and 'disable_event' event trigger commands")
Reivewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_events_trigger.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1422,6 +1422,9 @@ int event_enable_trigger_func(struct eve
 		goto out;
 	}
 
+	/* Up the trigger_data count to make sure nothing frees it on failure */
+	event_trigger_init(trigger_ops, trigger_data);
+
 	if (trigger) {
 		number = strsep(&trigger, ":");
 
@@ -1472,6 +1475,7 @@ int event_enable_trigger_func(struct eve
 		goto out_disable;
 	/* Just return zero, not the number of enabled functions */
 	ret = 0;
+	event_trigger_free(trigger_ops, trigger_data);
  out:
 	return ret;
 
@@ -1482,7 +1486,7 @@ int event_enable_trigger_func(struct eve
  out_free:
 	if (cmd_ops->set_filter)
 		cmd_ops->set_filter(NULL, trigger_data, NULL);
-	kfree(trigger_data);
+	event_trigger_free(trigger_ops, trigger_data);
 	kfree(enable_data);
 	goto out;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 010/336] kthread, tracing: Dont expose half-written comm when creating kthreads
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 009/336] tracing: Fix possible double free in event_enable_trigger_func() Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 011/336] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware), Snild Dolkow

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Snild Dolkow <snild@sony.com>

commit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream.

There is a window for racing when printing directly to task->comm,
allowing other threads to see a non-terminated string. The vsnprintf
function fills the buffer, counts the truncated chars, then finally
writes the \0 at the end.

	creator                     other
	vsnprintf:
	  fill (not terminated)
	  count the rest            trace_sched_waking(p):
	  ...                         memcpy(comm, p->comm, TASK_COMM_LEN)
	  write \0

The consequences depend on how 'other' uses the string. In our case,
it was copied into the tracing system's saved cmdlines, a buffer of
adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):

	crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'
	0xffffffd5b3818640:     "irq/497-pwr_evenkworker/u16:12"

...and a strcpy out of there would cause stack corruption:

	[224761.522292] Kernel panic - not syncing: stack-protector:
	    Kernel stack is corrupted in: ffffff9bf9783c78

	crash-arm64> kbt | grep 'comm\|trace_print_context'
	#6  0xffffff9bf9783c78 in trace_print_context+0x18c(+396)
	      comm (char [16]) =  "irq/497-pwr_even"

	crash-arm64> rd 0xffffffd4d0e17d14 8
	ffffffd4d0e17d14:  2f71726900000000 5f7277702d373934   ....irq/497-pwr_
	ffffffd4d0e17d24:  726f776b6e657665 3a3631752f72656b   evenkworker/u16:
	ffffffd4d0e17d34:  f9780248ff003231 cede60e0ffffff9b   12..H.x......`..
	ffffffd4d0e17d44:  cede60c8ffffffd4 00000fffffffffd4   .....`..........

The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was
likely needed because of this same bug.

Solved by vsnprintf:ing to a local buffer, then using set_task_comm().
This way, there won't be a window where comm is not terminated.

Link: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com

Cc: stable@vger.kernel.org
Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure")
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Snild Dolkow <snild@sony.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/kthread.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -319,8 +319,14 @@ struct task_struct *__kthread_create_on_
 	task = create->result;
 	if (!IS_ERR(task)) {
 		static const struct sched_param param = { .sched_priority = 0 };
+		char name[TASK_COMM_LEN];
 
-		vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
+		/*
+		 * task is already visible to other tasks, so updating
+		 * COMM must be protected.
+		 */
+		vsnprintf(name, sizeof(name), namefmt, args);
+		set_task_comm(task, name);
 		/*
 		 * root may have changed our (kthreadd's) priority or CPU mask.
 		 * The kernel thread should not inherit these properties.



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 011/336] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 010/336] kthread, tracing: Dont expose half-written comm when creating kthreads Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 012/336] tracing: Quiet gcc warning about maybe unused link variable Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Masami Hiramatsu,
	Josh Poimboeuf, Artem Savkov, Steven Rostedt (VMware)

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Artem Savkov <asavkov@redhat.com>

commit 57ea2a34adf40f3a6e88409aafcf803b8945619a upstream.

If enable_trace_kprobe fails to enable the probe in enable_k(ret)probe
it returns an error, but does not unset the tp flags it set previously.
This results in a probe being considered enabled and failures like being
unable to remove the probe through kprobe_events file since probes_open()
expects every probe to be disabled.

Link: http://lkml.kernel.org/r/20180725102826.8300-1-asavkov@redhat.com
Link: http://lkml.kernel.org/r/20180725142038.4765-1-asavkov@redhat.com

Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 41a7dd420c57 ("tracing/kprobes: Support ftrace_event_file base multibuffer")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_kprobe.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -400,11 +400,10 @@ static struct trace_kprobe *find_trace_k
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
+	struct event_file_link *link;
 	int ret = 0;
 
 	if (file) {
-		struct event_file_link *link;
-
 		link = kmalloc(sizeof(*link), GFP_KERNEL);
 		if (!link) {
 			ret = -ENOMEM;
@@ -424,6 +423,16 @@ enable_trace_kprobe(struct trace_kprobe
 		else
 			ret = enable_kprobe(&tk->rp.kp);
 	}
+
+	if (ret) {
+		if (file) {
+			list_del_rcu(&link->list);
+			kfree(link);
+			tk->tp.flags &= ~TP_FLAG_TRACE;
+		} else {
+			tk->tp.flags &= ~TP_FLAG_PROFILE;
+		}
+	}
  out:
 	return ret;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 012/336] tracing: Quiet gcc warning about maybe unused link variable
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 011/336] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 013/336] arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Steven Rostedt (VMware)

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit 2519c1bbe38d7acacc9aacba303ca6f97482ed53 upstream.

Commit 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on
enable_trace_kprobe() failure") added an if statement that depends on another
if statement that gcc doesn't see will initialize the "link" variable and
gives the warning:

 "warning: 'link' may be used uninitialized in this function"

It is really a false positive, but to quiet the warning, and also to make
sure that it never actually is used uninitialized, initialize the "link"
variable to NULL and add an if (!WARN_ON_ONCE(!link)) where the compiler
thinks it could be used uninitialized.

Cc: stable@vger.kernel.org
Fixes: 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure")
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_kprobe.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -400,7 +400,7 @@ static struct trace_kprobe *find_trace_k
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
-	struct event_file_link *link;
+	struct event_file_link *link = NULL;
 	int ret = 0;
 
 	if (file) {
@@ -426,7 +426,9 @@ enable_trace_kprobe(struct trace_kprobe
 
 	if (ret) {
 		if (file) {
-			list_del_rcu(&link->list);
+			/* Notice the if is true on not WARN() */
+			if (!WARN_ON_ONCE(!link))
+				list_del_rcu(&link->list);
 			kfree(link);
 			tk->tp.flags &= ~TP_FLAG_TRACE;
 		} else {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 013/336] arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 012/336] tracing: Quiet gcc warning about maybe unused link variable Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 014/336] drm/i915/glk: Add Quirk for GLK NUC HDMI port issues Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Johannes Weiner, Will Deacon

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Weiner <hannes@cmpxchg.org>

commit 7b0eb6b41a08fa1fa0d04b1c53becd62b5fbfaee upstream.

Arnd reports the following arm64 randconfig build error with the PSI
patches that add another page flag:

  /git/arm-soc/arch/arm64/mm/init.c: In function 'mem_init':
  /git/arm-soc/include/linux/compiler.h:357:38: error: call to
  '__compiletime_assert_618' declared with attribute error: BUILD_BUG_ON
  failed: sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT)

The additional page flag causes other information stored in
page->flags to get bumped into their own struct page member:

  #if SECTIONS_WIDTH+ZONES_WIDTH+NODES_SHIFT+LAST_CPUPID_SHIFT <=
  BITS_PER_LONG - NR_PAGEFLAGS
  #define LAST_CPUPID_WIDTH LAST_CPUPID_SHIFT
  #else
  #define LAST_CPUPID_WIDTH 0
  #endif

  #if defined(CONFIG_NUMA_BALANCING) && LAST_CPUPID_WIDTH == 0
  #define LAST_CPUPID_NOT_IN_PAGE_FLAGS
  #endif

which in turn causes the struct page size to exceed the size set in
STRUCT_PAGE_MAX_SHIFT. This value is an an estimate used to size the
VMEMMAP page array according to address space and struct page size.

However, the check is performed - and triggers here - on a !VMEMMAP
config, which consumes an additional 22 page bits for the sparse
section id. When VMEMMAP is enabled, those bits are returned, cpupid
doesn't need its own member, and the page passes the VMEMMAP check.

Restrict that check to the situation it was meant to check: that we
are sizing the VMEMMAP page array correctly.

Says Arnd:

    Further experiments show that the build error already existed before,
    but was only triggered with larger values of CONFIG_NR_CPU and/or
    CONFIG_NODES_SHIFT that might be used in actual configurations but
    not in randconfig builds.

    With longer CPU and node masks, I could recreate the problem with
    kernels as old as linux-4.7 when arm64 NUMA support got added.

Reported-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Fixes: 1a2db300348b ("arm64, numa: Add NUMA support for arm64 platforms.")
Fixes: 3e1907d5bf5a ("arm64: mm: move vmemmap region right below the linear region")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/mm/init.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -611,11 +611,13 @@ void __init mem_init(void)
 	BUILD_BUG_ON(TASK_SIZE_32			> TASK_SIZE_64);
 #endif
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
 	/*
 	 * Make sure we chose the upper bound of sizeof(struct page)
-	 * correctly.
+	 * correctly when sizing the VMEMMAP array.
 	 */
 	BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
+#endif
 
 	if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
 		extern int sysctl_overcommit_memory;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 014/336] drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 013/336] arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 015/336] mlxsw: spectrum_switchdev: Fix port_vlan refcounting Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Imre Deak, Clint Taylor,
	Daniel Scheller, Radhakrishna Sripada, Rodrigo Vivi

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Clint Taylor <clinton.a.taylor@intel.com>

commit 0ca9488193e61ec5f31a631d8147f74525629e8a upstream.

On GLK NUC platforms the HDMI retiming buffer needs additional disabled
time to correctly sync to a faster incoming signal.

When measured on a scope the highspeed lines of the HDMI clock turn off
 for ~400uS during a normal resolution change. The HDMI retimer on the
 GLK NUC appears to require at least a full frame of quiet time before a
new faster clock can be correctly sync'd. Wait 100ms due to msleep
inaccuracies while waiting for a completed frame. Add a quirk to the
driver for GLK boards that use ITE66317 HDMI retimers.

V2: Add more devices to the quirk list
V3: Delay increased to 100ms, check to confirm crtc type is HDMI.
V4: crtc type check extended to include _DDI and whitespace fixes
v5: Fix white spaces, remove the macro for delay. Revert the crtc type
    check introduced in v4.

Cc: Imre Deak <imre.deak@intel.com>
Cc: <stable@vger.kernel.org> # v4.14+
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105887
Signed-off-by: Clint Taylor <clinton.a.taylor@intel.com>
Tested-by: Daniel Scheller <d.scheller.oss@gmail.com>
Signed-off-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180710200205.1478-1-radhakrishna.sripada@intel.com
(cherry picked from commit 90c3e2198777aaa355b6994a31a79c636c8d4306)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_drv.h      |    1 +
 drivers/gpu/drm/i915/intel_ddi.c     |   13 +++++++++++--
 drivers/gpu/drm/i915/intel_display.c |   21 ++++++++++++++++++++-
 drivers/gpu/drm/i915/intel_drv.h     |    3 +--
 4 files changed, 33 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -804,6 +804,7 @@ enum intel_sbi_destination {
 #define QUIRK_BACKLIGHT_PRESENT (1<<3)
 #define QUIRK_PIN_SWIZZLED_PAGES (1<<5)
 #define QUIRK_INCREASE_T12_DELAY (1<<6)
+#define QUIRK_INCREASE_DDI_DISABLED_TIME (1<<7)
 
 struct intel_fbdev;
 struct intel_fbc_work;
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1605,15 +1605,24 @@ void intel_ddi_enable_transcoder_func(co
 	I915_WRITE(TRANS_DDI_FUNC_CTL(cpu_transcoder), temp);
 }
 
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-				       enum transcoder cpu_transcoder)
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state)
 {
+	struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
+	struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+	enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
 	i915_reg_t reg = TRANS_DDI_FUNC_CTL(cpu_transcoder);
 	uint32_t val = I915_READ(reg);
 
 	val &= ~(TRANS_DDI_FUNC_ENABLE | TRANS_DDI_PORT_MASK | TRANS_DDI_DP_VC_PAYLOAD_ALLOC);
 	val |= TRANS_DDI_PORT_NONE;
 	I915_WRITE(reg, val);
+
+	if (dev_priv->quirks & QUIRK_INCREASE_DDI_DISABLED_TIME &&
+	    intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) {
+		DRM_DEBUG_KMS("Quirk Increase DDI disabled time\n");
+		/* Quirk time at 100ms for reliable operation */
+		msleep(100);
+	}
 }
 
 int intel_ddi_toggle_hdcp_signalling(struct intel_encoder *intel_encoder,
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5685,7 +5685,7 @@ static void haswell_crtc_disable(struct
 		intel_ddi_set_vc_payload_alloc(intel_crtc->config, false);
 
 	if (!transcoder_is_dsi(cpu_transcoder))
-		intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder);
+		intel_ddi_disable_transcoder_func(old_crtc_state);
 
 	if (INTEL_GEN(dev_priv) >= 9)
 		skylake_scaler_disable(intel_crtc);
@@ -14388,6 +14388,18 @@ static void quirk_increase_t12_delay(str
 	DRM_INFO("Applying T12 delay quirk\n");
 }
 
+/*
+ * GeminiLake NUC HDMI outputs require additional off time
+ * this allows the onboard retimer to correctly sync to signal
+ */
+static void quirk_increase_ddi_disabled_time(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = to_i915(dev);
+
+	dev_priv->quirks |= QUIRK_INCREASE_DDI_DISABLED_TIME;
+	DRM_INFO("Applying Increase DDI Disabled quirk\n");
+}
+
 struct intel_quirk {
 	int device;
 	int subsystem_vendor;
@@ -14474,6 +14486,13 @@ static struct intel_quirk intel_quirks[]
 
 	/* Toshiba Satellite P50-C-18C */
 	{ 0x191B, 0x1179, 0xF840, quirk_increase_t12_delay },
+
+	/* GeminiLake NUC */
+	{ 0x3185, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+	{ 0x3184, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+	/* ASRock ITX*/
+	{ 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
+	{ 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1368,8 +1368,7 @@ void hsw_fdi_link_train(struct intel_crt
 void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port);
 bool intel_ddi_get_hw_state(struct intel_encoder *encoder, enum pipe *pipe);
 void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state);
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-				       enum transcoder cpu_transcoder);
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state);
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state);
 void intel_ddi_disable_pipe_clock(const  struct intel_crtc_state *crtc_state);
 struct intel_encoder *



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 015/336] mlxsw: spectrum_switchdev: Fix port_vlan refcounting
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 014/336] drm/i915/glk: Add Quirk for GLK NUC HDMI port issues Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 016/336] kcov: ensure irq code sees a valid area Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Jiri Pirko,
	Ido Schimmel, David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ]

Switchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are
distributed not only on clean addition, but also when flags on an
existing VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls
mlxsw_sp_port_vlan_get() to get at the port_vlan in question, which
implicitly references the object. This then leads to discrepancies in
reference counting when the VLAN is removed. spectrum.c warns about the
problem when the module is removed:

[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum]
[...]
[13578.627106] Call Trace:
[13578.629617]  mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum]
[13578.634748]  mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core]
[13578.641290]  mlxsw_pci_remove+0x13/0x40 [mlxsw_pci]
[13578.646238]  pci_device_remove+0x31/0xb0
[13578.650244]  device_release_driver_internal+0x14f/0x220
[13578.655562]  driver_detach+0x32/0x70
[13578.659183]  bus_remove_driver+0x47/0xa0
[13578.663134]  pci_unregister_driver+0x1e/0x80
[13578.667486]  mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum]
[13578.673207]  __x64_sys_delete_module+0x13b/0x1e0
[13578.677888]  ? exit_to_usermode_loop+0x78/0x80
[13578.682374]  do_syscall_64+0x39/0xe0
[13578.685976]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join()
determines it's a flag-only change.

Fixes: b3529af6bb0d ("spectrum: Reference count VLAN entries")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1013,8 +1013,10 @@ mlxsw_sp_port_vlan_bridge_join(struct ml
 	int err;
 
 	/* No need to continue if only VLAN flags were changed */
-	if (mlxsw_sp_port_vlan->bridge_port)
+	if (mlxsw_sp_port_vlan->bridge_port) {
+		mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan);
 		return 0;
+	}
 
 	err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port);
 	if (err)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 016/336] kcov: ensure irq code sees a valid area
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 015/336] mlxsw: spectrum_switchdev: Fix port_vlan refcounting Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 017/336] mm: check for SIGKILL inside dup_mmap() loop Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Andrey Ryabinin,
	Dmitry Vyukov, Ingo Molnar, Peter Zijlstra, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

[ Upstream commit c9484b986ef03492357fddd50afbdd02929cfa72 ]

Patch series "kcov: fix unexpected faults".

These patches fix a few issues where KCOV code could trigger recursive
faults, discovered while debugging a patch enabling KCOV for arch/arm:

* On CONFIG_PREEMPT kernels, there's a small race window where
  __sanitizer_cov_trace_pc() can see a bogus kcov_area.

* Lazy faulting of the vmalloc area can cause mutual recursion between
  fault handling code and __sanitizer_cov_trace_pc().

* During the context switch, switching the mm can cause the kcov_area to
  be transiently unmapped.

These are prerequisites for enabling KCOV on arm, but the issues
themsevles are generic -- we just happen to avoid them by chance rather
than design on x86-64 and arm64.

This patch (of 3):

For kernels built with CONFIG_PREEMPT, some C code may execute before or
after the interrupt handler, while the hardirq count is zero.  In these
cases, in_task() can return true.

A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it
resets the task's kcov data via kcov_task_init().  Instrumented code
executed during this period will call __sanitizer_cov_trace_pc(), and as
in_task() returns true, will inspect t->kcov_mode before trying to write
to t->kcov_area.

In kcov_init_task() we update t->kcov_{mode,area,size} with plain stores,
which may be re-ordered, torn, etc.  Thus __sanitizer_cov_trace_pc() may
see bogus values for any of these fields, and may attempt to write to
memory which is not mapped.

Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a
barrier() to ensure this is ordered before we clear t->kov_{area,size}.
This ensures that any code execute while kcov_init_task() is preempted
will either see valid values for t->kcov_{area,size}, or will see that
t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching
t->kcov_area.

Link: http://lkml.kernel.org/r/20180504135535.53744-2-mark.rutland@arm.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kcov.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -241,7 +241,8 @@ static void kcov_put(struct kcov *kcov)
 
 void kcov_task_init(struct task_struct *t)
 {
-	t->kcov_mode = KCOV_MODE_DISABLED;
+	WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED);
+	barrier();
 	t->kcov_size = 0;
 	t->kcov_area = NULL;
 	t->kcov = NULL;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 017/336] mm: check for SIGKILL inside dup_mmap() loop
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 016/336] kcov: ensure irq code sees a valid area Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 018/336] drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2) Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Alexander Viro,
	Rik van Riel, Michal Hocko, Kirill A. Shutemov, David Rientjes,
	Andrew Morton, Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

[ Upstream commit 655c79bb40a0870adcd0871057d01de11625882b ]

As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas
can loop while potentially allocating memory, with mm->mmap_sem held for
write by current thread.  This is bad if current thread was selected as
an OOM victim, for current thread will continue allocations using memory
reserves while OOM reaper is unable to reclaim memory.

As an actually observable problem, it is not difficult to make OOM
reaper unable to reclaim memory if the OOM victim is blocked at
i_mmap_lock_write() in this loop.  Unfortunately, since nobody can
explain whether it is safe to use killable wait there, let's check for
SIGKILL before trying to allocate memory.  Even without an OOM event,
there is no point with continuing the loop from the beginning if current
thread is killed.

I tested with debug printk().  This patch should be safe because we
already fail if security_vm_enough_memory_mm() or
kmem_cache_alloc(GFP_KERNEL) fails and exit_mmap() handles it.

   ***** Aborting dup_mmap() due to SIGKILL *****
   ***** Aborting dup_mmap() due to SIGKILL *****
   ***** Aborting dup_mmap() due to SIGKILL *****
   ***** Aborting dup_mmap() due to SIGKILL *****
   ***** Aborting exit_mmap() due to NULL mmap *****

[akpm@linux-foundation.org: add comment]
Link: http://lkml.kernel.org/r/201804071938.CDE04681.SOFVQJFtMHOOLF@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Rik van Riel <riel@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/fork.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -440,6 +440,14 @@ static __latent_entropy int dup_mmap(str
 			continue;
 		}
 		charge = 0;
+		/*
+		 * Don't duplicate many vmas if we've been oom-killed (for
+		 * example)
+		 */
+		if (fatal_signal_pending(current)) {
+			retval = -EINTR;
+			goto out;
+		}
 		if (mpnt->vm_flags & VM_ACCOUNT) {
 			unsigned long len = vma_pages(mpnt);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 018/336] drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2)
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 017/336] mm: check for SIGKILL inside dup_mmap() loop Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 019/336] xen/netfront: raise max number of slots in xennet_get_responses() Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kenneth Feng, Rex Zhu, Alex Deucher,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kenneth Feng <kenneth.feng@amd.com>

[ Upstream commit 5c16f36f6f003b4415237acca59384a074cd8030 ]

Fix the issue that SCLK&MCLK can't be set higher than dpm7 when
OD is enabled in SMU7.

v2: fix warning (Alex)

Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Acked-by: Rex Zhu<rezhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -3715,14 +3715,17 @@ static int smu7_trim_dpm_states(struct p
 static int smu7_generate_dpm_level_enable_mask(
 		struct pp_hwmgr *hwmgr, const void *input)
 {
-	int result;
+	int result = 0;
 	const struct phm_set_power_state_input *states =
 			(const struct phm_set_power_state_input *)input;
 	struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
 	const struct smu7_power_state *smu7_ps =
 			cast_const_phw_smu7_power_state(states->pnew_state);
 
-	result = smu7_trim_dpm_states(hwmgr, smu7_ps);
+	/*skip the trim if od is enabled*/
+	if (!hwmgr->od_enabled)
+		result = smu7_trim_dpm_states(hwmgr, smu7_ps);
+
 	if (result)
 		return result;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 019/336] xen/netfront: raise max number of slots in xennet_get_responses()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 018/336] drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2) Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 020/336] hv_netvsc: fix network namespace issues with VF support Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Juergen Gross, Boris Ostrovsky,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Juergen Gross <jgross@suse.com>

[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ]

The max number of slots used in xennet_get_responses() is set to
MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD).

In old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This
difference is resulting in frequent messages "too many slots" and a
reduced network throughput for some workloads (factor 10 below that of
a kernel-xen based guest).

Replacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of
the max number of slots to use solves that problem (tests showed no
more messages "too many slots" and throughput was as high as with the
kernel-xen based guest system).

Replace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in
netfront_tx_slot_available() for making it clearer what is really being
tested without actually modifying the tested value.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netfront.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -239,7 +239,7 @@ static void rx_refill_timeout(struct tim
 static int netfront_tx_slot_available(struct netfront_queue *queue)
 {
 	return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) <
-		(NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2);
+		(NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1);
 }
 
 static void xennet_maybe_wake_tx(struct netfront_queue *queue)
@@ -790,7 +790,7 @@ static int xennet_get_responses(struct n
 	RING_IDX cons = queue->rx.rsp_cons;
 	struct sk_buff *skb = xennet_get_rx_skb(queue, cons);
 	grant_ref_t ref = xennet_get_rx_ref(queue, cons);
-	int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
+	int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
 	int slots = 1;
 	int err = 0;
 	unsigned long ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 020/336] hv_netvsc: fix network namespace issues with VF support
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 019/336] xen/netfront: raise max number of slots in xennet_get_responses() Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 021/336] skip LAYOUTRETURN if layout is invalid Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, David S. Miller,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Hemminger <stephen@networkplumber.org>

[ Upstream commit 7bf7bb37f16a80465ee3bd7c6c966f96f5a075a6 ]

When finding the parent netvsc device, the search needs to be across
all netvsc device instances (independent of network namespace).

Find parent device of VF using upper_dev_get routine which
searches only adjacent list.

Fixes: e8ff40d4bff1 ("hv_netvsc: improve VF device matching")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>

netns aware byref
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/hyperv/hyperv_net.h |    2 +
 drivers/net/hyperv/netvsc_drv.c |   45 ++++++++++++++++++----------------------
 2 files changed, 23 insertions(+), 24 deletions(-)

--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -738,6 +738,8 @@ struct net_device_context {
 	struct hv_device *device_ctx;
 	/* netvsc_device */
 	struct netvsc_device __rcu *nvdev;
+	/* list of netvsc net_devices */
+	struct list_head list;
 	/* reconfigure work */
 	struct delayed_work dwork;
 	/* last reconfig time */
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -69,6 +69,8 @@ static int debug = -1;
 module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
+static LIST_HEAD(netvsc_dev_list);
+
 static void netvsc_change_rx_flags(struct net_device *net, int change)
 {
 	struct net_device_context *ndev_ctx = netdev_priv(net);
@@ -1779,13 +1781,10 @@ out_unlock:
 
 static struct net_device *get_netvsc_bymac(const u8 *mac)
 {
-	struct net_device *dev;
-
-	ASSERT_RTNL();
+	struct net_device_context *ndev_ctx;
 
-	for_each_netdev(&init_net, dev) {
-		if (dev->netdev_ops != &device_ops)
-			continue;	/* not a netvsc device */
+	list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+		struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
 
 		if (ether_addr_equal(mac, dev->perm_addr))
 			return dev;
@@ -1796,25 +1795,18 @@ static struct net_device *get_netvsc_bym
 
 static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
 {
+	struct net_device_context *net_device_ctx;
 	struct net_device *dev;
 
-	ASSERT_RTNL();
-
-	for_each_netdev(&init_net, dev) {
-		struct net_device_context *net_device_ctx;
-
-		if (dev->netdev_ops != &device_ops)
-			continue;	/* not a netvsc device */
-
-		net_device_ctx = netdev_priv(dev);
-		if (!rtnl_dereference(net_device_ctx->nvdev))
-			continue;	/* device is removed */
+	dev = netdev_master_upper_dev_get(vf_netdev);
+	if (!dev || dev->netdev_ops != &device_ops)
+		return NULL;	/* not a netvsc device */
+
+	net_device_ctx = netdev_priv(dev);
+	if (!rtnl_dereference(net_device_ctx->nvdev))
+		return NULL;	/* device is removed */
 
-		if (rtnl_dereference(net_device_ctx->vf_netdev) == vf_netdev)
-			return dev;	/* a match */
-	}
-
-	return NULL;
+	return dev;
 }
 
 /* Called when VF is injecting data into network stack.
@@ -2094,15 +2086,19 @@ static int netvsc_probe(struct hv_device
 	else
 		net->max_mtu = ETH_DATA_LEN;
 
-	ret = register_netdev(net);
+	rtnl_lock();
+	ret = register_netdevice(net);
 	if (ret != 0) {
 		pr_err("Unable to register netdev.\n");
 		goto register_failed;
 	}
 
-	return ret;
+	list_add(&net_device_ctx->list, &netvsc_dev_list);
+	rtnl_unlock();
+	return 0;
 
 register_failed:
+	rtnl_unlock();
 	rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
 	free_percpu(net_device_ctx->vf_stats);
@@ -2148,6 +2144,7 @@ static int netvsc_remove(struct hv_devic
 		rndis_filter_device_remove(dev, nvdev);
 
 	unregister_netdevice(net);
+	list_del(&ndev_ctx->list);
 
 	rtnl_unlock();
 	rcu_read_unlock();



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 021/336] skip LAYOUTRETURN if layout is invalid
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 020/336] hv_netvsc: fix network namespace issues with VF support Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 022/336] ixgbe: Fix setting of TC configuration for macvlan case Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olga Kornievskaia, Trond Myklebust,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Olga Kornievskaia <olga.kornievskaia@gmail.com>

[ Upstream commit 93b7f7ad2018d2037559b1d0892417864c78b371 ]

Currently, when IO to DS fails, client returns the layout and
retries against the MDS. However, then on umounting (inode eviction)
it returns the layout again.

This is because pnfs_return_layout() was changed in
commit d78471d32bb6 ("pnfs/blocklayout: set PNFS_LAYOUTRETURN_ON_ERROR")
to always set NFS_LAYOUT_RETURN_REQUESTED so even if we returned
the layout, it will be returned again. Instead, let's also check
if we have already marked the layout invalid.

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/pnfs.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1144,7 +1144,7 @@ _pnfs_return_layout(struct inode *ino)
 	LIST_HEAD(tmp_list);
 	nfs4_stateid stateid;
 	int status = 0;
-	bool send;
+	bool send, valid_layout;
 
 	dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino);
 
@@ -1165,6 +1165,7 @@ _pnfs_return_layout(struct inode *ino)
 			goto out_put_layout_hdr;
 		spin_lock(&ino->i_lock);
 	}
+	valid_layout = pnfs_layout_is_valid(lo);
 	pnfs_clear_layoutcommit(ino, &tmp_list);
 	pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0);
 
@@ -1178,7 +1179,8 @@ _pnfs_return_layout(struct inode *ino)
 	}
 
 	/* Don't send a LAYOUTRETURN if list was initially empty */
-	if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
+	if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
+			!valid_layout) {
 		spin_unlock(&ino->i_lock);
 		dprintk("NFS: %s no layout segments to return\n", __func__);
 		goto out_put_layout_hdr;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 022/336] ixgbe: Fix setting of TC configuration for macvlan case
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 021/336] skip LAYOUTRETURN if layout is invalid Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 023/336] ALSA: emu10k1: add error handling for snd_ctl_add Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Duyck <alexander.h.duyck@intel.com>

[ Upstream commit 646bb57ce86e4d7b0bd9d33244450ae009411e48 ]

When we were enabling macvlan interfaces we weren't correctly configuring
things until ixgbe_setup_tc was called a second time either by tweaking the
number of queues or increasing the macvlan count past 15.

The issue came down to the fact that num_rx_pools is not populated until
after the queues and interrupts are reinitialized.

Instead of trying to set it sooner we can just move the call to setup at
least 1 traffic class to the SR-IOV/VMDq setup function so that we just set
it for this one case. We already had a spot that was configuring the queues
for TC 0 in the code here anyway so it makes sense to also set the number
of TCs here as well.

Fixes: 49cfbeb7a95c ("ixgbe: Fix handling of macvlan Tx offload")
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c  |    8 ++++++++
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |    8 --------
 2 files changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
@@ -618,6 +618,14 @@ static bool ixgbe_set_sriov_queues(struc
 	}
 
 #endif
+	/* To support macvlan offload we have to use num_tc to
+	 * restrict the queues that can be used by the device.
+	 * By doing this we can avoid reporting a false number of
+	 * queues.
+	 */
+	if (vmdq_i > 1)
+		netdev_set_num_tc(adapter->netdev, 1);
+
 	/* populate TC0 for use by pool 0 */
 	netdev_set_tc_queue(adapter->netdev, 0,
 			    adapter->num_rx_queues_per_pool, 0);
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -8875,14 +8875,6 @@ int ixgbe_setup_tc(struct net_device *de
 	} else {
 		netdev_reset_tc(dev);
 
-		/* To support macvlan offload we have to use num_tc to
-		 * restrict the queues that can be used by the device.
-		 * By doing this we can avoid reporting a false number of
-		 * queues.
-		 */
-		if (!tc && adapter->num_rx_pools > 1)
-			netdev_set_num_tc(dev, 1);
-
 		if (adapter->hw.mac.type == ixgbe_mac_82598EB)
 			adapter->hw.fc.requested_mode = adapter->last_lfc_mode;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 023/336] ALSA: emu10k1: add error handling for snd_ctl_add
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 022/336] ixgbe: Fix setting of TC configuration for macvlan case Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 024/336] ALSA: fm801: " Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Takashi Iwai, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyang Jia <jiazhouyang09@gmail.com>

[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ]

When snd_ctl_add fails, the lack of error-handling code may
cause unexpected results.

This patch adds error-handling code after calling snd_ctl_add.

Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/emu10k1/emupcm.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/sound/pci/emu10k1/emupcm.c
+++ b/sound/pci/emu10k1/emupcm.c
@@ -1858,7 +1858,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10
 	if (!kctl)
 		return -ENOMEM;
 	kctl->id.device = device;
-	snd_ctl_add(emu->card, kctl);
+	err = snd_ctl_add(emu->card, kctl);
+	if (err < 0)
+		return err;
 
 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 024/336] ALSA: fm801: add error handling for snd_ctl_add
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 023/336] ALSA: emu10k1: add error handling for snd_ctl_add Greg Kroah-Hartman
@ 2018-08-01 16:45 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 025/336] NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Andy Shevchenko,
	Takashi Iwai, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyang Jia <jiazhouyang09@gmail.com>

[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ]

When snd_ctl_add fails, the lack of error-handling code may
cause unexpected results.

This patch adds error-handling code after calling snd_ctl_add.

Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/fm801.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801
 		if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0)
 			return err;
 	}
-	for (i = 0; i < FM801_CONTROLS; i++)
-		snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip));
+	for (i = 0; i < FM801_CONTROLS; i++) {
+		err = snd_ctl_add(chip->card,
+			snd_ctl_new1(&snd_fm801_controls[i], chip));
+		if (err < 0)
+			return err;
+	}
 	if (chip->multichannel) {
-		for (i = 0; i < FM801_CONTROLS_MULTI; i++)
-			snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+		for (i = 0; i < FM801_CONTROLS_MULTI; i++) {
+			err = snd_ctl_add(chip->card,
+				snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+			if (err < 0)
+				return err;
+		}
 	}
 	return 0;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 025/336] NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2018-08-01 16:45 ` [PATCH 4.17 024/336] ALSA: fm801: " Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 026/336] nfsd: fix error handling in nfs4_set_delegation() Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit f9312a541050007ec59eb0106273a0a10718cd83 ]

If the server returns NFS4ERR_SEQ_FALSE_RETRY or NFS4ERR_RETRY_UNCACHED_REP,
then it thinks we're trying to replay an existing request. If so, then
let's just bump the sequence ID and retry the operation.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -746,6 +746,13 @@ static int nfs41_sequence_process(struct
 			slot->slot_nr,
 			slot->seq_nr);
 		goto out_retry;
+	case -NFS4ERR_RETRY_UNCACHED_REP:
+	case -NFS4ERR_SEQ_FALSE_RETRY:
+		/*
+		 * The server thinks we tried to replay a request.
+		 * Retry the call after bumping the sequence ID.
+		 */
+		goto retry_new_seq;
 	case -NFS4ERR_BADSLOT:
 		/*
 		 * The slot id we used was probably retired. Try again
@@ -770,10 +777,6 @@ static int nfs41_sequence_process(struct
 			goto retry_nowait;
 		}
 		goto session_recover;
-	case -NFS4ERR_SEQ_FALSE_RETRY:
-		if (interrupted)
-			goto retry_new_seq;
-		goto session_recover;
 	default:
 		/* Just update the slot sequence no. */
 		slot->seq_done = 1;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 026/336] nfsd: fix error handling in nfs4_set_delegation()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 025/336] NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 027/336] nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Elble, J. Bruce Fields, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrew Elble <aweits@rit.edu>

[ Upstream commit 692ad280bff3e81721ab138b9455948ab5289acf ]

I noticed a memory corruption crash in nfsd in
4.17-rc1. This patch corrects the issue.

Fix to return error if the delegation couldn't be hashed or there was
a recall in progress. Use the existing error path instead of
destroy_delegation() for readability.

Signed-off-by: Andrew Elble <aweits@rit.edu>
Fixes: 353601e7d323c ("nfsd: create a separate lease for each delegation")
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4378,8 +4378,11 @@ nfs4_set_delegation(struct nfs4_client *
 	spin_unlock(&state_lock);
 
 	if (status)
-		destroy_unhashed_deleg(dp);
+		goto out_unlock;
+
 	return dp;
+out_unlock:
+	vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
 out_clnt_odstate:
 	put_clnt_odstate(dp->dl_clnt_odstate);
 out_stid:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 027/336] nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 026/336] nfsd: fix error handling in nfs4_set_delegation() Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 028/336] vfio: platform: Fix reset module leak in error path Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Scott Mayhew, J. Bruce Fields, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Scott Mayhew <smayhew@redhat.com>

[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ]

When running a fuzz tester against a KASAN-enabled kernel, the following
splat periodically occurs.

The problem occurs when the test sends a GETDEVICEINFO request with a
malformed xdr array (size but no data) for gdia_notify_types and the
array size is > 0x3fffffff, which results in an overflow in the value of
nbytes which is passed to read_buf().

If the array size is 0x40000000, 0x80000000, or 0xc0000000, then after
the overflow occurs, the value of nbytes 0, and when that happens the
pointer returned by read_buf() points to the end of the xdr data (i.e.
argp->end) when really it should be returning NULL.

Fix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this
value is arbitrary, but it's the same threshold used by
nfsd4_decode_bitmap()... in could really be any value >= 1 since it's
expected to get at most a single bitmap in gdia_notify_types).

[  119.256854] ==================================================================
[  119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538

[  119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1
[  119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014
[  119.261202] Call Trace:
[  119.262265]  dump_stack+0x71/0xab
[  119.263371]  print_address_description+0x6a/0x270
[  119.264609]  kasan_report+0x258/0x380
[  119.265854]  ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.267291]  nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.268549]  ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
[  119.269873]  ? nfsd4_decode_sequence+0x490/0x490 [nfsd]
[  119.271095]  nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
[  119.272393]  ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd]
[  119.273658]  nfsd_dispatch+0x183/0x850 [nfsd]
[  119.274918]  svc_process+0x161c/0x31a0 [sunrpc]
[  119.276172]  ? svc_printk+0x190/0x190 [sunrpc]
[  119.277386]  ? svc_xprt_release+0x451/0x680 [sunrpc]
[  119.278622]  nfsd+0x2b9/0x430 [nfsd]
[  119.279771]  ? nfsd_destroy+0x1c0/0x1c0 [nfsd]
[  119.281157]  kthread+0x2db/0x390
[  119.282347]  ? kthread_create_worker_on_cpu+0xc0/0xc0
[  119.283756]  ret_from_fork+0x35/0x40

[  119.286041] Allocated by task 436:
[  119.287525]  kasan_kmalloc+0xa0/0xd0
[  119.288685]  kmem_cache_alloc+0xe9/0x1f0
[  119.289900]  get_empty_filp+0x7b/0x410
[  119.291037]  path_openat+0xca/0x4220
[  119.292242]  do_filp_open+0x182/0x280
[  119.293411]  do_sys_open+0x216/0x360
[  119.294555]  do_syscall_64+0xa0/0x2f0
[  119.295721]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[  119.298068] Freed by task 436:
[  119.299271]  __kasan_slab_free+0x130/0x180
[  119.300557]  kmem_cache_free+0x78/0x210
[  119.301823]  rcu_process_callbacks+0x35b/0xbd0
[  119.303162]  __do_softirq+0x192/0x5ea

[  119.305443] The buggy address belongs to the object at ffff880113ada000
                which belongs to the cache filp of size 256
[  119.308556] The buggy address is located 0 bytes inside of
                256-byte region [ffff880113ada000, ffff880113ada100)
[  119.311376] The buggy address belongs to the page:
[  119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780
[  119.314428] flags: 0x17ffe000000100(slab)
[  119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001
[  119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000
[  119.319050] page dumped because: kasan: bad access detected

[  119.321652] Memory state around the buggy address:
[  119.322993]  ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  119.324515]  ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.327547]                    ^
[  119.328730]  ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.330218]  ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  119.331740] ==================================================================

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1585,6 +1585,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_
 	gdev->gd_maxcount = be32_to_cpup(p++);
 	num = be32_to_cpup(p++);
 	if (num) {
+		if (num > 1000)
+			goto xdr_error;
 		READ_BUF(4 * num);
 		gdev->gd_notify_types = be32_to_cpup(p++);
 		for (i = 1; i < num; i++) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 028/336] vfio: platform: Fix reset module leak in error path
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 027/336] nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 029/336] vfio/mdev: Check globally for duplicate devices Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Eric Auger,
	Simon Horman, Alex Williamson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 28a68387888997e8a7fa57940ea5d55f2e16b594 ]

If the IOMMU group setup fails, the reset module is not released.

Fixes: b5add544d677d363 ("vfio, platform: make reset driver a requirement by default")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Acked-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vfio/platform/vfio_platform_common.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vf
 	group = vfio_iommu_group_get(dev);
 	if (!group) {
 		pr_err("VFIO: No IOMMU group for device %s\n", vdev->name);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_reset;
 	}
 
 	ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev);
-	if (ret) {
-		vfio_iommu_group_put(group, dev);
-		return ret;
-	}
+	if (ret)
+		goto put_iommu;
 
 	mutex_init(&vdev->igate);
 
 	return 0;
+
+put_iommu:
+	vfio_iommu_group_put(group, dev);
+put_reset:
+	vfio_platform_put_reset(vdev);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(vfio_platform_probe_common);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 029/336] vfio/mdev: Check globally for duplicate devices
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 028/336] vfio: platform: Fix reset module leak in error path Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 030/336] vfio/type1: Fix task tracking for QEMU vCPU hotplug Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kirti Wankhede, Cornelia Huck,
	Halil Pasic, Zhenyu Wang, Alex Williamson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Williamson <alex.williamson@redhat.com>

[ Upstream commit 002fe996f67f4f46d8917b14cfb6e4313c20685a ]

When we create an mdev device, we check for duplicates against the
parent device and return -EEXIST if found, but the mdev device
namespace is global since we'll link all devices from the bus.  We do
catch this later in sysfs_do_create_link_sd() to return -EEXIST, but
with it comes a kernel warning and stack trace for trying to create
duplicate sysfs links, which makes it an undesirable response.

Therefore we should really be looking for duplicates across all mdev
parent devices, or as implemented here, against our mdev device list.
Using mdev_list to prevent duplicates means that we can remove
mdev_parent.lock, but in order not to serialize mdev device creation
and removal globally, we add mdev_device.active which allows UUIDs to
be reserved such that we can drop the mdev_list_lock before the mdev
device is fully in place.

Two behavioral notes; first, mdev_parent.lock had the side-effect of
serializing mdev create and remove ops per parent device.  This was
an implementation detail, not an intentional guarantee provided to
the mdev vendor drivers.  Vendor drivers can trivially provide this
serialization internally if necessary.  Second, review comments note
the new -EAGAIN behavior when the device, and in particular the remove
attribute, becomes visible in sysfs.  If a remove is triggered prior
to completion of mdev_device_create() the user will see a -EAGAIN
error.  While the errno is different, receiving an error during this
period is not, the previous implementation returned -ENODEV for the
same condition.  Furthermore, the consistency to the user is improved
in the case where mdev_device_remove_ops() returns error.  Previously
concurrent calls to mdev_device_remove() could see the device
disappear with -ENODEV and return in the case of error.  Now a user
would see -EAGAIN while the device is in this transitory state.

Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/vfio-mediated-device.txt |    5 +
 drivers/vfio/mdev/mdev_core.c          |  102 +++++++++++----------------------
 drivers/vfio/mdev/mdev_private.h       |    2 
 3 files changed, 42 insertions(+), 67 deletions(-)

--- a/Documentation/vfio-mediated-device.txt
+++ b/Documentation/vfio-mediated-device.txt
@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops str
 * create: allocate basic resources in a driver for a mediated device
 * remove: free resources in a driver when a mediated device is destroyed
 
+(Note that mdev-core provides no implicit serialization of create/remove
+callbacks per mdev parent device, per mdev type, or any other categorization.
+Vendor drivers are expected to be fully asynchronous in this respect or
+provide their own internal resource protection.)
+
 The callbacks in the mdev_parent_ops structure are as follows:
 
 * open: open callback of mediated device
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -66,34 +66,6 @@ uuid_le mdev_uuid(struct mdev_device *md
 }
 EXPORT_SYMBOL(mdev_uuid);
 
-static int _find_mdev_device(struct device *dev, void *data)
-{
-	struct mdev_device *mdev;
-
-	if (!dev_is_mdev(dev))
-		return 0;
-
-	mdev = to_mdev_device(dev);
-
-	if (uuid_le_cmp(mdev->uuid, *(uuid_le *)data) == 0)
-		return 1;
-
-	return 0;
-}
-
-static bool mdev_device_exist(struct mdev_parent *parent, uuid_le uuid)
-{
-	struct device *dev;
-
-	dev = device_find_child(parent->dev, &uuid, _find_mdev_device);
-	if (dev) {
-		put_device(dev);
-		return true;
-	}
-
-	return false;
-}
-
 /* Should be called holding parent_list_lock */
 static struct mdev_parent *__find_parent_device(struct device *dev)
 {
@@ -221,7 +193,6 @@ int mdev_register_device(struct device *
 	}
 
 	kref_init(&parent->ref);
-	mutex_init(&parent->lock);
 
 	parent->dev = dev;
 	parent->ops = ops;
@@ -297,6 +268,10 @@ static void mdev_device_release(struct d
 {
 	struct mdev_device *mdev = to_mdev_device(dev);
 
+	mutex_lock(&mdev_list_lock);
+	list_del(&mdev->next);
+	mutex_unlock(&mdev_list_lock);
+
 	dev_dbg(&mdev->dev, "MDEV: destroying\n");
 	kfree(mdev);
 }
@@ -304,7 +279,7 @@ static void mdev_device_release(struct d
 int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid)
 {
 	int ret;
-	struct mdev_device *mdev;
+	struct mdev_device *mdev, *tmp;
 	struct mdev_parent *parent;
 	struct mdev_type *type = to_mdev_type(kobj);
 
@@ -312,21 +287,28 @@ int mdev_device_create(struct kobject *k
 	if (!parent)
 		return -EINVAL;
 
-	mutex_lock(&parent->lock);
+	mutex_lock(&mdev_list_lock);
 
 	/* Check for duplicate */
-	if (mdev_device_exist(parent, uuid)) {
-		ret = -EEXIST;
-		goto create_err;
+	list_for_each_entry(tmp, &mdev_list, next) {
+		if (!uuid_le_cmp(tmp->uuid, uuid)) {
+			mutex_unlock(&mdev_list_lock);
+			ret = -EEXIST;
+			goto mdev_fail;
+		}
 	}
 
 	mdev = kzalloc(sizeof(*mdev), GFP_KERNEL);
 	if (!mdev) {
+		mutex_unlock(&mdev_list_lock);
 		ret = -ENOMEM;
-		goto create_err;
+		goto mdev_fail;
 	}
 
 	memcpy(&mdev->uuid, &uuid, sizeof(uuid_le));
+	list_add(&mdev->next, &mdev_list);
+	mutex_unlock(&mdev_list_lock);
+
 	mdev->parent = parent;
 	kref_init(&mdev->ref);
 
@@ -338,35 +320,28 @@ int mdev_device_create(struct kobject *k
 	ret = device_register(&mdev->dev);
 	if (ret) {
 		put_device(&mdev->dev);
-		goto create_err;
+		goto mdev_fail;
 	}
 
 	ret = mdev_device_create_ops(kobj, mdev);
 	if (ret)
-		goto create_failed;
+		goto create_fail;
 
 	ret = mdev_create_sysfs_files(&mdev->dev, type);
 	if (ret) {
 		mdev_device_remove_ops(mdev, true);
-		goto create_failed;
+		goto create_fail;
 	}
 
 	mdev->type_kobj = kobj;
+	mdev->active = true;
 	dev_dbg(&mdev->dev, "MDEV: created\n");
 
-	mutex_unlock(&parent->lock);
-
-	mutex_lock(&mdev_list_lock);
-	list_add(&mdev->next, &mdev_list);
-	mutex_unlock(&mdev_list_lock);
-
-	return ret;
+	return 0;
 
-create_failed:
+create_fail:
 	device_unregister(&mdev->dev);
-
-create_err:
-	mutex_unlock(&parent->lock);
+mdev_fail:
 	mdev_put_parent(parent);
 	return ret;
 }
@@ -377,44 +352,39 @@ int mdev_device_remove(struct device *de
 	struct mdev_parent *parent;
 	struct mdev_type *type;
 	int ret;
-	bool found = false;
 
 	mdev = to_mdev_device(dev);
 
 	mutex_lock(&mdev_list_lock);
 	list_for_each_entry(tmp, &mdev_list, next) {
-		if (tmp == mdev) {
-			found = true;
+		if (tmp == mdev)
 			break;
-		}
 	}
 
-	if (found)
-		list_del(&mdev->next);
+	if (tmp != mdev) {
+		mutex_unlock(&mdev_list_lock);
+		return -ENODEV;
+	}
 
-	mutex_unlock(&mdev_list_lock);
+	if (!mdev->active) {
+		mutex_unlock(&mdev_list_lock);
+		return -EAGAIN;
+	}
 
-	if (!found)
-		return -ENODEV;
+	mdev->active = false;
+	mutex_unlock(&mdev_list_lock);
 
 	type = to_mdev_type(mdev->type_kobj);
 	parent = mdev->parent;
-	mutex_lock(&parent->lock);
 
 	ret = mdev_device_remove_ops(mdev, force_remove);
 	if (ret) {
-		mutex_unlock(&parent->lock);
-
-		mutex_lock(&mdev_list_lock);
-		list_add(&mdev->next, &mdev_list);
-		mutex_unlock(&mdev_list_lock);
-
+		mdev->active = true;
 		return ret;
 	}
 
 	mdev_remove_sysfs_files(dev, type);
 	device_unregister(dev);
-	mutex_unlock(&parent->lock);
 	mdev_put_parent(parent);
 
 	return 0;
--- a/drivers/vfio/mdev/mdev_private.h
+++ b/drivers/vfio/mdev/mdev_private.h
@@ -20,7 +20,6 @@ struct mdev_parent {
 	struct device *dev;
 	const struct mdev_parent_ops *ops;
 	struct kref ref;
-	struct mutex lock;
 	struct list_head next;
 	struct kset *mdev_types_kset;
 	struct list_head type_list;
@@ -34,6 +33,7 @@ struct mdev_device {
 	struct kref ref;
 	struct list_head next;
 	struct kobject *type_kobj;
+	bool active;
 };
 
 #define to_mdev_device(dev)	container_of(dev, struct mdev_device, dev)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 030/336] vfio/type1: Fix task tracking for QEMU vCPU hotplug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 029/336] vfio/mdev: Check globally for duplicate devices Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 031/336] kernel/hung_task.c: show all hung tasks before panic Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xu Yandong, Alex Williamson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Williamson <alex.williamson@redhat.com>

[ Upstream commit 48d8476b41eed63567dd2f0ad125c895b9ac648a ]

MAP_DMA ioctls might be called from various threads within a process,
for example when using QEMU, the vCPU threads are often generating
these calls and we therefore take a reference to that vCPU task.
However, QEMU also supports vCPU hotplug on some machines and the task
that called MAP_DMA may have exited by the time UNMAP_DMA is called,
resulting in the mm_struct pointer being NULL and thus a failure to
match against the existing mapping.

To resolve this, we instead take a reference to the thread
group_leader, which has the same mm_struct and resource limits, but
is less likely exit, at least in the QEMU case.  A difficulty here is
guaranteeing that the capabilities of the group_leader match that of
the calling thread, which we resolve by tracking CAP_IPC_LOCK at the
time of calling rather than at an indeterminate time in the future.
Potentially this also results in better efficiency as this is now
recorded once per MAP_DMA ioctl.

Reported-by: Xu Yandong <xuyandong2@huawei.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vfio/vfio_iommu_type1.c |   73 +++++++++++++++++++++++++---------------
 1 file changed, 47 insertions(+), 26 deletions(-)

--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -83,6 +83,7 @@ struct vfio_dma {
 	size_t			size;		/* Map size (bytes) */
 	int			prot;		/* IOMMU_READ/WRITE */
 	bool			iommu_mapped;
+	bool			lock_cap;	/* capable(CAP_IPC_LOCK) */
 	struct task_struct	*task;
 	struct rb_root		pfn_list;	/* Ex-user pinned pfn list */
 };
@@ -253,29 +254,25 @@ static int vfio_iova_put_vfio_pfn(struct
 	return ret;
 }
 
-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap)
+static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
 {
 	struct mm_struct *mm;
-	bool is_current;
 	int ret;
 
 	if (!npage)
 		return 0;
 
-	is_current = (task->mm == current->mm);
-
-	mm = is_current ? task->mm : get_task_mm(task);
+	mm = async ? get_task_mm(dma->task) : dma->task->mm;
 	if (!mm)
 		return -ESRCH; /* process exited */
 
 	ret = down_write_killable(&mm->mmap_sem);
 	if (!ret) {
 		if (npage > 0) {
-			if (lock_cap ? !*lock_cap :
-			    !has_capability(task, CAP_IPC_LOCK)) {
+			if (!dma->lock_cap) {
 				unsigned long limit;
 
-				limit = task_rlimit(task,
+				limit = task_rlimit(dma->task,
 						RLIMIT_MEMLOCK) >> PAGE_SHIFT;
 
 				if (mm->locked_vm + npage > limit)
@@ -289,7 +286,7 @@ static int vfio_lock_acct(struct task_st
 		up_write(&mm->mmap_sem);
 	}
 
-	if (!is_current)
+	if (async)
 		mmput(mm);
 
 	return ret;
@@ -398,7 +395,7 @@ static int vaddr_get_pfn(struct mm_struc
  */
 static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
 				  long npage, unsigned long *pfn_base,
-				  bool lock_cap, unsigned long limit)
+				  unsigned long limit)
 {
 	unsigned long pfn = 0;
 	long ret, pinned = 0, lock_acct = 0;
@@ -421,7 +418,7 @@ static long vfio_pin_pages_remote(struct
 	 * pages are already counted against the user.
 	 */
 	if (!rsvd && !vfio_find_vpfn(dma, iova)) {
-		if (!lock_cap && current->mm->locked_vm + 1 > limit) {
+		if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) {
 			put_pfn(*pfn_base, dma->prot);
 			pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__,
 					limit << PAGE_SHIFT);
@@ -447,7 +444,7 @@ static long vfio_pin_pages_remote(struct
 		}
 
 		if (!rsvd && !vfio_find_vpfn(dma, iova)) {
-			if (!lock_cap &&
+			if (!dma->lock_cap &&
 			    current->mm->locked_vm + lock_acct + 1 > limit) {
 				put_pfn(pfn, dma->prot);
 				pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n",
@@ -460,7 +457,7 @@ static long vfio_pin_pages_remote(struct
 	}
 
 out:
-	ret = vfio_lock_acct(current, lock_acct, &lock_cap);
+	ret = vfio_lock_acct(dma, lock_acct, false);
 
 unpin_out:
 	if (ret) {
@@ -491,7 +488,7 @@ static long vfio_unpin_pages_remote(stru
 	}
 
 	if (do_accounting)
-		vfio_lock_acct(dma->task, locked - unlocked, NULL);
+		vfio_lock_acct(dma, locked - unlocked, true);
 
 	return unlocked;
 }
@@ -508,7 +505,7 @@ static int vfio_pin_page_external(struct
 
 	ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base);
 	if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) {
-		ret = vfio_lock_acct(dma->task, 1, NULL);
+		ret = vfio_lock_acct(dma, 1, true);
 		if (ret) {
 			put_pfn(*pfn_base, dma->prot);
 			if (ret == -ENOMEM)
@@ -535,7 +532,7 @@ static int vfio_unpin_page_external(stru
 	unlocked = vfio_iova_put_vfio_pfn(dma, vpfn);
 
 	if (do_accounting)
-		vfio_lock_acct(dma->task, -unlocked, NULL);
+		vfio_lock_acct(dma, -unlocked, true);
 
 	return unlocked;
 }
@@ -827,7 +824,7 @@ static long vfio_unmap_unpin(struct vfio
 		unlocked += vfio_sync_unpin(dma, domain, &unmapped_region_list);
 
 	if (do_accounting) {
-		vfio_lock_acct(dma->task, -unlocked, NULL);
+		vfio_lock_acct(dma, -unlocked, true);
 		return 0;
 	}
 	return unlocked;
@@ -1042,14 +1039,12 @@ static int vfio_pin_map_dma(struct vfio_
 	size_t size = map_size;
 	long npage;
 	unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-	bool lock_cap = capable(CAP_IPC_LOCK);
 	int ret = 0;
 
 	while (size) {
 		/* Pin a contiguous chunk of memory */
 		npage = vfio_pin_pages_remote(dma, vaddr + dma->size,
-					      size >> PAGE_SHIFT, &pfn,
-					      lock_cap, limit);
+					      size >> PAGE_SHIFT, &pfn, limit);
 		if (npage <= 0) {
 			WARN_ON(!npage);
 			ret = (int)npage;
@@ -1124,8 +1119,36 @@ static int vfio_dma_do_map(struct vfio_i
 	dma->iova = iova;
 	dma->vaddr = vaddr;
 	dma->prot = prot;
-	get_task_struct(current);
-	dma->task = current;
+
+	/*
+	 * We need to be able to both add to a task's locked memory and test
+	 * against the locked memory limit and we need to be able to do both
+	 * outside of this call path as pinning can be asynchronous via the
+	 * external interfaces for mdev devices.  RLIMIT_MEMLOCK requires a
+	 * task_struct and VM locked pages requires an mm_struct, however
+	 * holding an indefinite mm reference is not recommended, therefore we
+	 * only hold a reference to a task.  We could hold a reference to
+	 * current, however QEMU uses this call path through vCPU threads,
+	 * which can be killed resulting in a NULL mm and failure in the unmap
+	 * path when called via a different thread.  Avoid this problem by
+	 * using the group_leader as threads within the same group require
+	 * both CLONE_THREAD and CLONE_VM and will therefore use the same
+	 * mm_struct.
+	 *
+	 * Previously we also used the task for testing CAP_IPC_LOCK at the
+	 * time of pinning and accounting, however has_capability() makes use
+	 * of real_cred, a copy-on-write field, so we can't guarantee that it
+	 * matches group_leader, or in fact that it might not change by the
+	 * time it's evaluated.  If a process were to call MAP_DMA with
+	 * CAP_IPC_LOCK but later drop it, it doesn't make sense that they
+	 * possibly see different results for an iommu_mapped vfio_dma vs
+	 * externally mapped.  Therefore track CAP_IPC_LOCK in vfio_dma at the
+	 * time of calling MAP_DMA.
+	 */
+	get_task_struct(current->group_leader);
+	dma->task = current->group_leader;
+	dma->lock_cap = capable(CAP_IPC_LOCK);
+
 	dma->pfn_list = RB_ROOT;
 
 	/* Insert zero-sized and grow as we map chunks of it */
@@ -1160,7 +1183,6 @@ static int vfio_iommu_replay(struct vfio
 	struct vfio_domain *d;
 	struct rb_node *n;
 	unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-	bool lock_cap = capable(CAP_IPC_LOCK);
 	int ret;
 
 	/* Arbitrarily pick the first domain in the list for lookups */
@@ -1207,8 +1229,7 @@ static int vfio_iommu_replay(struct vfio
 
 				npage = vfio_pin_pages_remote(dma, vaddr,
 							      n >> PAGE_SHIFT,
-							      &pfn, lock_cap,
-							      limit);
+							      &pfn, limit);
 				if (npage <= 0) {
 					WARN_ON(!npage);
 					ret = (int)npage;
@@ -1485,7 +1506,7 @@ static void vfio_iommu_unmap_unpin_reacc
 			if (!is_invalid_reserved_pfn(vpfn->pfn))
 				locked++;
 		}
-		vfio_lock_acct(dma->task, locked - unlocked, NULL);
+		vfio_lock_acct(dma, locked - unlocked, true);
 	}
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 031/336] kernel/hung_task.c: show all hung tasks before panic
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 030/336] vfio/type1: Fix task tracking for QEMU vCPU hotplug Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 032/336] mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Paul E. McKenney,
	Dmitry Vyukov, Vegard Nossum, Mandeep Singh Baines,
	Peter Zijlstra, Thomas Gleixner, Ingo Molnar, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

[ Upstream commit 401c636a0eeb0d51862fce222da1bf08e3a0ffd0 ]

When we get a hung task it can often be valuable to see _all_ the hung
tasks on the system before calling panic().

Quoting from https://syzkaller.appspot.com/text?tag=CrashReport&id=5316056503549952
----------------------------------------
INFO: task syz-executor0:6540 blocked for more than 120 seconds.
      Not tainted 4.16.0+ #13
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D23560  6540   4521 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2848 [inline]
 __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490
 schedule+0xf5/0x430 kernel/sched/core.c:3549
 schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3607
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0xb7f/0x1810 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355
 __blkdev_driver_ioctl block/ioctl.c:303 [inline]
 blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601
 ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2060
 isofs_get_last_session fs/isofs/inode.c:567 [inline]
 isofs_fill_super+0x2ba9/0x3bc0 fs/isofs/inode.c:660
 mount_bdev+0x2b7/0x370 fs/super.c:1119
 isofs_mount+0x34/0x40 fs/isofs/inode.c:1560
 mount_fs+0x66/0x2d0 fs/super.c:1222
 vfs_kern_mount.part.26+0xc6/0x4a0 fs/namespace.c:1037
 vfs_kern_mount fs/namespace.c:2514 [inline]
 do_new_mount fs/namespace.c:2517 [inline]
 do_mount+0xea4/0x2b90 fs/namespace.c:2847
 ksys_mount+0xab/0x120 fs/namespace.c:3063
 SYSC_mount fs/namespace.c:3077 [inline]
 SyS_mount+0x39/0x50 fs/namespace.c:3074
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
(...snipped...)
Showing all locks held in the system:
(...snipped...)
2 locks held by syz-executor0/6540:
 #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:211 [inline]
 #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x3b2/0xe60 fs/super.c:502 /* down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); */
 #1: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */
(...snipped...)
3 locks held by syz-executor7/6541:
 #0: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */
 #1: 000000007bf3d3f9 (&bdev->bd_mutex){+.+.}, at: blkdev_reread_part+0x1e/0x40 block/ioctl.c:192
 #2: 00000000566d4c39 (&type->s_umount_key#50){.+.+}, at: __get_super.part.10+0x1d3/0x280 fs/super.c:663 /* down_read(&sb->s_umount); */
----------------------------------------

When reporting an AB-BA deadlock like shown above, it would be nice if
trace of PID=6541 is printed as well as trace of PID=6540 before calling
panic().

Showing hung tasks up to /proc/sys/kernel/hung_task_warnings could delay
calling panic() but normally there should not be so many hung tasks.

Link: http://lkml.kernel.org/r/201804050705.BHE57833.HVFOFtSOMQJFOL@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/hung_task.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warni
 
 static int __read_mostly did_panic;
 static bool hung_task_show_lock;
+static bool hung_task_call_panic;
 
 static struct task_struct *watchdog_task;
 
@@ -127,10 +128,8 @@ static void check_hung_task(struct task_
 	touch_nmi_watchdog();
 
 	if (sysctl_hung_task_panic) {
-		if (hung_task_show_lock)
-			debug_show_all_locks();
-		trigger_all_cpu_backtrace();
-		panic("hung_task: blocked tasks");
+		hung_task_show_lock = true;
+		hung_task_call_panic = true;
 	}
 }
 
@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_t
 	rcu_read_unlock();
 	if (hung_task_show_lock)
 		debug_show_all_locks();
+	if (hung_task_call_panic) {
+		trigger_all_cpu_backtrace();
+		panic("hung_task: blocked tasks");
+	}
 }
 
 static long hung_timeout_jiffies(unsigned long last_checked,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 032/336] mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 031/336] kernel/hung_task.c: show all hung tasks before panic Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 033/336] mm: /proc/pid/pagemap: hide swap entries from unprivileged users Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aaron Lu, kernel test robot,
	Johannes Weiner, Michal Hocko, Tejun Heo, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aaron Lu <aaron.lu@intel.com>

[ Upstream commit e81bf9793b1861d74953ef041b4f6c7faecc2dbd ]

The LKP robot found a 27% will-it-scale/page_fault3 performance
regression regarding commit e27be240df53("mm: memcg: make sure
memory.events is uptodate when waking pollers").

What the test does is:
 1 mkstemp() a 128M file on a tmpfs;
 2 start $nr_cpu processes, each to loop the following:
   2.1 mmap() this file in shared write mode;
   2.2 write 0 to this file in a PAGE_SIZE step till the end of the file;
   2.3 unmap() this file and repeat this process.
 3 After 5 minutes, check how many loops they managed to complete, the
   higher the better.

The commit itself looks innocent enough as it merely changed some event
counting mechanism and this test didn't trigger those events at all.
Perf shows increased cycles spent on accessing root_mem_cgroup->stat_cpu
in count_memcg_event_mm()(called by handle_mm_fault()) and in
__mod_memcg_state() called by page_add_file_rmap().  So it's likely due
to the changed layout of 'struct mem_cgroup' that either make stat_cpu
falling into a constantly modifying cacheline or some hot fields stop
being in the same cacheline.

I verified this by moving memory_events[] back to where it was:

: --- a/include/linux/memcontrol.h
: +++ b/include/linux/memcontrol.h
: @@ -205,7 +205,6 @@ struct mem_cgroup {
:  	int		oom_kill_disable;
:
:  	/* memory.events */
: -	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
:  	struct cgroup_file events_file;
:
:  	/* protect arrays of thresholds */
: @@ -238,6 +237,7 @@ struct mem_cgroup {
:  	struct mem_cgroup_stat_cpu __percpu *stat_cpu;
:  	atomic_long_t		stat[MEMCG_NR_STAT];
:  	atomic_long_t		events[NR_VM_EVENT_ITEMS];
: +	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
:
:  	unsigned long		socket_pressure;

And performance restored.

Later investigation found that as long as the following 3 fields
moving_account, move_lock_task and stat_cpu are in the same cacheline,
performance will be good.  To avoid future performance surprise by other
commits changing the layout of 'struct mem_cgroup', this patch makes
sure the 3 fields stay in the same cacheline.

One concern of this approach is, moving_account and move_lock_task could
be modified when a process changes memory cgroup while stat_cpu is a
always read field, it might hurt to place them in the same cacheline.  I
assume it is rare for a process to change memory cgroup so this should
be OK.

Link: https://lkml.kernel.org/r/20180528114019.GF9904@yexl-desktop
Link: http://lkml.kernel.org/r/20180601071115.GA27302@intel.com
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Reported-by: kernel test robot <xiaolong.ye@intel.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/memcontrol.h |   23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -158,6 +158,15 @@ enum memcg_kmem_state {
 	KMEM_ONLINE,
 };
 
+#if defined(CONFIG_SMP)
+struct memcg_padding {
+	char x[0];
+} ____cacheline_internodealigned_in_smp;
+#define MEMCG_PADDING(name)      struct memcg_padding name;
+#else
+#define MEMCG_PADDING(name)
+#endif
+
 /*
  * The memory controller data structure. The memory controller controls both
  * page cache and RSS per cgroup. We would eventually like to provide
@@ -205,7 +214,6 @@ struct mem_cgroup {
 	int		oom_kill_disable;
 
 	/* memory.events */
-	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
 	struct cgroup_file events_file;
 
 	/* protect arrays of thresholds */
@@ -225,19 +233,26 @@ struct mem_cgroup {
 	 * mem_cgroup ? And what type of charges should we move ?
 	 */
 	unsigned long move_charge_at_immigrate;
+	/* taken only while moving_account > 0 */
+	spinlock_t		move_lock;
+	unsigned long		move_lock_flags;
+
+	MEMCG_PADDING(_pad1_);
+
 	/*
 	 * set > 0 if pages under this cgroup are moving to other cgroup.
 	 */
 	atomic_t		moving_account;
-	/* taken only while moving_account > 0 */
-	spinlock_t		move_lock;
 	struct task_struct	*move_lock_task;
-	unsigned long		move_lock_flags;
 
 	/* memory.stat */
 	struct mem_cgroup_stat_cpu __percpu *stat_cpu;
+
+	MEMCG_PADDING(_pad2_);
+
 	atomic_long_t		stat[MEMCG_NR_STAT];
 	atomic_long_t		events[NR_VM_EVENT_ITEMS];
+	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
 
 	unsigned long		socket_pressure;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 033/336] mm: /proc/pid/pagemap: hide swap entries from unprivileged users
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 032/336] mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 034/336] mm: vmalloc: avoid racy handling of debugobjects in vunmap Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huang, Ying, Kirill A. Shutemov,
	Naoya Horiguchi, Konstantin Khlebnikov, Michal Hocko,
	Andrei Vagin, Jerome Glisse, Daniel Colascione, Zi Yan,
	Andrew Morton, Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huang Ying <ying.huang@intel.com>

[ Upstream commit ab6ecf247a9321e3180e021a6a60164dee53ab2e ]

In commit ab676b7d6fbf ("pagemap: do not leak physical addresses to
non-privileged userspace"), the /proc/PID/pagemap is restricted to be
readable only by CAP_SYS_ADMIN to address some security issue.

In commit 1c90308e7a77 ("pagemap: hide physical addresses from
non-privileged users"), the restriction is relieved to make
/proc/PID/pagemap readable, but hide the physical addresses for
non-privileged users.

But the swap entries are readable for non-privileged users too.  This
has some security issues.  For example, for page under migrating, the
swap entry has physical address information.  So, in this patch, the
swap entries are hided for non-privileged users too.

Link: http://lkml.kernel.org/r/20180508012745.7238-1-ying.huang@intel.com
Fixes: 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")
Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Suggested-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Andrei Vagin <avagin@openvz.org>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Daniel Colascione <dancol@google.com>
Cc: Zi Yan <zi.yan@cs.rutgers.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/task_mmu.c |   26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1259,8 +1259,9 @@ static pagemap_entry_t pte_to_pagemap_en
 		if (pte_swp_soft_dirty(pte))
 			flags |= PM_SOFT_DIRTY;
 		entry = pte_to_swp_entry(pte);
-		frame = swp_type(entry) |
-			(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+		if (pm->show_pfn)
+			frame = swp_type(entry) |
+				(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
 		flags |= PM_SWAP;
 		if (is_migration_entry(entry))
 			page = migration_entry_to_page(entry);
@@ -1311,11 +1312,14 @@ static int pagemap_pmd_range(pmd_t *pmdp
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 		else if (is_swap_pmd(pmd)) {
 			swp_entry_t entry = pmd_to_swp_entry(pmd);
-			unsigned long offset = swp_offset(entry);
+			unsigned long offset;
 
-			offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
-			frame = swp_type(entry) |
-				(offset << MAX_SWAPFILES_SHIFT);
+			if (pm->show_pfn) {
+				offset = swp_offset(entry) +
+					((addr & ~PMD_MASK) >> PAGE_SHIFT);
+				frame = swp_type(entry) |
+					(offset << MAX_SWAPFILES_SHIFT);
+			}
 			flags |= PM_SWAP;
 			if (pmd_swp_soft_dirty(pmd))
 				flags |= PM_SOFT_DIRTY;
@@ -1333,10 +1337,12 @@ static int pagemap_pmd_range(pmd_t *pmdp
 			err = add_to_pagemap(addr, &pme, pm);
 			if (err)
 				break;
-			if (pm->show_pfn && (flags & PM_PRESENT))
-				frame++;
-			else if (flags & PM_SWAP)
-				frame += (1 << MAX_SWAPFILES_SHIFT);
+			if (pm->show_pfn) {
+				if (flags & PM_PRESENT)
+					frame++;
+				else if (flags & PM_SWAP)
+					frame += (1 << MAX_SWAPFILES_SHIFT);
+			}
 		}
 		spin_unlock(ptl);
 		return err;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 034/336] mm: vmalloc: avoid racy handling of debugobjects in vunmap
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 033/336] mm: /proc/pid/pagemap: hide swap entries from unprivileged users Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 035/336] mm/slub.c: add __printf verification to slab_err() Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chintan Pandya, Andrew Morton,
	Ard Biesheuvel, Byungchul Park, Catalin Marinas,
	Florian Fainelli, Johannes Weiner, Laura Abbott, Vlastimil Babka,
	Wei Yang, Yisheng Xie, Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chintan Pandya <cpandya@codeaurora.org>

[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ]

Currently, __vunmap flow is,
 1) Release the VM area
 2) Free the debug objects corresponding to that vm area.

This leave some race window open.
 1) Release the VM area
 1.5) Some other client gets the same vm area
 1.6) This client allocates new debug objects on the same
      vm area
 2) Free the debug objects corresponding to this vm area.

Here, we actually free 'other' client's debug objects.

Fix this by freeing the debug objects first and then releasing the VM
area.

Link: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Byungchul Park <byungchul.park@lge.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yisheng Xie <xieyisheng1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmalloc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, i
 			addr))
 		return;
 
-	area = remove_vm_area(addr);
+	area = find_vmap_area((unsigned long)addr)->vm;
 	if (unlikely(!area)) {
 		WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
 				addr);
@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, i
 	debug_check_no_locks_freed(addr, get_vm_area_size(area));
 	debug_check_no_obj_freed(addr, get_vm_area_size(area));
 
+	remove_vm_area(addr);
 	if (deallocate_pages) {
 		int i;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 035/336] mm/slub.c: add __printf verification to slab_err()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 034/336] mm: vmalloc: avoid racy handling of debugobjects in vunmap Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 036/336] rtc: ensure rtc_set_alarm fails when alarms are not supported Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Malaterre, Andrew Morton,
	Christoph Lameter, Pekka Enberg, David Rientjes, Joonsoo Kim,
	Linus Torvalds, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mathieu Malaterre <malat@debian.org>

[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ]

__printf is useful to verify format and arguments.  Remove the following
warning (with W=1):

  mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format]

Link: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org
Signed-off-by: Mathieu Malaterre <malat@debian.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/slub.c
+++ b/mm/slub.c
@@ -711,7 +711,7 @@ void object_err(struct kmem_cache *s, st
 	print_trailer(s, page, object);
 }
 
-static void slab_err(struct kmem_cache *s, struct page *page,
+static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,
 			const char *fmt, ...)
 {
 	va_list args;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 036/336] rtc: ensure rtc_set_alarm fails when alarms are not supported
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 035/336] mm/slub.c: add __printf verification to slab_err() Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 037/336] rxrpc: Fix terminal retransmission connection ID to include the channel Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]

When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set,
rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the
subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that
case.

Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting
programs think the alarms are working for a particular RTC when they are
not.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/interface.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -441,6 +441,11 @@ int rtc_set_alarm(struct rtc_device *rtc
 {
 	int err;
 
+	if (!rtc->ops)
+		return -ENODEV;
+	else if (!rtc->ops->set_alarm)
+		return -EINVAL;
+
 	err = rtc_valid_tm(&alarm->time);
 	if (err != 0)
 		return err;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 037/336] rxrpc: Fix terminal retransmission connection ID to include the channel
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 036/336] rtc: ensure rtc_set_alarm fails when alarms are not supported Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 038/336] net: hns3: Fix for VF mailbox cannot receiving PF response Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

[ Upstream commit fb1967a69f756073362b8f19347f863f227320ad ]

When retransmitting the final ACK or ABORT packet for a call, the cid field
in the packet header is set to the connection's cid, but this is incorrect
as it also needs to include the channel number on that connection that the
call was made on.

Fix this by OR'ing in the channel number.

Note that this fixes the bug that:

	commit 1a025028d400b23477341aa7ec2ce55f8b39b554
	rxrpc: Fix handling of call quietly cancelled out on server

works around.  I'm not intending to revert that as it will help protect
against problems that might occur on the server.

Fixes: 3136ef49a14c ("rxrpc: Delay terminal ACK transmission on a client call")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/conn_event.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -70,7 +70,7 @@ static void rxrpc_conn_retransmit_call(s
 	iov[2].iov_len	= sizeof(ack_info);
 
 	pkt.whdr.epoch		= htonl(conn->proto.epoch);
-	pkt.whdr.cid		= htonl(conn->proto.cid);
+	pkt.whdr.cid		= htonl(conn->proto.cid | channel);
 	pkt.whdr.callNumber	= htonl(call_id);
 	pkt.whdr.seq		= 0;
 	pkt.whdr.type		= chan->last_type;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 038/336] net: hns3: Fix for VF mailbox cannot receiving PF response
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 037/336] rxrpc: Fix terminal retransmission connection ID to include the channel Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 039/336] perf tools: Fix pmu events parsing rule Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit 1819e40908ee76c7219287224c22c772556c927e ]

When the VF frequently switches the CMDQ interrupt, if the CMDQ_SRC is not
cleared, the VF will not receive the new PF response after the interrupt
is re-enabled, the corresponding log is as follows:

[  317.482222] hns3 0000:00:03.0: VF could not get mbx resp(=0) from PF
in 500 tries
[  317.483137] hns3 0000:00:03.0: VF request to get tqp info from PF
failed -5

This patch fixes this problem by clearing CMDQ_SRC before enabling
interrupt and syncing pending IRQ handlers after disabling interrupt.

Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1441,6 +1441,8 @@ static int hclgevf_misc_irq_init(struct
 		return ret;
 	}
 
+	hclgevf_clear_event_cause(hdev, 0);
+
 	/* enable misc. vector(vector 0) */
 	hclgevf_enable_vector(&hdev->misc_vector, true);
 
@@ -1451,6 +1453,7 @@ static void hclgevf_misc_irq_uninit(stru
 {
 	/* disable misc vector(vector 0) */
 	hclgevf_enable_vector(&hdev->misc_vector, false);
+	synchronize_irq(hdev->misc_vector.vector_irq);
 	free_irq(hdev->misc_vector.vector_irq, hdev);
 	hclgevf_free_vector(hdev, 0);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 039/336] perf tools: Fix pmu events parsing rule
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 038/336] net: hns3: Fix for VF mailbox cannot receiving PF response Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 040/336] netfilter: ipset: forbid family for hash:mac sets Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Arnaldo Carvalho de Melo, Alexander Shishkin, David Ahern,
	Namhyung Kim, Peter Zijlstra, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Olsa <jolsa@kernel.org>

[ Upstream commit ceac7b79df7bd67ef9aaf464b0179a2686aff4ee ]

Currently all the event parsing fails end up
in the event_pmu rule, and display misleading
help like:

  $ perf stat -e inst kill
  event syntax error: 'inst'
                       \___ Cannot find PMU `inst'. Missing kernel support?
  ...

The reason is that the event_pmu is too strong
and match also single string. Changing it to
force the '/' separators to be part of the rule,
and getting the proper error now:

  $ perf stat -e inst kill
  event syntax error: 'inst'
                       \___ parser error
  Run 'perf list' for a list of valid events
  ...

Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20180605121416.31645-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/parse-events.y |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -73,6 +73,7 @@ static void inc_group_count(struct list_
 %type <num> value_sym
 %type <head> event_config
 %type <head> opt_event_config
+%type <head> opt_pmu_config
 %type <term> event_term
 %type <head> event_pmu
 %type <head> event_legacy_symbol
@@ -224,7 +225,7 @@ event_def: event_pmu |
 	   event_bpf_file
 
 event_pmu:
-PE_NAME opt_event_config
+PE_NAME opt_pmu_config
 {
 	struct list_head *list, *orig_terms, *terms;
 
@@ -495,6 +496,17 @@ opt_event_config:
 {
 	$$ = NULL;
 }
+
+opt_pmu_config:
+'/' event_config '/'
+{
+	$$ = $2;
+}
+|
+'/' '/'
+{
+	$$ = NULL;
+}
 
 start_terms: event_config
 {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 040/336] netfilter: ipset: forbid family for hash:mac sets
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 039/336] perf tools: Fix pmu events parsing rule Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 041/336] netfilter: ipset: List timing out entries with "timeout 1" instead of zero Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florent Fourcot, Victorien Molle,
	Jozsef Kadlecsik, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florent Fourcot <florent.fourcot@wifirst.fr>

[ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ]

Userspace `ipset` command forbids family option for hash:mac type:

ipset create test hash:mac family inet4
ipset v6.30: Unknown argument: `family'

However, this check is not done in kernel itself. When someone use
external netlink applications (pyroute2 python library for example), one
can create hash:mac with invalid family and inconsistant results from
userspace (`ipset` command cannot read set content anymore).

This patch enforce the logic in kernel, and forbids insertion of
hash:mac with a family set.

Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
impact on other hash:* sets

Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *
 	pr_debug("Create set %s with family %s\n",
 		 set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");
 
-#ifndef IP_SET_PROTO_UNDEF
+#ifdef IP_SET_PROTO_UNDEF
+	if (set->family != NFPROTO_UNSPEC)
+		return -IPSET_ERR_INVALID_FAMILY;
+#else
 	if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
 		return -IPSET_ERR_INVALID_FAMILY;
 #endif



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 041/336] netfilter: ipset: List timing out entries with "timeout 1" instead of zero
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 040/336] netfilter: ipset: forbid family for hash:mac sets Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 042/336] irqchip/ls-scfg-msi: Map MSIs in the iommu Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jozsef Kadlecsik, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ]

When listing sets with timeout support, there's a probability that
just timing out entries with "0" timeout value is listed/saved.
However when restoring the saved list, the zero timeout value means
permanent elelements.

The new behaviour is that timing out entries are listed with "timeout 1"
instead of zero.

Fixes netfilter bugzilla #1258.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netfilter/ipset/ip_set_timeout.h |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/include/linux/netfilter/ipset/ip_set_timeout.h
+++ b/include/linux/netfilter/ipset/ip_set_timeout.h
@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeou
 static inline u32
 ip_set_timeout_get(const unsigned long *timeout)
 {
-	return *timeout == IPSET_ELEM_PERMANENT ? 0 :
-		jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
+	u32 t;
+
+	if (*timeout == IPSET_ELEM_PERMANENT)
+		return 0;
+
+	t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
+	/* Zero value in userspace means no timeout */
+	return t == 0 ? 1 : t;
 }
 
 #endif	/* __KERNEL__ */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 042/336] irqchip/ls-scfg-msi: Map MSIs in the iommu
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 041/336] netfilter: ipset: List timing out entries with "timeout 1" instead of zero Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 043/336] watchdog: da9063: Fix updating timeout value Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurentiu Tudor, Thomas Gleixner,
	jason, marc.zyngier, zhiqiang.hou, minghuan.lian, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

[ Upstream commit 0cdd431c337e99177e68597f3de34bedd3a20a74 ]

Add the required iommu_dma_map_msi_msg() when composing the MSI message,
otherwise the interrupts will not work.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: jason@lakedaemon.net
Cc: marc.zyngier@arm.com
Cc: zhiqiang.hou@nxp.com
Cc: minghuan.lian@nxp.com
Link: https://lkml.kernel.org/r/20180605122727.12831-1-laurentiu.tudor@nxp.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/irqchip/irq-ls-scfg-msi.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/irqchip/irq-ls-scfg-msi.c
+++ b/drivers/irqchip/irq-ls-scfg-msi.c
@@ -21,6 +21,7 @@
 #include <linux/of_pci.h>
 #include <linux/of_platform.h>
 #include <linux/spinlock.h>
+#include <linux/dma-iommu.h>
 
 #define MSI_IRQS_PER_MSIR	32
 #define MSI_MSIR_OFFSET		4
@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(stru
 
 	if (msi_affinity_flag)
 		msg->data |= cpumask_first(data->common->affinity);
+
+	iommu_dma_map_msi_msg(data->irq, msg);
 }
 
 static int ls_scfg_msi_set_affinity(struct irq_data *irq_data,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 043/336] watchdog: da9063: Fix updating timeout value
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 042/336] irqchip/ls-scfg-msi: Map MSIs in the iommu Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 044/336] media: arch: sh: migor: Fix TW9910 PDN gpio Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marco Felsch, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marco Felsch <m.felsch@pengutronix.de>

[ Upstream commit 44ee54aabfdb3b35866ed909bde3ab01e9679385 ]

The DA9063 watchdog has only one register field to store the timeout value
and to enable the watchdog. The watchdog gets enabled if the value is
not zero. There is no issue if the watchdog is already running but it
leads into problems if the watchdog is disabled.

If the watchdog is disabled and only the timeout value should be prepared
the watchdog gets enabled too. Add a check to get the current watchdog
state and update the watchdog timeout value on hw-side only if the
watchdog is already active.

Fixes: 5e9c16e37608 ("watchdog: Add DA9063 PMIC watchdog driver.")
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/watchdog/da9063_wdt.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/drivers/watchdog/da9063_wdt.c
+++ b/drivers/watchdog/da9063_wdt.c
@@ -99,10 +99,23 @@ static int da9063_wdt_set_timeout(struct
 {
 	struct da9063 *da9063 = watchdog_get_drvdata(wdd);
 	unsigned int selector;
-	int ret;
+	int ret = 0;
 
 	selector = da9063_wdt_timeout_to_sel(timeout);
-	ret = _da9063_wdt_set_timeout(da9063, selector);
+
+	/*
+	 * There are two cases when a set_timeout() will be called:
+	 * 1. The watchdog is off and someone wants to set the timeout for the
+	 *    further use.
+	 * 2. The watchdog is already running and a new timeout value should be
+	 *    set.
+	 *
+	 * The watchdog can't store a timeout value not equal zero without
+	 * enabling the watchdog, so the timeout must be buffered by the driver.
+	 */
+	if (watchdog_active(wdd))
+		ret = _da9063_wdt_set_timeout(da9063, selector);
+
 	if (ret)
 		dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n",
 			ret);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 044/336] media: arch: sh: migor: Fix TW9910 PDN gpio
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 043/336] watchdog: da9063: Fix updating timeout value Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 045/336] printk: drop in_nmi check from printk_safe_flush_on_panic() Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit 2b787b66bcb03ec3bd97e950464e0452f459e2ca ]

The TW9910 PDN gpio (power down) is listed as active high in the chip
manual. It turns out it is actually active low as when set to physical
level 0 it actually turns the video decoder power off.

Without this patch applied:
tw9910 0-0045: Product ID error 1f:2

With this patch applied:
tw9910 0-0045: tw9910 Product ID b:0

Fixes: commit "186c446f4b840bd77b79d3dc951ca436cb8abe79"

Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sh/boards/mach-migor/setup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -359,7 +359,7 @@ static struct gpiod_lookup_table ov7725_
 static struct gpiod_lookup_table tw9910_gpios = {
 	.dev_id		= "0-0045",
 	.table		= {
-		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_LOW),
 		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT3, "rstb", GPIO_ACTIVE_LOW),
 	},
 };



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 045/336] printk: drop in_nmi check from printk_safe_flush_on_panic()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 044/336] media: arch: sh: migor: Fix TW9910 PDN gpio Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46   ` [PATCH 4.17 046/336] bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64, i64} Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel, Steven Rostedt
  Cc: Greg Kroah-Hartman, stable, Peter Zijlstra, Sergey Senozhatsky,
	Petr Mladek, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>

[ Upstream commit 554755be08fba31c74f66b82a485e5513205af84 ]

Drop the in_nmi() check from printk_safe_flush_on_panic()
and attempt to re-init (IOW unlock) locked logbuf spinlock
from panic CPU regardless of its context.

Otherwise, theoretically, we can deadlock on logbuf trying to flush
per-CPU buffers:

  a) Panic CPU is running in non-NMI context
  b) Panic CPU sends out shutdown IPI via reboot vector
  c) Panic CPU fails to stop all remote CPUs
  d) Panic CPU sends out shutdown IPI via NMI vector
     One of the CPUs that we bring down via NMI vector can hold
     logbuf spin lock (theoretically).

Link: http://lkml.kernel.org/r/20180530070350.10131-1-sergey.senozhatsky@gmail.com
To: Steven Rostedt <rostedt@goodmis.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/printk/printk_safe.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/printk/printk_safe.c
+++ b/kernel/printk/printk_safe.c
@@ -281,7 +281,7 @@ void printk_safe_flush_on_panic(void)
 	 * Make sure that we could access the main ring buffer.
 	 * Do not risk a double release when more CPUs are up.
 	 */
-	if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) {
+	if (raw_spin_is_locked(&logbuf_lock)) {
 		if (num_online_cpus() > 1)
 			return;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 046/336] bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
@ 2018-08-01 16:46   ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
                     ` (310 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang YanQing, Shubham Bansal,
	linux-arm-kernel, linux, Daniel Borkmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang YanQing <udknight@gmail.com>

[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ]

The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*,
the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but
the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*.

For consistence reason, let's rename emit_a32_lsr_* to
emit_a32_rsh_*.

This patch also corrects a wrong comment.

Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
Signed-off-by: Wang YanQing <udknight@gmail.com>
Cc: Shubham Bansal <illusionist.neo@gmail.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux@armlinux.org.uk
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/net/bpf_jit_32.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -708,7 +708,7 @@ static inline void emit_a32_arsh_r64(con
 }
 
 /* dst = dst >> src */
-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk,
+static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
 				     bool sstk, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];
@@ -724,7 +724,7 @@ static inline void emit_a32_lsr_r64(cons
 		emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx);
 	}
 
-	/* Do LSH operation */
+	/* Do RSH operation */
 	emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
 	emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
 	emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);
@@ -774,7 +774,7 @@ static inline void emit_a32_lsh_i64(cons
 }
 
 /* dst = dst >> val */
-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk,
+static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk,
 				    const u32 val, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];
@@ -1330,7 +1330,7 @@ static int build_insn(const struct bpf_i
 	case BPF_ALU64 | BPF_RSH | BPF_K:
 		if (unlikely(imm > 63))
 			return -EINVAL;
-		emit_a32_lsr_i64(dst, dstk, imm, ctx);
+		emit_a32_rsh_i64(dst, dstk, imm, ctx);
 		break;
 	/* dst = dst << src */
 	case BPF_ALU64 | BPF_LSH | BPF_X:
@@ -1338,7 +1338,7 @@ static int build_insn(const struct bpf_i
 		break;
 	/* dst = dst >> src */
 	case BPF_ALU64 | BPF_RSH | BPF_X:
-		emit_a32_lsr_r64(dst, src, dstk, sstk, ctx);
+		emit_a32_rsh_r64(dst, src, dstk, sstk, ctx);
 		break;
 	/* dst = dst >> src (signed) */
 	case BPF_ALU64 | BPF_ARSH | BPF_X:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 046/336] bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64, i64}
@ 2018-08-01 16:46   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-arm-kernel

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang YanQing <udknight@gmail.com>

[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ]

The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*,
the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but
the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*.

For consistence reason, let's rename emit_a32_lsr_* to
emit_a32_rsh_*.

This patch also corrects a wrong comment.

Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
Signed-off-by: Wang YanQing <udknight@gmail.com>
Cc: Shubham Bansal <illusionist.neo@gmail.com>
Cc: linux-arm-kernel at lists.infradead.org
Cc: linux at armlinux.org.uk
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/net/bpf_jit_32.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -708,7 +708,7 @@ static inline void emit_a32_arsh_r64(con
 }
 
 /* dst = dst >> src */
-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk,
+static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
 				     bool sstk, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];
@@ -724,7 +724,7 @@ static inline void emit_a32_lsr_r64(cons
 		emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx);
 	}
 
-	/* Do LSH operation */
+	/* Do RSH operation */
 	emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
 	emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
 	emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);
@@ -774,7 +774,7 @@ static inline void emit_a32_lsh_i64(cons
 }
 
 /* dst = dst >> val */
-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk,
+static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk,
 				    const u32 val, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];
@@ -1330,7 +1330,7 @@ static int build_insn(const struct bpf_i
 	case BPF_ALU64 | BPF_RSH | BPF_K:
 		if (unlikely(imm > 63))
 			return -EINVAL;
-		emit_a32_lsr_i64(dst, dstk, imm, ctx);
+		emit_a32_rsh_i64(dst, dstk, imm, ctx);
 		break;
 	/* dst = dst << src */
 	case BPF_ALU64 | BPF_LSH | BPF_X:
@@ -1338,7 +1338,7 @@ static int build_insn(const struct bpf_i
 		break;
 	/* dst = dst >> src */
 	case BPF_ALU64 | BPF_RSH | BPF_X:
-		emit_a32_lsr_r64(dst, src, dstk, sstk, ctx);
+		emit_a32_rsh_r64(dst, src, dstk, sstk, ctx);
 		break;
 	/* dst = dst >> src (signed) */
 	case BPF_ALU64 | BPF_ARSH | BPF_X:

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 047/336] ceph: fix alignment of rasize
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2018-08-01 16:46   ` [PATCH 4.17 046/336] bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64, i64} Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 048/336] ceph: fix use-after-free in ceph_statfs() Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chengguang Xu, Yan, Zheng,
	Ilya Dryomov, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chengguang Xu <cgxu519@gmx.com>

[ Upstream commit c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7 ]

On currently logic:
when I specify rasize=0~1 then it will be 4096.
when I specify rasize=2~4097 then it will be 8192.

Make it the same as rsize & wsize.

Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/super.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -268,7 +268,7 @@ static int parse_fsopt_token(char *c, vo
 	case Opt_rasize:
 		if (intval < 0)
 			return -EINVAL;
-		fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE);
+		fsopt->rasize = ALIGN(intval, PAGE_SIZE);
 		break;
 	case Opt_caps_wanted_delay_min:
 		if (intval < 1)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 048/336] ceph: fix use-after-free in ceph_statfs()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 047/336] ceph: fix alignment of rasize Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 049/336] e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luis Henriques, Yan, Zheng,
	Ilya Dryomov, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luis Henriques <lhenriques@suse.com>

[ Upstream commit 73fb0949cf246b212ff63d692a0ec88db954bb35 ]

KASAN found an UAF in ceph_statfs.  This was a one-off bug but looking at
the code it looks like the monmap access needs to be protected as it can
be modified while we're accessing it.  Fix this by protecting the access
with the monc->mutex.

  BUG: KASAN: use-after-free in ceph_statfs+0x21d/0x2c0
  Read of size 8 at addr ffff88006844f2e0 by task trinity-c5/304

  CPU: 0 PID: 304 Comm: trinity-c5 Not tainted 4.17.0-rc6+ #172
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
  Call Trace:
   dump_stack+0xa5/0x11b
   ? show_regs_print_info+0x5/0x5
   ? kmsg_dump_rewind+0x118/0x118
   ? ceph_statfs+0x21d/0x2c0
   print_address_description+0x73/0x2b0
   ? ceph_statfs+0x21d/0x2c0
   kasan_report+0x243/0x360
   ceph_statfs+0x21d/0x2c0
   ? ceph_umount_begin+0x80/0x80
   ? kmem_cache_alloc+0xdf/0x1a0
   statfs_by_dentry+0x79/0xb0
   vfs_statfs+0x28/0x110
   user_statfs+0x8c/0xe0
   ? vfs_statfs+0x110/0x110
   ? __fdget_raw+0x10/0x10
   __se_sys_statfs+0x5d/0xa0
   ? user_statfs+0xe0/0xe0
   ? mutex_unlock+0x1d/0x40
   ? __x64_sys_statfs+0x20/0x30
   do_syscall_64+0xee/0x290
   ? syscall_return_slowpath+0x1c0/0x1c0
   ? page_fault+0x1e/0x30
   ? syscall_return_slowpath+0x13c/0x1c0
   ? prepare_exit_to_usermode+0xdb/0x140
   ? syscall_trace_enter+0x330/0x330
   ? __put_user_4+0x1c/0x30
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

  Allocated by task 130:
   __kmalloc+0x124/0x210
   ceph_monmap_decode+0x1c1/0x400
   dispatch+0x113/0xd20
   ceph_con_workfn+0xa7e/0x44e0
   process_one_work+0x5f0/0xa30
   worker_thread+0x184/0xa70
   kthread+0x1a0/0x1c0
   ret_from_fork+0x35/0x40

  Freed by task 130:
   kfree+0xb8/0x210
   dispatch+0x15a/0xd20
   ceph_con_workfn+0xa7e/0x44e0
   process_one_work+0x5f0/0xa30
   worker_thread+0x184/0xa70
   kthread+0x1a0/0x1c0
   ret_from_fork+0x35/0x40

Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/super.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -45,7 +45,7 @@ static void ceph_put_super(struct super_
 static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	struct ceph_fs_client *fsc = ceph_inode_to_client(d_inode(dentry));
-	struct ceph_monmap *monmap = fsc->client->monc.monmap;
+	struct ceph_mon_client *monc = &fsc->client->monc;
 	struct ceph_statfs st;
 	u64 fsid;
 	int err;
@@ -58,7 +58,7 @@ static int ceph_statfs(struct dentry *de
 	}
 
 	dout("statfs\n");
-	err = ceph_monc_do_statfs(&fsc->client->monc, data_pool, &st);
+	err = ceph_monc_do_statfs(monc, data_pool, &st);
 	if (err < 0)
 		return err;
 
@@ -94,8 +94,11 @@ static int ceph_statfs(struct dentry *de
 	buf->f_namelen = NAME_MAX;
 
 	/* Must convert the fsid, for consistent values across arches */
-	fsid = le64_to_cpu(*(__le64 *)(&monmap->fsid)) ^
-	       le64_to_cpu(*((__le64 *)&monmap->fsid + 1));
+	mutex_lock(&monc->mutex);
+	fsid = le64_to_cpu(*(__le64 *)(&monc->monmap->fsid)) ^
+	       le64_to_cpu(*((__le64 *)&monc->monmap->fsid + 1));
+	mutex_unlock(&monc->mutex);
+
 	buf->f_fsid.val[0] = fsid & 0xffffffff;
 	buf->f_fsid.val[1] = fsid >> 32;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 049/336] e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 048/336] ceph: fix use-after-free in ceph_statfs() Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 050/336] infiniband: fix a possible use-after-free bug Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Achim Mildenberger, Benjamin Poirier,
	Aaron Brown, Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Poirier <bpoirier@suse.com>

[ Upstream commit fff200caf6f9179dd9a7fc67acd659e614c3f72f ]

There have been multiple reports of crashes that look like
kernel: RIP: 0010:[<ffffffff8110303f>] timecounter_read+0xf/0x50
[...]
kernel: Call Trace:
kernel:  [<ffffffffa0806b0f>] e1000e_phc_gettime+0x2f/0x60 [e1000e]
kernel:  [<ffffffffa0806c5d>] e1000e_systim_overflow_work+0x1d/0x80 [e1000e]
kernel:  [<ffffffff810992c5>] process_one_work+0x155/0x440
kernel:  [<ffffffff81099e16>] worker_thread+0x116/0x4b0
kernel:  [<ffffffff8109f422>] kthread+0xd2/0xf0
kernel:  [<ffffffff8163184f>] ret_from_fork+0x3f/0x70

These can be traced back to the fact that e1000e_systim_reset() skips the
timecounter_init() call if e1000e_get_base_timinca() returns -EINVAL, which
leads to a null deref in timecounter_read().

Commit 83129b37ef35 ("e1000e: fix systim issues", v4.2-rc1) reworked
e1000e_get_base_timinca() in such a way that it can return -EINVAL for
e1000_pch_spt if the SYSCFI bit is not set in TSYNCRXCTL.

Some experimentation has shown that on I219 (e1000_pch_spt, "MAC: 12")
adapters, the E1000_TSYNCRXCTL_SYSCFI flag is unstable; TSYNCRXCTL reads
sometimes don't have the SYSCFI bit set. Retrying the read shortly after
finds the bit to be set. This was observed at boot (probe) but also link up
and link down.

Moreover, the phc (PTP Hardware Clock) seems to operate normally even after
reads where SYSCFI=0. Therefore, remove this register read and
unconditionally set the clock parameters.

Reported-by: Achim Mildenberger <admin@fph.physik.uni-karlsruhe.de>
Message-Id: <20180425065243.g5mqewg5irkwgwgv@f2>
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1075876
Fixes: 83129b37ef35 ("e1000e: fix systim issues")
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/e1000e/netdev.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3546,15 +3546,12 @@ s32 e1000e_get_base_timinca(struct e1000
 		}
 		break;
 	case e1000_pch_spt:
-		if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
-			/* Stable 24MHz frequency */
-			incperiod = INCPERIOD_24MHZ;
-			incvalue = INCVALUE_24MHZ;
-			shift = INCVALUE_SHIFT_24MHZ;
-			adapter->cc.shift = shift;
-			break;
-		}
-		return -EINVAL;
+		/* Stable 24MHz frequency */
+		incperiod = INCPERIOD_24MHZ;
+		incvalue = INCVALUE_24MHZ;
+		shift = INCVALUE_SHIFT_24MHZ;
+		adapter->cc.shift = shift;
+		break;
 	case e1000_pch_cnp:
 		if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
 			/* Stable 24MHz frequency */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 050/336] infiniband: fix a possible use-after-free bug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 049/336] e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 051/336] powerpc/lib: Adjust .balign inside string functions for PPC32 Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Noam Rathaus, Cong Wang,
	Jason Gunthorpe, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]

ucma_process_join() will free the new allocated "mc" struct,
if there is any error after that, especially the copy_to_user().

But in parallel, ucma_leave_multicast() could find this "mc"
through idr_find() before ucma_process_join() frees it, since it
is already published.

So "mc" could be used in ucma_leave_multicast() after it is been
allocated and freed in ucma_process_join(), since we don't refcnt
it.

Fix this by separating "publish" from ID allocation, so that we
can get an ID first and publish it later after copy_to_user().

Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/core/ucma.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc
 		return NULL;
 
 	mutex_lock(&mut);
-	mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
+	mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
 	mutex_unlock(&mut);
 	if (mc->id < 0)
 		goto error;
@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct
 		goto err3;
 	}
 
+	mutex_lock(&mut);
+	idr_replace(&multicast_idr, mc, mc->id);
+	mutex_unlock(&mut);
+
 	mutex_unlock(&file->mut);
 	ucma_put_ctx(ctx);
 	return 0;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 051/336] powerpc/lib: Adjust .balign inside string functions for PPC32
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 050/336] infiniband: fix a possible use-after-free bug Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 052/336] powerpc/64s: Add barrier_nospec Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit 1128bb7813a896bd608fb622eee3c26aaf33b473 ]

commit 87a156fb18fe1 ("Align hot loops of some string functions")
degraded the performance of string functions by adding useless
nops

A simple benchmark on an 8xx calling 100000x a memchr() that
matches the first byte runs in 41668 TB ticks before this patch
and in 35986 TB ticks after this patch. So this gives an
improvement of approx 10%

Another benchmark doing the same with a memchr() matching the 128th
byte runs in 1011365 TB ticks before this patch and 1005682 TB ticks
after this patch, so regardless on the number of loops, removing
those useless nops improves the test by 5683 TB ticks.

Fixes: 87a156fb18fe1 ("Align hot loops of some string functions")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/cache.h |    3 +++
 arch/powerpc/lib/string.S        |    7 ++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

--- a/arch/powerpc/include/asm/cache.h
+++ b/arch/powerpc/include/asm/cache.h
@@ -9,11 +9,14 @@
 #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX)
 #define L1_CACHE_SHIFT		4
 #define MAX_COPY_PREFETCH	1
+#define IFETCH_ALIGN_SHIFT	2
 #elif defined(CONFIG_PPC_E500MC)
 #define L1_CACHE_SHIFT		6
 #define MAX_COPY_PREFETCH	4
+#define IFETCH_ALIGN_SHIFT	3
 #elif defined(CONFIG_PPC32)
 #define MAX_COPY_PREFETCH	4
+#define IFETCH_ALIGN_SHIFT	3	/* 603 fetches 2 insn at a time */
 #if defined(CONFIG_PPC_47x)
 #define L1_CACHE_SHIFT		7
 #else
--- a/arch/powerpc/lib/string.S
+++ b/arch/powerpc/lib/string.S
@@ -12,6 +12,7 @@
 #include <asm/errno.h>
 #include <asm/ppc_asm.h>
 #include <asm/export.h>
+#include <asm/cache.h>
 
 	.text
 	
@@ -23,7 +24,7 @@ _GLOBAL(strncpy)
 	mtctr	r5
 	addi	r6,r3,-1
 	addi	r4,r4,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r0,1(r4)
 	cmpwi	0,r0,0
 	stbu	r0,1(r6)
@@ -43,7 +44,7 @@ _GLOBAL(strncmp)
 	mtctr	r5
 	addi	r5,r3,-1
 	addi	r4,r4,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r3,1(r5)
 	cmpwi	1,r3,0
 	lbzu	r0,1(r4)
@@ -77,7 +78,7 @@ _GLOBAL(memchr)
 	beq-	2f
 	mtctr	r5
 	addi	r3,r3,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r0,1(r3)
 	cmpw	0,r0,r4
 	bdnzf	2,1b



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 052/336] powerpc/64s: Add barrier_nospec
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 051/336] powerpc/lib: Adjust .balign inside string functions for PPC32 Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 053/336] powerpc/eeh: Fix use-after-release of EEH driver Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michal Suchanek, Michael Ellerman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Suchanek <msuchanek@suse.de>

[ Upstream commit a6b3964ad71a61bb7c61d80a60bea7d42187b2eb ]

A no-op form of ori (or immediate of 0 into r31 and the result stored
in r31) has been re-tasked as a speculation barrier. The instruction
only acts as a barrier on newer machines with appropriate firmware
support. On older CPUs it remains a harmless no-op.

Implement barrier_nospec using this instruction.

mpe: The semantics of the instruction are believed to be that it
prevents execution of subsequent instructions until preceding branches
have been fully resolved and are no longer executing speculatively.
There is no further documentation available at this time.

Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/barrier.h |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

--- a/arch/powerpc/include/asm/barrier.h
+++ b/arch/powerpc/include/asm/barrier.h
@@ -76,6 +76,21 @@ do {									\
 	___p1;								\
 })
 
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * Prevent execution of subsequent instructions until preceding branches have
+ * been fully resolved and are no longer executing speculatively.
+ */
+#define barrier_nospec_asm ori 31,31,0
+
+// This also acts as a compiler barrier due to the memory clobber.
+#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory")
+
+#else /* !CONFIG_PPC_BOOK3S_64 */
+#define barrier_nospec_asm
+#define barrier_nospec()
+#endif
+
 #include <asm-generic/barrier.h>
 
 #endif /* _ASM_POWERPC_BARRIER_H */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 053/336] powerpc/eeh: Fix use-after-release of EEH driver
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 052/336] powerpc/64s: Add barrier_nospec Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 054/336] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common() Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sam Bobroff, Michael Ellerman, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sam Bobroff <sbobroff@linux.ibm.com>

[ Upstream commit 46d4be41b987a6b2d25a2ebdd94cafb44e21d6c5 ]

Correct two cases where eeh_pcid_get() is used to reference the driver's
module but the reference is dropped before the driver pointer is used.

In eeh_rmv_device() also refactor a little so that only two calls to
eeh_pcid_put() are needed, rather than three and the reference isn't
taken at all if it wasn't needed.

Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/eeh_driver.c |   28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -458,9 +458,11 @@ static void *eeh_add_virt_device(void *d
 
 	driver = eeh_pcid_get(dev);
 	if (driver) {
-		eeh_pcid_put(dev);
-		if (driver->err_handler)
+		if (driver->err_handler) {
+			eeh_pcid_put(dev);
 			return NULL;
+		}
+		eeh_pcid_put(dev);
 	}
 
 #ifdef CONFIG_PCI_IOV
@@ -497,17 +499,19 @@ static void *eeh_rmv_device(void *data,
 	if (eeh_dev_removed(edev))
 		return NULL;
 
-	driver = eeh_pcid_get(dev);
-	if (driver) {
-		eeh_pcid_put(dev);
-		if (removed &&
-		    eeh_pe_passed(edev->pe))
-			return NULL;
-		if (removed &&
-		    driver->err_handler &&
-		    driver->err_handler->error_detected &&
-		    driver->err_handler->slot_reset)
+	if (removed) {
+		if (eeh_pe_passed(edev->pe))
 			return NULL;
+		driver = eeh_pcid_get(dev);
+		if (driver) {
+			if (driver->err_handler &&
+			    driver->err_handler->error_detected &&
+			    driver->err_handler->slot_reset) {
+				eeh_pcid_put(dev);
+				return NULL;
+			}
+			eeh_pcid_put(dev);
+		}
 	}
 
 	/* Remove it from PCI subsystem */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 054/336] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 053/336] powerpc/eeh: Fix use-after-release of EEH driver Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 055/336] powerpc/64s: Fix compiler store ordering to SLB shadow area Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stewart Smith, Michael Ellerman, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stewart Smith <stewart@linux.ibm.com>

[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ]

time_init() will set up tb_ticks_per_usec based on reality.
time_init() is called *after* udbg_init_opal_common() during boot.

from arch/powerpc/kernel/time.c:
  unsigned long tb_ticks_per_usec = 100; /* sane default */

Currently, all powernv systems have a timebase frequency of 512mhz
(512000000/1000000 == 0x200) - although there's nothing written
down anywhere that I can find saying that we couldn't make that
different based on the requirements in the ISA.

So, we've been (accidentally) thwacking the (currently) correct
(for powernv at least) value for tb_ticks_per_usec earlier than
we otherwise would have.

The "sane default" seems to be adequate for our purposes between
udbg_init_opal_common() and time_init() being called, and if it isn't,
then we should probably be setting it somewhere that isn't hvc_opal.c!

Signed-off-by: Stewart Smith <stewart@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/hvc/hvc_opal.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/tty/hvc/hvc_opal.c
+++ b/drivers/tty/hvc/hvc_opal.c
@@ -318,7 +318,6 @@ static void udbg_init_opal_common(void)
 	udbg_putc = udbg_opal_putc;
 	udbg_getc = udbg_opal_getc;
 	udbg_getc_poll = udbg_opal_getc_poll;
-	tb_ticks_per_usec = 0x200; /* Make udelay not suck */
 }
 
 void __init hvc_opal_init_early(void)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 055/336] powerpc/64s: Fix compiler store ordering to SLB shadow area
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 054/336] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common() Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 056/336] clk-si544: Properly round requested frequency to nearest match Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Michael Ellerman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Piggin <npiggin@gmail.com>

[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ]

The stores to update the SLB shadow area must be made as they appear
in the C code, so that the hypervisor does not see an entry with
mismatched vsid and esid. Use WRITE_ONCE for this.

GCC has been observed to elide the first store to esid in the update,
which means that if the hypervisor interrupts the guest after storing
to vsid, it could see an entry with old esid and new vsid, which may
possibly result in memory corruption.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/mm/slb.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -63,14 +63,14 @@ static inline void slb_shadow_update(uns
 	 * updating it.  No write barriers are needed here, provided
 	 * we only update the current CPU's SLB shadow buffer.
 	 */
-	p->save_area[index].esid = 0;
-	p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags));
-	p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index));
+	WRITE_ONCE(p->save_area[index].esid, 0);
+	WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags)));
+	WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index)));
 }
 
 static inline void slb_shadow_clear(enum slb_index index)
 {
-	get_slb_shadow()->save_area[index].esid = 0;
+	WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0);
 }
 
 static inline void create_shadowed_slbe(unsigned long ea, int ssize,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 056/336] clk-si544: Properly round requested frequency to nearest match
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 055/336] powerpc/64s: Fix compiler store ordering to SLB shadow area Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 057/336] clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Looijmans, Stephen Boyd, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mike Looijmans <mike.looijmans@topic.nl>

[ Upstream commit 4d3f36c5e9ca0f947eed71660239c529c501141a ]

The si544 driver had a rounding problem that using the result of clk_round_rate
may set the clock to yet another rate, for example:
clk_round_rate(195000000) = 194999999
clk_round_rate(194999999) = 194999998

Clients would expect that after clk_set_rate(clk, freq2=clk_round_rate(clk, freq)) the
chip will be running at exactly freq2.

The problem was in the calculation of the feedback divider, it was always rounded
down instead of to the nearest possible VCO value.

After this change, the following holds true for any supported frequency:
actual_freq = clk_round_rate(clk, freq);
clk_set_rate(clk, actual_freq);
clk_round_rate(clk, actual_freq) == actual_freq && clk_get_rate(clk) == actual_freq

Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Fixes: 953cc3e81170 ("clk: Add driver for the si544 clock generator chip")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/clk-si544.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/clk/clk-si544.c
+++ b/drivers/clk/clk-si544.c
@@ -207,6 +207,7 @@ static int si544_calc_muldiv(struct clk_
 
 	/* And the fractional bits using the remainder */
 	vco = (u64)tmp << 32;
+	vco += FXO / 2; /* Round to nearest multiple */
 	do_div(vco, FXO);
 	settings->fb_div_frac = vco;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 057/336] clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 056/336] clk-si544: Properly round requested frequency to nearest match Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 058/336] net: hns3: Fix for phy not link up problem after resetting Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Stephen Boyd, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Cercueil <paul@crapouillou.net>

[ Upstream commit 45ba63a29fd9b8a461110185e3abc5b4c90b806a ]

When the main processor goes idle, by default its clock is stopped.
However, this also stops the clock of the co-processor.

Here, if the C1CLK clock is enabled, we disable this functionality.

Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/ingenic/jz4770-cgu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/clk/ingenic/jz4770-cgu.c
+++ b/drivers/clk/ingenic/jz4770-cgu.c
@@ -194,9 +194,10 @@ static const struct ingenic_cgu_clk_info
 		.div = { CGU_REG_CPCCR, 16, 1, 4, 22, -1, -1 },
 	},
 	[JZ4770_CLK_C1CLK] = {
-		"c1clk", CGU_CLK_DIV,
+		"c1clk", CGU_CLK_DIV | CGU_CLK_GATE,
 		.parents = { JZ4770_CLK_PLL0, },
 		.div = { CGU_REG_CPCCR, 12, 1, 4, 22, -1, -1 },
+		.gate = { CGU_REG_OPCR, 31, true }, // disable CCLK stop on idle
 	},
 	[JZ4770_CLK_PCLK] = {
 		"pclk", CGU_CLK_DIV,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 058/336] net: hns3: Fix for phy not link up problem after resetting
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 057/336] clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 059/336] net: hns3: Fix for service_task not running " Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunsheng Lin, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit 9617f66867b09b326cc932416be2431c5b91c8d8 ]

When resetting, phy_state_machine may be accessing the phy through
firmware if the phy is not stopped or disconnected, which will
cause firemware timeout problem because the firmware is busy
processing the reset request.

This patch fixes it by disabling the phy when resetting.

Fixes: b940aeae0ed6 ("net: hns3: never send command queue message to IMP when reset")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3787,9 +3787,6 @@ static int hclge_ae_start(struct hnae3_h
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);
 
-	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
-		return 0;
-
 	ret = hclge_mac_start_phy(hdev);
 	if (ret)
 		return ret;
@@ -3806,8 +3803,10 @@ static void hclge_ae_stop(struct hnae3_h
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
 
-	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
+		hclge_mac_stop_phy(hdev);
 		return;
+	}
 
 	for (i = 0; i < vport->alloc_tqps; i++)
 		hclge_tqp_enable(hdev, i, 0, false);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 059/336] net: hns3: Fix for service_task not running problem after resetting
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 058/336] net: hns3: Fix for phy not link up problem after resetting Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 060/336] RDMA/mad: Convert BUG_ONs to error flows Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunsheng Lin, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit f5be79673fc4c925708c99ec37d77e0a2c3cd30b ]

When hclge_ae_stop is called during resetting, it will cancel the
service_task by calling cancel_work_sync, which may cause the
service_task to exit without clearing HCLGE_STATE_SERVICE_SCHED
bit. If this happens, the service_task will never run again.

This patch fixes this problem by clearing it after calling
cancel_work_sync in hclge_ae_stop.

Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c   |    1 +
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3802,6 +3802,7 @@ static void hclge_ae_stop(struct hnae3_h
 
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
+	clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
 
 	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
 		hclge_mac_stop_phy(hdev);
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1323,6 +1323,7 @@ static void hclgevf_ae_stop(struct hnae3
 	hclgevf_reset_tqp_stats(handle);
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
+	clear_bit(HCLGEVF_STATE_SERVICE_SCHED, &hdev->state);
 	hclgevf_update_link_status(hdev, 0);
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 060/336] RDMA/mad: Convert BUG_ONs to error flows
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 059/336] net: hns3: Fix for service_task not running " Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 064/336] netfilter: nf_tables: check msg_type before nft_trans_set(trans) Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Doug Ledford, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leon Romanovsky <leonro@mellanox.com>

[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ]

Let's perform checks in-place instead of BUG_ONs.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/core/mad.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1557,7 +1557,8 @@ static int add_oui_reg_req(struct ib_mad
 			    mad_reg_req->oui, 3)) {
 			method = &(*vendor_table)->vendor_class[
 						vclass]->method_table[i];
-			BUG_ON(!*method);
+			if (!*method)
+				goto error3;
 			goto check_in_use;
 		}
 	}
@@ -1567,10 +1568,12 @@ static int add_oui_reg_req(struct ib_mad
 				vclass]->oui[i])) {
 			method = &(*vendor_table)->vendor_class[
 				vclass]->method_table[i];
-			BUG_ON(*method);
 			/* Allocate method table for this OUI */
-			if ((ret = allocate_method_table(method)))
-				goto error3;
+			if (!*method) {
+				ret = allocate_method_table(method);
+				if (ret)
+					goto error3;
+			}
 			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
 			       mad_reg_req->oui, 3);
 			goto check_in_use;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 064/336] netfilter: nf_tables: check msg_type before nft_trans_set(trans)
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 060/336] RDMA/mad: Convert BUG_ONs to error flows Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 065/336] pnfs: Dont release the sequence slot until weve processed layoutget on open Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kodanev, Florian Westphal,
	Pablo Neira Ayuso, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Kodanev <alexey.kodanev@oracle.com>

[ Upstream commit 9c7f96fd77b0dbe1fe7ed1f9c462c45dc48a1076 ]

The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before
using nft_trans_set(trans). Otherwise we can get out of bounds read.

For example, KASAN reported the one when running 0001_cache_handling_0 nft
test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE:

[75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356
...
[75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G  E   4.17.0-rc7.1.x86_64 #1
[75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2
[75517.618129] Call Trace:
[75517.648821]  dump_stack+0xd1/0x13b
[75517.691040]  ? show_regs_print_info+0x5/0x5
[75517.742519]  ? kmsg_dump_rewind_nolock+0xf5/0xf5
[75517.799300]  ? lock_acquire+0x143/0x310
[75517.846738]  print_address_description+0x85/0x3a0
[75517.904547]  kasan_report+0x18d/0x4b0
[75517.949892]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.019153]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.088420]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.157689]  nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.224869]  nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables]
[75518.291024]  ? nft_add_set_elem+0x2280/0x2280 [nf_tables]
[75518.357154]  ? nla_parse+0x1a5/0x300
[75518.401455]  ? kasan_kmalloc+0xa6/0xd0
[75518.447842]  nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
[75518.507743]  ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink]
[75518.569745]  ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink]
[75518.631711]  ? lock_acquire+0x143/0x310
[75518.679133]  ? netlink_deliver_tap+0x9b/0x1070
[75518.733840]  ? kasan_unpoison_shadow+0x31/0x40
[75518.788542]  netlink_unicast+0x45d/0x680
[75518.837111]  ? __isolate_free_page+0x890/0x890
[75518.891913]  ? netlink_attachskb+0x6b0/0x6b0
[75518.944542]  netlink_sendmsg+0x6fa/0xd30
[75518.993107]  ? netlink_unicast+0x680/0x680
[75519.043758]  ? netlink_unicast+0x680/0x680
[75519.094402]  sock_sendmsg+0xd9/0x160
[75519.138810]  ___sys_sendmsg+0x64d/0x980
[75519.186234]  ? copy_msghdr_from_user+0x350/0x350
[75519.243118]  ? lock_downgrade+0x650/0x650
[75519.292738]  ? do_raw_spin_unlock+0x5d/0x250
[75519.345456]  ? _raw_spin_unlock+0x24/0x30
[75519.395065]  ? __handle_mm_fault+0xbde/0x3410
[75519.448830]  ? sock_setsockopt+0x3d2/0x1940
[75519.500516]  ? __lock_acquire.isra.25+0xdc/0x19d0
[75519.558448]  ? lock_downgrade+0x650/0x650
[75519.608057]  ? __audit_syscall_entry+0x317/0x720
[75519.664960]  ? __fget_light+0x58/0x250
[75519.711325]  ? __sys_sendmsg+0xde/0x170
[75519.758850]  __sys_sendmsg+0xde/0x170
[75519.804193]  ? __ia32_sys_shutdown+0x90/0x90
[75519.856725]  ? syscall_trace_enter+0x897/0x10e0
[75519.912354]  ? trace_event_raw_event_sys_enter+0x920/0x920
[75519.979432]  ? __audit_syscall_entry+0x720/0x720
[75520.036118]  do_syscall_64+0xa3/0x3d0
[75520.081248]  ? prepare_exit_to_usermode+0x47/0x1d0
[75520.139904]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[75520.201680] RIP: 0033:0x7fc153320ba0
[75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0
[75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003
[75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090
[75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660
[75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001

[75520.790946] Allocated by task 7356:
[75520.833994]  kasan_kmalloc+0xa6/0xd0
[75520.878088]  __kmalloc+0x189/0x450
[75520.920107]  nft_trans_alloc_gfp+0x20/0x190 [nf_tables]
[75520.983961]  nf_tables_newtable+0xcd0/0x1bd0 [nf_tables]
[75521.048857]  nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
[75521.108655]  netlink_unicast+0x45d/0x680
[75521.157013]  netlink_sendmsg+0x6fa/0xd30
[75521.205271]  sock_sendmsg+0xd9/0x160
[75521.249365]  ___sys_sendmsg+0x64d/0x980
[75521.296686]  __sys_sendmsg+0xde/0x170
[75521.341822]  do_syscall_64+0xa3/0x3d0
[75521.386957]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[75521.467867] Freed by task 23454:
[75521.507804]  __kasan_slab_free+0x132/0x180
[75521.558137]  kfree+0x14d/0x4d0
[75521.596005]  free_rt_sched_group+0x153/0x280
[75521.648410]  sched_autogroup_create_attach+0x19a/0x520
[75521.711330]  ksys_setsid+0x2ba/0x400
[75521.755529]  __ia32_sys_setsid+0xa/0x10
[75521.802850]  do_syscall_64+0xa3/0x3d0
[75521.848090]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[75521.929000] The buggy address belongs to the object at ffff881bdb643f80
 which belongs to the cache kmalloc-96 of size 96
[75522.079797] The buggy address is located 72 bytes inside of
 96-byte region [ffff881bdb643f80, ffff881bdb643fe0)
[75522.221234] The buggy address belongs to the page:
[75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0
[75522.377443] flags: 0x2fffff80000100(slab)
[75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020
[75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000
[75522.615601] page dumped because: kasan: bad access detected

Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_tables_api.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2728,12 +2728,13 @@ static struct nft_set *nf_tables_set_loo
 	u32 id = ntohl(nla_get_be32(nla));
 
 	list_for_each_entry(trans, &net->nft.commit_list, list) {
-		struct nft_set *set = nft_trans_set(trans);
+		if (trans->msg_type == NFT_MSG_NEWSET) {
+			struct nft_set *set = nft_trans_set(trans);
 
-		if (trans->msg_type == NFT_MSG_NEWSET &&
-		    id == nft_trans_set_id(trans) &&
-		    nft_active_genmask(set, genmask))
-			return set;
+			if (id == nft_trans_set_id(trans) &&
+			    nft_active_genmask(set, genmask))
+				return set;
+		}
 	}
 	return ERR_PTR(-ENOENT);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 065/336] pnfs: Dont release the sequence slot until weve processed layoutget on open
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 064/336] netfilter: nf_tables: check msg_type before nft_trans_set(trans) Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 066/336] NFS: Fix up nfs_post_op_update_inode() to force ctime updates Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit ae55e59da0e401893b3c52b575fc18a00623d0a1 ]

If the server recalls the layout that was just handed out, we risk hitting
a race as described in RFC5661 Section 2.10.6.3 unless we ensure that we
release the sequence slot after processing the LAYOUTGET operation that
was sent as part of the OPEN compound.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2807,7 +2807,7 @@ static int _nfs4_open_and_get_state(stru
 	if (ret != 0)
 		goto out;
 
-	state = nfs4_opendata_to_nfs4_state(opendata);
+	state = _nfs4_opendata_to_nfs4_state(opendata);
 	ret = PTR_ERR(state);
 	if (IS_ERR(state))
 		goto out;
@@ -2843,6 +2843,7 @@ static int _nfs4_open_and_get_state(stru
 			nfs4_schedule_stateid_recovery(server, state);
 	}
 out:
+	nfs4_sequence_free_slot(&opendata->o_res.seq_res);
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 066/336] NFS: Fix up nfs_post_op_update_inode() to force ctime updates
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 065/336] pnfs: Dont release the sequence slot until weve processed layoutget on open Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 067/336] disable loading f2fs module on PAGE_SIZE > 4KB Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit d554168f87a55b35b7c59921a0dc45b6ba17d08d ]

We do not want to ignore ctime updates that originate from functions
such as link().

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/inode.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1629,7 +1629,8 @@ int nfs_post_op_update_inode(struct inod
 	nfs_fattr_set_barrier(fattr);
 	status = nfs_post_op_update_inode_locked(inode, fattr,
 			NFS_INO_INVALID_CHANGE
-			| NFS_INO_INVALID_CTIME);
+			| NFS_INO_INVALID_CTIME
+			| NFS_INO_REVAL_FORCED);
 	spin_unlock(&inode->i_lock);
 
 	return status;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 067/336] disable loading f2fs module on PAGE_SIZE > 4KB
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 066/336] NFS: Fix up nfs_post_op_update_inode() to force ctime updates Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 068/336] f2fs: fix error path of move_data_page Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Pugachev, Chao Yu,
	Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anatoly Pugachev <matorola@gmail.com>

[ Upstream commit 4071e67cffcc5c2a007116a02437471351f550eb ]

The following patch disables loading of f2fs module on architectures
which have PAGE_SIZE > 4096 , since it is impossible to mount f2fs on
such architectures , log messages are:

mount: /mnt: wrong fs type, bad option, bad superblock on
/dev/vdiskb1, missing codepage or helper program, or other error.
/dev/vdiskb1: F2FS filesystem,
UUID=1d8b9ca4-2389-4910-af3b-10998969f09c, volume name ""

May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
page_cache_size (8192), supports only 4KB
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
filesystem in 1th superblock
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
page_cache_size (8192), supports only 4KB
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
filesystem in 2th superblock
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
page_cache_size (8192), supports only 4KB

which was introduced by git commit 5c9b469295fb6b10d98923eab5e79c4edb80ed20

tested on git kernel 4.17.0-rc6-00309-gec30dcf7f425

with patch applied:

modprobe: ERROR: could not insert 'f2fs': Invalid argument
May 28 01:40:28 v215 kernel: F2FS not supported on PAGE_SIZE(8192) != 4096

Signed-off-by: Anatoly Pugachev <matorola@gmail.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/super.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3063,6 +3063,12 @@ static int __init init_f2fs_fs(void)
 {
 	int err;
 
+	if (PAGE_SIZE != F2FS_BLKSIZE) {
+		printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n",
+				PAGE_SIZE, F2FS_BLKSIZE);
+		return -EINVAL;
+	}
+
 	f2fs_build_trace_ios();
 
 	err = init_inodecache();



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 068/336] f2fs: fix error path of move_data_page
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 067/336] disable loading f2fs module on PAGE_SIZE > 4KB Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 069/336] f2fs: dont drop dentry pages after fs shutdown Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 14a28559f43ac7c0b98dd1b0e73ec9ec8ab4fc45 ]

This patch fixes error path of move_data_page:
- clear cold data flag if it fails to write page.
- redirty page for non-ENOMEM case.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/gc.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -778,9 +778,14 @@ retry:
 		set_cold_data(page);
 
 		err = do_write_data_page(&fio);
-		if (err == -ENOMEM && is_dirty) {
-			congestion_wait(BLK_RW_ASYNC, HZ/50);
-			goto retry;
+		if (err) {
+			clear_cold_data(page);
+			if (err == -ENOMEM) {
+				congestion_wait(BLK_RW_ASYNC, HZ/50);
+				goto retry;
+			}
+			if (is_dirty)
+				set_page_dirty(page);
 		}
 	}
 out:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 069/336] f2fs: dont drop dentry pages after fs shutdown
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 068/336] f2fs: fix error path of move_data_page Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 070/336] f2fs: fix to dont trigger writeback during recovery Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 1174abfd8309f4c47d454734233aa3b694560e10 ]

As description in commit "f2fs: don't drop any page on f2fs_cp_error()
case":

"We still provide readdir() after shtudown, so we should keep pages to
avoid additional IOs."

In order to provider lastest directory structure, let's keep dentry
pages in cache after fs shutdown.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/data.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1745,6 +1745,12 @@ static int __write_data_page(struct page
 	/* we should bypass data pages to proceed the kworkder jobs */
 	if (unlikely(f2fs_cp_error(sbi))) {
 		mapping_set_error(page->mapping, -EIO);
+		/*
+		 * don't drop any dirty dentry pages for keeping lastest
+		 * directory structure.
+		 */
+		if (S_ISDIR(inode->i_mode))
+			goto redirty_out;
 		goto out;
 	}
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 070/336] f2fs: fix to dont trigger writeback during recovery
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 069/336] f2fs: dont drop dentry pages after fs shutdown Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 071/336] f2fs: fix to wait page writeback during revoking atomic write Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Yunlei He, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 64c74a7ab505ea40d1b3e5d02735ecab08ae1b14 ]

- f2fs_fill_super
 - recover_fsync_data
  - recover_data
   - del_fsync_inode
    - iput
     - iput_final
      - write_inode_now
       - f2fs_write_inode
        - f2fs_balance_fs
         - f2fs_balance_fs_bg
          - sync_dirty_inodes

With data_flush mount option, during recovery, in order to avoid entering
above writeback flow, let's detect recovery status and do skip in
f2fs_balance_fs_bg.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/segment.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -478,6 +478,9 @@ void f2fs_balance_fs(struct f2fs_sb_info
 
 void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
 {
+	if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
+		return;
+
 	/* try to shrink extent cache when there is no enough memory */
 	if (!available_free_memory(sbi, EXTENT_CACHE))
 		f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 071/336] f2fs: fix to wait page writeback during revoking atomic write
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 070/336] f2fs: fix to dont trigger writeback during recovery Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 072/336] f2fs: Fix deadlock in shutdown ioctl Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit e5e5732d8120654159254c16834bc8663d8be124 ]

After revoking atomic write, related LBA can be reused by others, so we
need to wait page writeback before reusing the LBA, in order to avoid
interference between old atomic written in-flight IO and new IO.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/segment.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -230,6 +230,8 @@ static int __revoke_inmem_pages(struct i
 
 		lock_page(page);
 
+		f2fs_wait_on_page_writeback(page, DATA, true);
+
 		if (recover) {
 			struct dnode_of_data dn;
 			struct node_info ni;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 072/336] f2fs: Fix deadlock in shutdown ioctl
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 071/336] f2fs: fix to wait page writeback during revoking atomic write Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 073/336] f2fs: fix missing clear FI_NO_PREALLOC in some error case Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sahitya Tummala, Chao Yu,
	Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sahitya Tummala <stummala@codeaurora.org>

[ Upstream commit 60b2b4ee2bc01dd052f99fa9d65da2232102ef8e ]

f2fs_ioc_shutdown() ioctl gets stuck in the below path
when issued with F2FS_GOING_DOWN_FULLSYNC option.

__switch_to+0x90/0xc4
percpu_down_write+0x8c/0xc0
freeze_super+0xec/0x1e4
freeze_bdev+0xc4/0xcc
f2fs_ioctl+0xc0c/0x1ce0
f2fs_compat_ioctl+0x98/0x1f0

Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1851,9 +1851,11 @@ static int f2fs_ioc_shutdown(struct file
 	if (get_user(in, (__u32 __user *)arg))
 		return -EFAULT;
 
-	ret = mnt_want_write_file(filp);
-	if (ret)
-		return ret;
+	if (in != F2FS_GOING_DOWN_FULLSYNC) {
+		ret = mnt_want_write_file(filp);
+		if (ret)
+			return ret;
+	}
 
 	switch (in) {
 	case F2FS_GOING_DOWN_FULLSYNC:
@@ -1894,7 +1896,8 @@ static int f2fs_ioc_shutdown(struct file
 
 	f2fs_update_time(sbi, REQ_TIME);
 out:
-	mnt_drop_write_file(filp);
+	if (in != F2FS_GOING_DOWN_FULLSYNC)
+		mnt_drop_write_file(filp);
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 073/336] f2fs: fix missing clear FI_NO_PREALLOC in some error case
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 072/336] f2fs: Fix deadlock in shutdown ioctl Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 074/336] f2fs: fix to detect failure of dquot_initialize Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunlei He, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunlei He <heyunlei@huawei.com>

[ Upstream commit cba41be08cb182476fec4d318a8a8f2f8361a901 ]

This patch fix missing clear FI_NO_PREALLOC in some error case

Signed-off-by: Yunlei He <heyunlei@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2927,6 +2927,8 @@ static ssize_t f2fs_file_write_iter(stru
 						iov_iter_count(from)) ||
 					f2fs_has_inline_data(inode) ||
 					f2fs_force_buffered_io(inode, WRITE)) {
+						clear_inode_flag(inode,
+								FI_NO_PREALLOC);
 						inode_unlock(inode);
 						return -EAGAIN;
 				}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 074/336] f2fs: fix to detect failure of dquot_initialize
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 073/336] f2fs: fix missing clear FI_NO_PREALLOC in some error case Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 075/336] f2fs: fix race in between GC and atomic open Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit c22aecd75919511abea872b201751e0be1add898 ]

dquot_initialize() can fail due to any exception inside quota subsystem,
f2fs needs to be aware of it, and return correct return value to caller.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2571,7 +2571,9 @@ static int f2fs_ioc_setproject(struct fi
 	}
 	f2fs_put_page(ipage, 1);
 
-	dquot_initialize(inode);
+	err = dquot_initialize(inode);
+	if (err)
+		goto out_unlock;
 
 	transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
 	if (!IS_ERR(transfer_to[PRJQUOTA])) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 075/336] f2fs: fix race in between GC and atomic open
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 074/336] f2fs: fix to detect failure of dquot_initialize Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 076/336] block, bfq: remove wrong lock in bfq_requests_merged Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 27319ba4044c0c67d62ae39e53c0118c89f0a029 ]

Thread					GC thread
- f2fs_ioc_start_atomic_write
 - get_dirty_pages
 - filemap_write_and_wait_range
					- f2fs_gc
					 - do_garbage_collect
					  - gc_data_segment
					   - move_data_page
					    - f2fs_is_atomic_file
					    - set_page_dirty
 - set_inode_flag(, FI_ATOMIC_FILE)

Dirty data page can still be generated by GC in race condition as
above call stack.

This patch adds fi->dio_rwsem[WRITE] in f2fs_ioc_start_atomic_write
to avoid such race.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1670,6 +1670,8 @@ static int f2fs_ioc_start_atomic_write(s
 
 	inode_lock(inode);
 
+	down_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
+
 	if (f2fs_is_atomic_file(inode))
 		goto out;
 
@@ -1699,6 +1701,7 @@ inc_stat:
 	stat_inc_atomic_write(inode);
 	stat_update_max_atomic_write(inode);
 out:
+	up_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
 	inode_unlock(inode);
 	mnt_drop_write_file(filp);
 	return ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 076/336] block, bfq: remove wrong lock in bfq_requests_merged
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 075/336] f2fs: fix race in between GC and atomic open Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 077/336] usbip: usbip_detach: Fix memory, udev context and udev leak Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filippo Muzzini, Paolo Valente,
	Jens Axboe, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filippo Muzzini <filippo.muzzini@outlook.it>

[ Upstream commit a12bffebc0c9d6a5851f062aaea3aa7c4adc6042 ]

In bfq_requests_merged(), there is a deadlock because the lock on
bfqq->bfqd->lock is held by the calling function, but the code of
this function tries to grab the lock again.

This deadlock is currently hidden by another bug (fixed by next commit
for this source file), which causes the body of bfq_requests_merged()
to be never executed.

This commit removes the deadlock by removing the lock/unlock pair.

Signed-off-by: Filippo Muzzini <filippo.muzzini@outlook.it>
Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/bfq-iosched.c |    2 --
 1 file changed, 2 deletions(-)

--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -1898,7 +1898,6 @@ static void bfq_requests_merged(struct r
 
 	if (!RB_EMPTY_NODE(&rq->rb_node))
 		goto end;
-	spin_lock_irq(&bfqq->bfqd->lock);
 
 	/*
 	 * If next and rq belong to the same bfq_queue and next is older
@@ -1923,7 +1922,6 @@ static void bfq_requests_merged(struct r
 	bfq_remove_request(q, next);
 	bfqg_stats_update_io_remove(bfqq_group(bfqq), next->cmd_flags);
 
-	spin_unlock_irq(&bfqq->bfqd->lock);
 end:
 	bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 077/336] usbip: usbip_detach: Fix memory, udev context and udev leak
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 076/336] block, bfq: remove wrong lock in bfq_requests_merged Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 078/336] usbip: dynamically allocate idev by nports found in sysfs Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>

[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ]

detach_port() fails to call usbip_vhci_driver_close() from its error
path after usbip_vhci_detach_device() returns failure, leaking memory
allocated in usbip_vhci_driver_open() and holding udev_context and udev
references. Fix it to call usbip_vhci_driver_close().

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/usb/usbip/src/usbip_detach.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/tools/usb/usbip/src/usbip_detach.c
+++ b/tools/usb/usbip/src/usbip_detach.c
@@ -43,7 +43,7 @@ void usbip_detach_usage(void)
 
 static int detach_port(char *port)
 {
-	int ret;
+	int ret = 0;
 	uint8_t portnum;
 	char path[PATH_MAX+1];
 
@@ -73,9 +73,12 @@ static int detach_port(char *port)
 	}
 
 	ret = usbip_vhci_detach_device(portnum);
-	if (ret < 0)
-		return -1;
+	if (ret < 0) {
+		ret = -1;
+		goto call_driver_close;
+	}
 
+call_driver_close:
 	usbip_vhci_driver_close();
 
 	return ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 078/336] usbip: dynamically allocate idev by nports found in sysfs
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 077/336] usbip: usbip_detach: Fix memory, udev context and udev leak Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 079/336] perf/x86/intel/uncore: Correct fixed counter index check in generic code Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Grzeschik,
	Shuah Khan (Samsung OSG),
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Grzeschik <m.grzeschik@pengutronix.de>

[ Upstream commit de19ca6fd72c7dd45ad82403e7b3fe9c74ef6767 ]

As the amount of available ports varies by the kernels build
configuration. To remove the limitation of the fixed 128 ports
we allocate the amount of idevs by using the number we get
from the kernel.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/usb/usbip/libsrc/vhci_driver.c |   32 +++++++++++++++++++-------------
 tools/usb/usbip/libsrc/vhci_driver.h |    3 +--
 2 files changed, 20 insertions(+), 15 deletions(-)

--- a/tools/usb/usbip/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
@@ -135,11 +135,11 @@ static int refresh_imported_device_list(
 	return 0;
 }
 
-static int get_nports(void)
+static int get_nports(struct udev_device *hc_device)
 {
 	const char *attr_nports;
 
-	attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports");
+	attr_nports = udev_device_get_sysattr_value(hc_device, "nports");
 	if (!attr_nports) {
 		err("udev_device_get_sysattr_value nports failed");
 		return -1;
@@ -242,35 +242,41 @@ static int read_record(int rhport, char
 
 int usbip_vhci_driver_open(void)
 {
+	int nports;
+	struct udev_device *hc_device;
+
 	udev_context = udev_new();
 	if (!udev_context) {
 		err("udev_new failed");
 		return -1;
 	}
 
-	vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver));
-
 	/* will be freed in usbip_driver_close() */
-	vhci_driver->hc_device =
+	hc_device =
 		udev_device_new_from_subsystem_sysname(udev_context,
 						       USBIP_VHCI_BUS_TYPE,
 						       USBIP_VHCI_DEVICE_NAME);
-	if (!vhci_driver->hc_device) {
+	if (!hc_device) {
 		err("udev_device_new_from_subsystem_sysname failed");
 		goto err;
 	}
 
-	vhci_driver->nports = get_nports();
-	dbg("available ports: %d", vhci_driver->nports);
-
-	if (vhci_driver->nports <= 0) {
+	nports = get_nports(hc_device);
+	if (nports <= 0) {
 		err("no available ports");
 		goto err;
-	} else if (vhci_driver->nports > MAXNPORT) {
-		err("port number exceeds %d", MAXNPORT);
+	}
+	dbg("available ports: %d", nports);
+
+	vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) +
+			nports * sizeof(struct usbip_imported_device));
+	if (!vhci_driver) {
+		err("vhci_driver allocation failed");
 		goto err;
 	}
 
+	vhci_driver->nports = nports;
+	vhci_driver->hc_device = hc_device;
 	vhci_driver->ncontrollers = get_ncontrollers();
 	dbg("available controllers: %d", vhci_driver->ncontrollers);
 
@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void)
 	return 0;
 
 err:
-	udev_device_unref(vhci_driver->hc_device);
+	udev_device_unref(hc_device);
 
 	if (vhci_driver)
 		free(vhci_driver);
--- a/tools/usb/usbip/libsrc/vhci_driver.h
+++ b/tools/usb/usbip/libsrc/vhci_driver.h
@@ -13,7 +13,6 @@
 
 #define USBIP_VHCI_BUS_TYPE "platform"
 #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0"
-#define MAXNPORT 128
 
 enum hub_speed {
 	HUB_SPEED_HIGH = 0,
@@ -41,7 +40,7 @@ struct usbip_vhci_driver {
 
 	int ncontrollers;
 	int nports;
-	struct usbip_imported_device idev[MAXNPORT];
+	struct usbip_imported_device idev[];
 };
 
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 079/336] perf/x86/intel/uncore: Correct fixed counter index check in generic code
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 078/336] usbip: dynamically allocate idev by nports found in sysfs Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 080/336] perf/x86/intel/uncore: Correct fixed counter index check for NHM Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Thomas Gleixner, Linus Torvalds, acme, eranian, Ingo Molnar,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kan Liang <kan.liang@intel.com>

[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ]

There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only
exception is client IMC uncore, which has been specially handled.
For generic code, it is not correct to use >= to check fixed counter.
The code quality issue will bring problem when a new counter index is
introduced.

Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: acme@kernel.org
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1525371913-10597-3-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/uncore.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct int
 	u64 prev_count, new_count, delta;
 	int shift;
 
-	if (event->hw.idx >= UNCORE_PMC_IDX_FIXED)
+	if (event->hw.idx == UNCORE_PMC_IDX_FIXED)
 		shift = 64 - uncore_fixed_ctr_bits(box);
 	else
 		shift = 64 - uncore_perf_ctr_bits(box);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 080/336] perf/x86/intel/uncore: Correct fixed counter index check for NHM
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 079/336] perf/x86/intel/uncore: Correct fixed counter index check in generic code Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 082/336] selftests: memfd: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Thomas Gleixner, Linus Torvalds, acme, eranian, Ingo Molnar,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kan Liang <kan.liang@intel.com>

[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ]

For Nehalem and Westmere, there is only one fixed counter for W-Box.
There is no index which is bigger than UNCORE_PMC_IDX_FIXED.
It is not correct to use >= to check fixed counter.
The code quality issue will bring problem when new counter index is
introduced.

Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: acme@kernel.org
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1525371913-10597-2-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/uncore_nhmex.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/uncore_nhmex.c
+++ b/arch/x86/events/intel/uncore_nhmex.c
@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_even
 {
 	struct hw_perf_event *hwc = &event->hw;
 
-	if (hwc->idx >= UNCORE_PMC_IDX_FIXED)
+	if (hwc->idx == UNCORE_PMC_IDX_FIXED)
 		wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0);
 	else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0)
 		wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 082/336] selftests: memfd: return Kselftest Skip code for skipped tests
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 080/336] perf/x86/intel/uncore: Correct fixed counter index check for NHM Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 083/336] selftests: kvm: " Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
	Mike Kravetz, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>

[ Upstream commit b27f0259e8cea74c627327c063742a83613dd460 ]

When memfd test is skipped because of unmet dependencies and/or unsupported
configuration, it returns non-zero value which is treated as a fail by the
Kselftest framework. This leads to false negative result even when the test
could not be run.

Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.

Added an explicit check for root user at the start of memfd hugetlbfs test
and return skip code if a non-root user attempts to run it.

In addition, return skip code when not enough huge pages are available to
run the test.

Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/memfd/run_tests.sh |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/tools/testing/selftests/memfd/run_tests.sh
+++ b/tools/testing/selftests/memfd/run_tests.sh
@@ -1,6 +1,9 @@
 #!/bin/bash
 # please run as root
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 #
 # Normal tests requiring no special resources
 #
@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $
 	nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
 	hpages_needed=`expr $hpages_test - $freepgs`
 
+	if [ $UID != 0 ]; then
+		echo "Please run memfd with hugetlbfs test as root"
+		exit $ksft_skip
+	fi
+
 	echo 3 > /proc/sys/vm/drop_caches
 	echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
-	if [ $? -ne 0 ]; then
-		echo "Please run this test as root"
-		exit 1
-	fi
 	while read name size unit; do
 		if [ "$name" = "HugePages_Free:" ]; then
 			freepgs=$size
@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then
 	fi
 	printf "Not enough huge pages available (%d < %d)\n" \
 		$freepgs $needpgs
-	exit 1
+	exit $ksft_skip
 fi
 
 #



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 083/336] selftests: kvm: return Kselftest Skip code for skipped tests
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 082/336] selftests: memfd: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:46 ` [PATCH 4.17 084/336] selftests: intel_pstate: " Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
	Paolo Bonzini, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>

[ Upstream commit ab0e9c4b91ca902b1cae593b3dec9c4c7a724f9f ]

When kvm test is skipped because of unmet dependencies and/or unsupported
configuration, it exits with error which is treated as a fail by the
Kselftest framework. This leads to false negative result even when the test
could not be run.

Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.

Change it to use ksft_exit_skip() when the test is skipped. In addition,
refine test_assert() message to include strerror() string and add explicit
check for EACCES to cleary identify when test doesn't run when access is
denied to resources required e.g: open /dev/kvm failed, rc: -1 errno: 13

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/kvm/lib/assert.c          |    9 +++++++--
 tools/testing/selftests/kvm/vmx_tsc_adjust_test.c |    2 ++
 2 files changed, 9 insertions(+), 2 deletions(-)

--- a/tools/testing/selftests/kvm/lib/assert.c
+++ b/tools/testing/selftests/kvm/lib/assert.c
@@ -13,6 +13,8 @@
 #include <execinfo.h>
 #include <sys/syscall.h>
 
+#include "../../kselftest.h"
+
 /* Dumps the current stack trace to stderr. */
 static void __attribute__((noinline)) test_dump_stack(void);
 static void test_dump_stack(void)
@@ -70,8 +72,9 @@ test_assert(bool exp, const char *exp_st
 
 		fprintf(stderr, "==== Test Assertion Failure ====\n"
 			"  %s:%u: %s\n"
-			"  pid=%d tid=%d\n",
-			file, line, exp_str, getpid(), gettid());
+			"  pid=%d tid=%d - %s\n",
+			file, line, exp_str, getpid(), gettid(),
+			strerror(errno));
 		test_dump_stack();
 		if (fmt) {
 			fputs("  ", stderr);
@@ -80,6 +83,8 @@ test_assert(bool exp, const char *exp_st
 		}
 		va_end(ap);
 
+		if (errno == EACCES)
+			ksft_exit_skip("Access denied - Exiting.\n");
 		exit(254);
 	}
 
--- a/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
+++ b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
@@ -28,6 +28,8 @@
 #include <string.h>
 #include <sys/ioctl.h>
 
+#include "../kselftest.h"
+
 #ifndef MSR_IA32_TSC_ADJUST
 #define MSR_IA32_TSC_ADJUST 0x3b
 #endif



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 084/336] selftests: intel_pstate: return Kselftest Skip code for skipped tests
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 083/336] selftests: kvm: " Greg Kroah-Hartman
@ 2018-08-01 16:46 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 085/336] selftests: filesystems: " Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>

[ Upstream commit 5c30a038fb8ec8cdff011e6b5d5d51eb415381d4 ]

When intel_pstate test is skipped because of unmet dependencies and/or
unsupported configuration, it returns 0 which is treated as a pass
by the Kselftest framework. This leads to false positive result even
when the test could not be run.

Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.

Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/intel_pstate/run.sh |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/tools/testing/selftests/intel_pstate/run.sh
+++ b/tools/testing/selftests/intel_pstate/run.sh
@@ -30,9 +30,12 @@
 
 EVALUATE_ONLY=0
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then
 	echo "$0 # Skipped: Test can only run on x86 architectures."
-	exit 0
+	exit $ksft_skip
 fi
 
 max_cpus=$(($(nproc)-1))



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 085/336] selftests: filesystems: return Kselftest Skip code for skipped tests
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2018-08-01 16:46 ` [PATCH 4.17 084/336] selftests: intel_pstate: " Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 086/336] selftests/filesystems: devpts_pts included wrong header Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
	Christian Brauner, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>

[ Upstream commit 7357dcf2ef2811156fdf223a9a27f73528934e1f ]

When devpts_pts test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative
result even when the test could not be run.

In another case, it returns pass for a skipped test reporting a false
postive.

Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.

Change it to use ksft_exit_skip() when test is skipped.

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/filesystems/devpts_pts.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/tools/testing/selftests/filesystems/devpts_pts.c
+++ b/tools/testing/selftests/filesystems/devpts_pts.c
@@ -11,6 +11,7 @@
 #include <sys/ioctl.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
+#include "../kselftest.h"
 
 static bool terminal_dup2(int duplicate, int original)
 {
@@ -125,10 +126,12 @@ static int do_tiocgptpeer(char *ptmx, ch
 		if (errno == EINVAL) {
 			fprintf(stderr, "TIOCGPTPEER is not supported. "
 					"Skipping test.\n");
-			fret = EXIT_SUCCESS;
+			fret = KSFT_SKIP;
+		} else {
+			fprintf(stderr,
+				"Failed to perform TIOCGPTPEER ioctl\n");
+			fret = EXIT_FAILURE;
 		}
-
-		fprintf(stderr, "Failed to perform TIOCGPTPEER ioctl\n");
 		goto do_cleanup;
 	}
 
@@ -281,7 +284,7 @@ int main(int argc, char *argv[])
 	if (!isatty(STDIN_FILENO)) {
 		fprintf(stderr, "Standard input file desciptor is not attached "
 				"to a terminal. Skipping test\n");
-		exit(EXIT_FAILURE);
+		exit(KSFT_SKIP);
 	}
 
 	ret = unshare(CLONE_NEWNS);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 086/336] selftests/filesystems: devpts_pts included wrong header
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 085/336] selftests: filesystems: " Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 087/336] qtnfmac: fix invalid STA state on EAPOL failure Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anders Roxell, Christian Brauner,
	Shuah Khan (Samsung OSG),
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anders Roxell <anders.roxell@linaro.org>

[ Upstream commit dd4b16b4f9b1b7d9f4a185cb8222e42f3a5daf00 ]

We were picking up the wrong header should use asm/ioctls.h form the kernel
and not the header from the system (sys/ioctl.h). In the current code we
added the correct include and we added the kernel headers path to the CFLAGS.

Fixes: ce290a19609d ("selftests: add devpts selftests")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/filesystems/Makefile     |    1 +
 tools/testing/selftests/filesystems/devpts_pts.c |    2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

--- a/tools/testing/selftests/filesystems/Makefile
+++ b/tools/testing/selftests/filesystems/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 
+CFLAGS += -I../../../../usr/include/
 TEST_GEN_PROGS := devpts_pts
 TEST_GEN_PROGS_EXTENDED := dnotify_test
 
--- a/tools/testing/selftests/filesystems/devpts_pts.c
+++ b/tools/testing/selftests/filesystems/devpts_pts.c
@@ -8,7 +8,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-#include <sys/ioctl.h>
+#include <asm/ioctls.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
 #include "../kselftest.h"



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 087/336] qtnfmac: fix invalid STA state on EAPOL failure
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 086/336] selftests/filesystems: devpts_pts included wrong header Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 088/336] PCI: Fix devm_pci_alloc_host_bridge() memory leak Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Matyukevich, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>

[ Upstream commit 480daa9cb62c14bbd1b87a01cd9bc10cc56dbf32 ]

Driver switches vif sta_state into QTNF_STA_CONNECTING when cfg80211
core initiates connect procedure. Further this state is changed either
to QTNF_STA_CONNECTED or to QTNF_STA_DISCONNECTED by BSS_JOIN and
BSS_LEAVE events from firmware. However it is possible that no such
events will be sent by firmware, e.g. if EAPOL timed out.

In this case vif sta_mode will remain in QTNF_STA_CONNECTING state and
all subsequent connection attempts will fail with -EBUSY error code.
Fix this by perfroming STA state transition from QTNF_STA_CONNECTING
to QTNF_STA_DISCONNECTED in cfg80211 disconnect callback.
No need to rely upon firmware events in this case.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/quantenna/qtnfmac/cfg80211.c |   21 ++++++++++++++-------
 drivers/net/wireless/quantenna/qtnfmac/event.c    |    8 +++-----
 2 files changed, 17 insertions(+), 12 deletions(-)

--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -651,28 +651,35 @@ qtnf_disconnect(struct wiphy *wiphy, str
 {
 	struct qtnf_wmac *mac = wiphy_priv(wiphy);
 	struct qtnf_vif *vif;
-	int ret;
+	int ret = 0;
 
 	vif = qtnf_mac_get_base_vif(mac);
 	if (!vif) {
 		pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-		return -EFAULT;
+		ret = -EFAULT;
+		goto out;
 	}
 
-	if (vif->wdev.iftype != NL80211_IFTYPE_STATION)
-		return -EOPNOTSUPP;
+	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
 
 	if (vif->sta_state == QTNF_STA_DISCONNECTED)
-		return 0;
+		goto out;
 
 	ret = qtnf_cmd_send_disconnect(vif, reason_code);
 	if (ret) {
 		pr_err("VIF%u.%u: failed to disconnect\n", mac->macid,
 		       vif->vifid);
-		return ret;
+		goto out;
 	}
 
-	return 0;
+out:
+	if (vif->sta_state == QTNF_STA_CONNECTING)
+		vif->sta_state = QTNF_STA_DISCONNECTED;
+
+	return ret;
 }
 
 static int
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -198,11 +198,9 @@ qtnf_event_handle_bss_leave(struct qtnf_
 		return -EPROTO;
 	}
 
-	if (vif->sta_state != QTNF_STA_CONNECTED) {
-		pr_err("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
-		       vif->mac->macid, vif->vifid);
-		return -EPROTO;
-	}
+	if (vif->sta_state != QTNF_STA_CONNECTED)
+		pr_warn("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
+			vif->mac->macid, vif->vifid);
 
 	pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 088/336] PCI: Fix devm_pci_alloc_host_bridge() memory leak
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 087/336] qtnfmac: fix invalid STA state on EAPOL failure Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 089/336] btrfs: balance dirty metadata pages in btrfs_finish_ordered_io Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Kiszka, Bjorn Helgaas, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kiszka <jan.kiszka@siemens.com>

[ Upstream commit 3bbce531788719749520f28052cabdef16af6b16 ]

Fix a memory leak by freeing the PCI resource list in
devm_pci_release_host_bridge_dev().

Fixes: 5c3f18cce083 ("PCI: Add devm_pci_alloc_host_bridge() interface")
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/probe.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -526,12 +526,14 @@ static void devm_pci_release_host_bridge
 
 	if (bridge->release_fn)
 		bridge->release_fn(bridge);
+
+	pci_free_resource_list(&bridge->windows);
 }
 
 static void pci_release_host_bridge_dev(struct device *dev)
 {
 	devm_pci_release_host_bridge_dev(dev);
-	pci_free_host_bridge(to_pci_host_bridge(dev));
+	kfree(to_pci_host_bridge(dev));
 }
 
 struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 089/336] btrfs: balance dirty metadata pages in btrfs_finish_ordered_io
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 088/336] PCI: Fix devm_pci_alloc_host_bridge() memory leak Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 090/336] iwlwifi: pcie: fix race in Rx buffer allocator Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ethan Lien, David Sterba, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ethan Lien <ethanlien@synology.com>

[ Upstream commit e73e81b6d0114d4a303205a952ab2e87c44bd279 ]

[Problem description and how we fix it]
We should balance dirty metadata pages at the end of
btrfs_finish_ordered_io, since a small, unmergeable random write can
potentially produce dirty metadata which is multiple times larger than
the data itself. For example, a small, unmergeable 4KiB write may
produce:

    16KiB dirty leaf (and possibly 16KiB dirty node) in subvolume tree
    16KiB dirty leaf (and possibly 16KiB dirty node) in checksum tree
    16KiB dirty leaf (and possibly 16KiB dirty node) in extent tree

Although we do call balance dirty pages in write side, but in the
buffered write path, most metadata are dirtied only after we reach the
dirty background limit (which by far only counts dirty data pages) and
wakeup the flusher thread. If there are many small, unmergeable random
writes spread in a large btree, we'll find a burst of dirty pages
exceeds the dirty_bytes limit after we wakeup the flusher thread - which
is not what we expect. In our machine, it caused out-of-memory problem
since a page cannot be dropped if it is marked dirty.

Someone may worry about we may sleep in btrfs_btree_balance_dirty_nodelay,
but since we do btrfs_finish_ordered_io in a separate worker, it will not
stop the flusher consuming dirty pages. Also, we use different worker for
metadata writeback endio, sleep in btrfs_finish_ordered_io help us throttle
the size of dirty metadata pages.

[Reproduce steps]
To reproduce the problem, we need to do 4KiB write randomly spread in a
large btree. In our 2GiB RAM machine:

1) Create 4 subvolumes.
2) Run fio on each subvolume:

   [global]
   direct=0
   rw=randwrite
   ioengine=libaio
   bs=4k
   iodepth=16
   numjobs=1
   group_reporting
   size=128G
   runtime=1800
   norandommap
   time_based
   randrepeat=0

3) Take snapshot on each subvolume and repeat fio on existing files.
4) Repeat step (3) until we get large btrees.
   In our case, by observing btrfs_root_item->bytes_used, we have 2GiB of
   metadata in each subvolume tree and 12GiB of metadata in extent tree.
5) Stop all fio, take snapshot again, and wait until all delayed work is
   completed.
6) Start all fio. Few seconds later we hit OOM when the flusher starts
   to work.

It can be reproduced even when using nocow write.

Signed-off-by: Ethan Lien <ethanlien@synology.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add comment ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3160,6 +3160,9 @@ out:
 	/* once for the tree */
 	btrfs_put_ordered_extent(ordered_extent);
 
+	/* Try to release some metadata so we don't get an OOM but don't wait */
+	btrfs_btree_balance_dirty_nodelay(fs_info);
+
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 090/336] iwlwifi: pcie: fix race in Rx buffer allocator
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 089/336] btrfs: balance dirty metadata pages in btrfs_finish_ordered_io Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 091/336] iwlwifi: mvm: open BA session only when sta is authorized Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shaul Triebitz, Luca Coelho, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shaul Triebitz <shaul.triebitz@intel.com>

[ Upstream commit 0f22e40053bd5378ad1e3250e65c574fd61c0cd6 ]

Make sure the rx_allocator worker is canceled before running the
rx_init routine.  rx_init frees and re-allocates all rxb's pages.  The
rx_allocator worker also allocates pages for the used rxb's.  Running
rx_init and rx_allocator simultaniously causes a kernel panic.  Fix
that by canceling the work in rx_init.

Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_
 	}
 	def_rxq = trans_pcie->rxq;
 
+	cancel_work_sync(&rba->rx_alloc);
+
 	spin_lock(&rba->lock);
 	atomic_set(&rba->req_pending, 0);
 	atomic_set(&rba->req_ready, 0);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 091/336] iwlwifi: mvm: open BA session only when sta is authorized
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 090/336] iwlwifi: pcie: fix race in Rx buffer allocator Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 092/336] Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gregory Greenman, Luca Coelho, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gregory Greenman <gregory.greenman@intel.com>

[ Upstream commit d94c5a820d107fdde711ec72c16848876027713d ]

Currently, a BA session is opened when the tx traffic exceeds
10 frames per second. As a result of inter-op problems with some
APs, add a condition to open BA session only when station is
already authorized.

Fixes: 482e48440a0e ("iwlwifi: mvm: change open and close criteria of a BA session")
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |    8 +---
 drivers/net/wireless/intel/iwlwifi/mvm/rs.c       |   38 +++++++++++-----------
 drivers/net/wireless/intel/iwlwifi/mvm/rs.h       |    7 +---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c      |    2 -
 drivers/net/wireless/intel/iwlwifi/mvm/sta.h      |   10 ++---
 5 files changed, 29 insertions(+), 36 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2652,7 +2652,7 @@ static int iwl_mvm_mac_sta_state(struct
 
 	mutex_lock(&mvm->mutex);
 	/* track whether or not the station is associated */
-	mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC;
+	mvm_sta->sta_state = new_state;
 
 	if (old_state == IEEE80211_STA_NOTEXIST &&
 	    new_state == IEEE80211_STA_NONE) {
@@ -2704,8 +2704,7 @@ static int iwl_mvm_mac_sta_state(struct
 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
 		}
 
-		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
-				     true);
+		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
 		ret = iwl_mvm_update_sta(mvm, vif, sta);
 	} else if (old_state == IEEE80211_STA_ASSOC &&
 		   new_state == IEEE80211_STA_AUTHORIZED) {
@@ -2721,8 +2720,7 @@ static int iwl_mvm_mac_sta_state(struct
 		/* enable beacon filtering */
 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
 
-		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
-				     false);
+		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
 
 		ret = 0;
 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -3,6 +3,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -13,10 +14,6 @@
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
  * The full GNU General Public License is included in this distribution in the
  * file called LICENSE.
  *
@@ -651,9 +648,10 @@ static void rs_tl_turn_on_agg(struct iwl
 	}
 
 	tid_data = &mvmsta->tid_data[tid];
-	if ((tid_data->state == IWL_AGG_OFF) &&
+	if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED &&
+	    tid_data->state == IWL_AGG_OFF &&
 	    (lq_sta->tx_agg_tid_en & BIT(tid)) &&
-	    (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
+	    tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD) {
 		IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
 		if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
 			tid_data->state = IWL_AGG_QUEUED;
@@ -1257,7 +1255,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm
 		       (unsigned long)(lq_sta->last_tx +
 				       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
 		IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
-		iwl_mvm_rs_rate_init(mvm, sta, info->band, false);
+		iwl_mvm_rs_rate_init(mvm, sta, info->band);
 		return;
 	}
 	lq_sta->last_tx = jiffies;
@@ -2684,9 +2682,9 @@ static void rs_get_initial_rate(struct i
 				struct ieee80211_sta *sta,
 				struct iwl_lq_sta *lq_sta,
 				enum nl80211_band band,
-				struct rs_rate *rate,
-				bool init)
+				struct rs_rate *rate)
 {
+	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	int i, nentries;
 	unsigned long active_rate;
 	s8 best_rssi = S8_MIN;
@@ -2748,7 +2746,8 @@ static void rs_get_initial_rate(struct i
 		 * bandwidth rate, and after authorization, when the phy context
 		 * is already up-to-date, re-init rs with the correct bw.
 		 */
-		u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
+		u32 bw = mvmsta->sta_state < IEEE80211_STA_AUTHORIZED ?
+				RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
 
 		switch (bw) {
 		case RATE_MCS_CHAN_WIDTH_40:
@@ -2833,9 +2832,9 @@ void rs_update_last_rssi(struct iwl_mvm
 static void rs_initialize_lq(struct iwl_mvm *mvm,
 			     struct ieee80211_sta *sta,
 			     struct iwl_lq_sta *lq_sta,
-			     enum nl80211_band band,
-			     bool init)
+			     enum nl80211_band band)
 {
+	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	struct iwl_scale_tbl_info *tbl;
 	struct rs_rate *rate;
 	u8 active_tbl = 0;
@@ -2851,7 +2850,7 @@ static void rs_initialize_lq(struct iwl_
 	tbl = &(lq_sta->lq_info[active_tbl]);
 	rate = &tbl->rate;
 
-	rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
+	rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
 	rs_init_optimal_rate(mvm, sta, lq_sta);
 
 	WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B,
@@ -2864,7 +2863,8 @@ static void rs_initialize_lq(struct iwl_
 	rs_set_expected_tpt_table(lq_sta, tbl);
 	rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
 	/* TODO restore station should remember the lq cmd */
-	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);
+	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq,
+			    mvmsta->sta_state < IEEE80211_STA_AUTHORIZED);
 }
 
 static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
@@ -3117,7 +3117,7 @@ void iwl_mvm_update_frame_stats(struct i
  * Called after adding a new station to initialize rate scaling
  */
 static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			     enum nl80211_band band, bool init)
+			     enum nl80211_band band)
 {
 	int i, j;
 	struct ieee80211_hw *hw = mvm->hw;
@@ -3196,7 +3196,7 @@ static void rs_drv_rate_init(struct iwl_
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 	iwl_mvm_reset_frame_stats(mvm);
 #endif
-	rs_initialize_lq(mvm, sta, lq_sta, band, init);
+	rs_initialize_lq(mvm, sta, lq_sta, band);
 }
 
 static void rs_drv_rate_update(void *mvm_r,
@@ -3216,7 +3216,7 @@ static void rs_drv_rate_update(void *mvm
 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
 		ieee80211_stop_tx_ba_session(sta, tid);
 
-	iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
+	iwl_mvm_rs_rate_init(mvm, sta, sband->band);
 }
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -4062,12 +4062,12 @@ static const struct rate_control_ops rs_
 };
 
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			  enum nl80211_band band, bool init)
+			  enum nl80211_band band)
 {
 	if (iwl_mvm_has_tlc_offload(mvm))
 		rs_fw_rate_init(mvm, sta, band);
 	else
-		rs_drv_rate_init(mvm, sta, band, init);
+		rs_drv_rate_init(mvm, sta, band);
 }
 
 int iwl_mvm_rate_control_register(void)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -3,6 +3,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -13,10 +14,6 @@
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
  * The full GNU General Public License is included in this distribution in the
  * file called LICENSE.
  *
@@ -410,7 +407,7 @@ struct iwl_lq_sta {
 
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			  enum nl80211_band band, bool init);
+			  enum nl80211_band band);
 
 /* Notify RS about Tx status */
 void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -214,7 +214,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mv
 		cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT);
 	add_sta_cmd.station_flags |=
 		cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT);
-	if (mvm_sta->associated)
+	if (mvm_sta->sta_state >= IEEE80211_STA_ASSOC)
 		add_sta_cmd.assoc_id = cpu_to_le16(sta->aid);
 
 	if (sta->wme) {
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -18,11 +19,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
  * The full GNU General Public License is included in this distribution
  * in the file called COPYING.
  *
@@ -35,6 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -376,6 +373,7 @@ struct iwl_mvm_rxq_dup_data {
  *	tid.
  * @max_agg_bufsize: the maximal size of the AGG buffer for this station
  * @sta_type: station type
+ * @sta_state: station state according to enum %ieee80211_sta_state
  * @bt_reduced_txpower: is reduced tx power enabled for this station
  * @next_status_eosp: the next reclaimed packet is a PS-Poll response and
  *	we need to signal the EOSP
@@ -414,6 +412,7 @@ struct iwl_mvm_sta {
 	u16 tid_disable_agg;
 	u8 max_agg_bufsize;
 	enum iwl_sta_type sta_type;
+	enum ieee80211_sta_state sta_state;
 	bool bt_reduced_txpower;
 	bool next_status_eosp;
 	spinlock_t lock;
@@ -438,7 +437,6 @@ struct iwl_mvm_sta {
 	bool disable_tx;
 	bool tlc_amsdu;
 	bool sleeping;
-	bool associated;
 	u8 agg_tids;
 	u8 sleep_tx_count;
 	u8 avg_energy;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 092/336] Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 091/336] iwlwifi: mvm: open BA session only when sta is authorized Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 093/336] drm/amd/display: Do not program interrupt status on disabled crtc Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thierry Escande, Marcel Holtmann,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thierry Escande <thierry.escande@linaro.org>

[ Upstream commit 9960521c44a5d828f29636ceac0600603ecbddbf ]

This patch fixes the following warning during boot:

 do not call blocking ops when !TASK_RUNNING; state=1 set at
 [<(ptrval)>] qca_setup+0x194/0x750 [hci_uart]
 WARNING: CPU: 2 PID: 1878 at kernel/sched/core.c:6135
 __might_sleep+0x7c/0x88

In qca_set_baudrate(), the current task state is set to
TASK_UNINTERRUPTIBLE before going to sleep for 300ms. It was then
restored to TASK_INTERRUPTIBLE. This patch sets the current task state
back to TASK_RUNNING instead.

Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/hci_qca.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -880,7 +880,7 @@ static int qca_set_baudrate(struct hci_d
 	 */
 	set_current_state(TASK_UNINTERRUPTIBLE);
 	schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS));
-	set_current_state(TASK_INTERRUPTIBLE);
+	set_current_state(TASK_RUNNING);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 093/336] drm/amd/display: Do not program interrupt status on disabled crtc
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 092/336] Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 094/336] drivers/bus: arm-cci: fix build warnings Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mikita Lipski, Harry Wentland,
	Alex Deucher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikita Lipski <mikita.lipski@amd.com>

[ Upstream commit 4ea7fc09539bd2399c1fa7acea14529406120d9e ]

Prevent interrupt programming of a crtc on which the stream is disabled and
it doesn't have an OTG to reference.

Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
@@ -555,6 +555,9 @@ static inline int dm_irq_state(struct am
 		return 0;
 	}
 
+	if (acrtc->otg_inst == -1)
+		return 0;
+
 	irq_source = dal_irq_type + acrtc->otg_inst;
 
 	st = (state == AMDGPU_IRQ_STATE_ENABLE);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 094/336] drivers/bus: arm-cci: fix build warnings
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 093/336] drm/amd/display: Do not program interrupt status on disabled crtc Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 095/336] Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Arnd Bergmann,
	Will Deacon, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 984e9cf1b9eaab08e4f1f082ce49ed2670e99d90 ]

When the arm-cci driver is enabled, but both CONFIG_ARM_CCI5xx_PMU and
CONFIG_ARM_CCI400_PMU are not, we get a warning about how parts of
the driver are never used:

drivers/perf/arm-cci.c:1454:29: error: 'cci_pmu_models' defined but not used [-Werror=unused-variable]
drivers/perf/arm-cci.c:693:16: error: 'cci_pmu_event_show' defined but not used [-Werror=unused-function]
drivers/perf/arm-cci.c:685:16: error: 'cci_pmu_format_show' defined but not used [-Werror=unused-function]

Marking all three functions as __maybe_unused avoids the warnings in
randconfig builds. I'm doing this lacking any ideas for a better fix.

Fixes: 3de6be7a3dd8 ("drivers/bus: Split Arm CCI driver")
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/perf/arm-cci.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/perf/arm-cci.c
+++ b/drivers/perf/arm-cci.c
@@ -120,9 +120,9 @@ enum cci_models {
 
 static void pmu_write_counters(struct cci_pmu *cci_pmu,
 				 unsigned long *mask);
-static ssize_t cci_pmu_format_show(struct device *dev,
+static ssize_t __maybe_unused cci_pmu_format_show(struct device *dev,
 			struct device_attribute *attr, char *buf);
-static ssize_t cci_pmu_event_show(struct device *dev,
+static ssize_t __maybe_unused cci_pmu_event_show(struct device *dev,
 			struct device_attribute *attr, char *buf);
 
 #define CCI_EXT_ATTR_ENTRY(_name, _func, _config) 				\
@@ -1466,7 +1466,7 @@ static int cci_pmu_offline_cpu(unsigned
 	return 0;
 }
 
-static struct cci_pmu_model cci_pmu_models[] = {
+static __maybe_unused struct cci_pmu_model cci_pmu_models[] = {
 #ifdef CONFIG_ARM_CCI400_PMU
 	[CCI400_R0] = {
 		.name = "CCI_400",



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 095/336] Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 094/336] drivers/bus: arm-cci: fix build warnings Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 096/336] ASoC: dpcm: fix BE dai not hw_free and shutdown Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian-Hong Pan, Marcel Holtmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jian-Hong Pan <jian-hong@endlessm.com>

[ Upstream commit 66d9975c5a7c40aa7e4bb0ec0b0c37ba1f190923 ]

Without this patch we cannot turn on the Bluethooth adapter on ASUS
E406MA.

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2ff8 ProdID=b011 Rev= 2.00
S:  Manufacturer=Realtek
S:  Product=802.11n WLAN Adapter
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/btusb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -371,6 +371,9 @@ static const struct usb_device_id blackl
 	/* Additional Realtek 8723BU Bluetooth devices */
 	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 
+	/* Additional Realtek 8723DE Bluetooth devices */
+	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
+
 	/* Additional Realtek 8821AE Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 096/336] ASoC: dpcm: fix BE dai not hw_free and shutdown
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 095/336] Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 097/336] mfd: cros_ec: Fail early if we cannot identify the EC Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, KaiChieh Chuang, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kai Chieh Chuang <kaichieh.chuang@mediatek.com>

[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ]

In case, one BE is used by two FE1/FE2
FE1--->BE-->
       |
FE2----]
when FE1/FE2 call dpcm_be_dai_hw_free() together
the BE users will be 2 (> 1), hence cannot be hw_free
the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP

later FE1/FE2 call dpcm_be_dai_shutdown(),
will be skip due to wrong state.
leaving the BE not being hw_free and shutdown.

The BE dai will be hw_free later when calling
dpcm_be_dai_shutdown() if still in invalid state.

Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-pcm.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1965,8 +1965,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_
 			continue;
 
 		if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
-		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN))
-			continue;
+		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) {
+			soc_pcm_hw_free(be_substream);
+			be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
+		}
 
 		dev_dbg(be->dev, "ASoC: close BE %s\n",
 			be->dai_link->name);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 097/336] mfd: cros_ec: Fail early if we cannot identify the EC
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 096/336] ASoC: dpcm: fix BE dai not hw_free and shutdown Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 098/336] mwifiex: handle race during mwifiex_usb_disconnect Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Palatin, Benson Leung,
	Enric Balletbo i Serra, Gwendal Grignou, Andy Shevchenko,
	Lee Jones, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vincent Palatin <vpalatin@chromium.org>

[ Upstream commit 0dbbf25561b29ffab5ba6277429760abdf49ceff ]

If we cannot communicate with the EC chip to detect the protocol version
and its features, it's very likely useless to continue. Else we will
commit all kind of uninformed mistakes (using the wrong protocol, the
wrong buffer size, mixing the EC with other chips).

Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Acked-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mfd/cros_ec.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_devi
 
 	mutex_init(&ec_dev->lock);
 
-	cros_ec_query_all(ec_dev);
+	err = cros_ec_query_all(ec_dev);
+	if (err) {
+		dev_err(dev, "Cannot identify the EC: error %d\n", err);
+		return err;
+	}
 
 	if (ec_dev->irq) {
 		err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 098/336] mwifiex: handle race during mwifiex_usb_disconnect
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 097/336] mfd: cros_ec: Fail early if we cannot identify the EC Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 099/336] wlcore: sdio: check for valid platform device data before suspend Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ganapathi Bhat, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ganapathi Bhat <gbhat@marvell.com>

[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ]

Race condition is observed during rmmod of mwifiex_usb:

1. The rmmod thread will call mwifiex_usb_disconnect(), download
   SHUTDOWN command and do wait_event_interruptible_timeout(),
   waiting for response.

2. The main thread will handle the response and will do a
   wake_up_interruptible(), unblocking rmmod thread.

3. On getting unblocked, rmmod thread  will make rx_cmd.urb = NULL in
   mwifiex_usb_free().

4. The main thread will try to resubmit rx_cmd.urb in
   mwifiex_usb_submit_rx_urb(), which is NULL.

To fix, wait for main thread to complete before calling
mwifiex_usb_free().

Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/usb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc
 					 MWIFIEX_FUNC_SHUTDOWN);
 	}
 
+	if (adapter->workqueue)
+		flush_workqueue(adapter->workqueue);
+
 	mwifiex_usb_free(card);
 
 	mwifiex_dbg(adapter, FATAL,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 099/336] wlcore: sdio: check for valid platform device data before suspend
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 098/336] mwifiex: handle race during mwifiex_usb_disconnect Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 100/336] net: hns3: Fixes initalization of RoCE handle and makes it conditional Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eyal Reizer, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eyal Reizer <eyalreizer@gmail.com>

[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ]

the wl pointer can be null In case only wlcore_sdio is probed while
no WiLink module is successfully probed, as in the case of mounting a
wl12xx module while using a device tree file configured with wl18xx
related settings.
In this case the system was crashing in wl1271_suspend() as platform
device data is not set.
Make sure wl the pointer is valid before using it.

Signed-off-by: Eyal Reizer <eyalr@ti.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ti/wlcore/sdio.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device
 	mmc_pm_flag_t sdio_flags;
 	int ret = 0;
 
+	if (!wl) {
+		dev_err(dev, "no wilink module was probed\n");
+		goto out;
+	}
+
 	dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n",
 		wl->wow_enabled);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 100/336] net: hns3: Fixes initalization of RoCE handle and makes it conditional
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 099/336] wlcore: sdio: check for valid platform device data before suspend Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 101/336] net: hns3: Fixes the init of the VALID BD info in the descriptor Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xinwei Kong, Zhou Wang, Lijun Ou,
	Salil Mehta, David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lijun Ou <oulijun@huawei.com>

[ Upstream commit 544a7bcd5cc74734003cf7f12502b26cebfed19f ]

When register a RoCE client with hnae3vf device, it needs to judge
the device whether support RoCE vf function. Otherwise, it will
lead to calltrace when RoCE is not support vf function and remove
roce device.

The calltrace as follows:
[   93.156614] Unable to handle kernel NULL pointer dereference at virtual address 00000015
 <SNIP>
[   93.278784] Call trace:
[   93.278788]  hnae3_match_n_instantiate+0x24/0xd8 [hnae3]
[   93.278790]  hnae3_register_client+0xcc/0x150 [hnae3]
[   93.278801]  hns_roce_hw_v2_init+0x18/0x1000 [hns_roce_hw_v2]
[   93.278805]  do_one_initcall+0x58/0x160
[   93.278807]  do_init_module+0x64/0x1d8
[   93.278809]  load_module+0x135c/0x15c8
[   93.278811]  SyS_finit_module+0x100/0x118
[   93.278816]  __sys_trace_return+0x0/0x4
[   93.278827] Code: aa0003f5 12001c56 aa1e03e0 d503201f (b9402660)

Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
Reported-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
Reported-by: Zhou Wang <wangzhou1@hisilicon.com>
Signed-off-by: Lijun Ou <oulijun@huawei.com>
Signed-off-by: Zhou Wang <wangzhou1@hisilicon.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1493,10 +1493,12 @@ static int hclgevf_init_instance(struct
 			return ret;
 		break;
 	case HNAE3_CLIENT_ROCE:
-		hdev->roce_client = client;
-		hdev->roce.client = client;
+		if (hnae3_dev_roce_supported(hdev)) {
+			hdev->roce_client = client;
+			hdev->roce.client = client;
+		}
 
-		if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
+		if (hdev->roce_client && hdev->nic_client) {
 			ret = hclgevf_init_roce_base_info(hdev);
 			if (ret)
 				return ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 101/336] net: hns3: Fixes the init of the VALID BD info in the descriptor
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 100/336] net: hns3: Fixes initalization of RoCE handle and makes it conditional Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 102/336] media: tw686x: Fix incorrect vb2_mem_ops GFP flags Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fuyun Liang, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fuyun Liang <liangfuyun1@huawei.com>

[ Upstream commit 7d0b130cbbfa4651cc1ab9268a2956c1b9d82ff9 ]

RX Buffer Descriptor contains a VALID bit which indicates if the BD
is valid and has some data. This field is set by HNS3 hardware to
intimate the driver of some valid data present in the BD. nd should
be reset by the driver when BD is being used again. In the existing
code this bit was not being (re-)initialized properly and hence was
causing problems.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1836,6 +1836,7 @@ static void hns3_replace_buffer(struct h
 	hns3_unmap_buffer(ring, &ring->desc_cb[i]);
 	ring->desc_cb[i] = *res_cb;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
+	ring->desc[i].rx.bd_base_info = 0;
 }
 
 static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i)
@@ -1843,6 +1844,7 @@ static void hns3_reuse_buffer(struct hns
 	ring->desc_cb[i].reuse_flag = 0;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma
 		+ ring->desc_cb[i].page_offset);
+	ring->desc[i].rx.bd_base_info = 0;
 }
 
 static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 102/336] media: tw686x: Fix incorrect vb2_mem_ops GFP flags
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 101/336] net: hns3: Fixes the init of the VALID BD info in the descriptor Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 103/336] media: cec-pin-error-inj: avoid a false-positive Spectre detection Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ezequiel Garcia, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ezequiel Garcia <ezequiel@collabora.com>

[ Upstream commit 636757ab6c93e19e2f58d3b3af1312e34eaffbab ]

When the driver is configured in the "memcpy" dma-mode,
it uses vb2_vmalloc_memops, which is backed by a SLAB
allocator and so shouldn't be using GFP_DMA32.

Fix it.

Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/tw686x/tw686x-video.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/media/pci/tw686x/tw686x-video.c
+++ b/drivers/media/pci/tw686x/tw686x-video.c
@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev
 		vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
 		vc->vidq.min_buffers_needed = 2;
 		vc->vidq.lock = &vc->vb_mutex;
-		vc->vidq.gfp_flags = GFP_DMA32;
+		vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ?
+				     GFP_DMA32 : 0;
 		vc->vidq.dev = &dev->pci_dev->dev;
 
 		err = vb2_queue_init(&vc->vidq);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 103/336] media: cec-pin-error-inj: avoid a false-positive Spectre detection
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 102/336] media: tw686x: Fix incorrect vb2_mem_ops GFP flags Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 104/336] media: videobuf2-core: dont call memop finish when queueing Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Hans Verkuil,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

[ Upstream commit a3d71f256c8a8b5d51ea0dfd09cd85ce3a09d9e1 ]

The current logic makes Smatch to false-detect a Spectre variant 1
vulnerability. The problem is that it initializes an u32 indirectly
from user space input.

After trying to write a fixup, after a while I realized that, in
practice, this shouldn't be a problem, as an u32 is initialized
from u8, but it took some time to discover it.

So, do some code cleanup to make it clearer for both humans
and machines about the valid range for "op".

Fix this warning:
	drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() warn: potential spectre issue 'pin->error_inj_args'

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/cec/cec-pin-error-inj.c |   23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

--- a/drivers/media/cec/cec-pin-error-inj.c
+++ b/drivers/media/cec/cec-pin-error-inj.c
@@ -81,10 +81,9 @@ bool cec_pin_error_inj_parse_line(struct
 	u64 *error;
 	u8 *args;
 	bool has_op;
-	u32 op;
+	u8 op;
 	u8 mode;
 	u8 pos;
-	u8 v;
 
 	p = skip_spaces(p);
 	token = strsep(&p, delims);
@@ -146,12 +145,18 @@ bool cec_pin_error_inj_parse_line(struct
 	comma = strchr(token, ',');
 	if (comma)
 		*comma++ = '\0';
-	if (!strcmp(token, "any"))
-		op = CEC_ERROR_INJ_OP_ANY;
-	else if (!kstrtou8(token, 0, &v))
-		op = v;
-	else
+	if (!strcmp(token, "any")) {
+		has_op = false;
+		error = pin->error_inj + CEC_ERROR_INJ_OP_ANY;
+		args = pin->error_inj_args[CEC_ERROR_INJ_OP_ANY];
+	} else if (!kstrtou8(token, 0, &op)) {
+		has_op = true;
+		error = pin->error_inj + op;
+		args = pin->error_inj_args[op];
+	} else {
 		return false;
+	}
+
 	mode = CEC_ERROR_INJ_MODE_ONCE;
 	if (comma) {
 		if (!strcmp(comma, "off"))
@@ -166,10 +171,6 @@ bool cec_pin_error_inj_parse_line(struct
 			return false;
 	}
 
-	error = pin->error_inj + op;
-	args = pin->error_inj_args[op];
-	has_op = op <= 0xff;
-
 	token = strsep(&p, delims);
 	if (p) {
 		p = skip_spaces(p);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 104/336] media: videobuf2-core: dont call memop finish when queueing
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 103/336] media: cec-pin-error-inj: avoid a false-positive Spectre detection Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 105/336] Btrfs: dont return ino to ino cache if inode item removal fails Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <hans.verkuil@cisco.com>

[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ]

When a buffer is queued or requeued in vb2_buffer_done, then don't
call the finish memop. In this case the buffer is only returned to vb2,
not to userspace.

Calling 'finish' here will cause an unbalance when the queue is
canceled, since the core will call the same memop again.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/common/videobuf2/videobuf2-core.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -916,9 +916,12 @@ void vb2_buffer_done(struct vb2_buffer *
 	dprintk(4, "done processing on buffer %d, state: %d\n",
 			vb->index, state);
 
-	/* sync buffers */
-	for (plane = 0; plane < vb->num_planes; ++plane)
-		call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+	if (state != VB2_BUF_STATE_QUEUED &&
+	    state != VB2_BUF_STATE_REQUEUEING) {
+		/* sync buffers */
+		for (plane = 0; plane < vb->num_planes; ++plane)
+			call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+	}
 
 	spin_lock_irqsave(&q->done_lock, flags);
 	if (state == VB2_BUF_STATE_QUEUED ||



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 105/336] Btrfs: dont return ino to ino cache if inode item removal fails
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 104/336] media: videobuf2-core: dont call memop finish when queueing Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 106/336] Btrfs: dont BUG_ON() in btrfs_truncate_inode_items() Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Josef Bacik, Omar Sandoval,
	David Sterba, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <osandov@fb.com>

[ Upstream commit c08db7d8d295a4f3a10faaca376de011afff7950 ]

In btrfs_evict_inode(), if btrfs_truncate_inode_items() fails, the inode
item will still be in the tree but we still return the ino to the ino
cache. That will blow up later when someone tries to allocate that ino,
so don't return it to the cache.

Fixes: 581bb050941b ("Btrfs: Cache free inode numbers in memory")
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c |   25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5426,13 +5426,18 @@ void btrfs_evict_inode(struct inode *ino
 		trans->block_rsv = rsv;
 
 		ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0);
-		if (ret != -ENOSPC && ret != -EAGAIN)
+		if (ret) {
+			trans->block_rsv = &fs_info->trans_block_rsv;
+			btrfs_end_transaction(trans);
+			btrfs_btree_balance_dirty(fs_info);
+			if (ret != -ENOSPC && ret != -EAGAIN) {
+				btrfs_orphan_del(NULL, BTRFS_I(inode));
+				btrfs_free_block_rsv(fs_info, rsv);
+				goto no_delete;
+			}
+		} else {
 			break;
-
-		trans->block_rsv = &fs_info->trans_block_rsv;
-		btrfs_end_transaction(trans);
-		trans = NULL;
-		btrfs_btree_balance_dirty(fs_info);
+		}
 	}
 
 	btrfs_free_block_rsv(fs_info, rsv);
@@ -5441,12 +5446,8 @@ void btrfs_evict_inode(struct inode *ino
 	 * Errors here aren't a big deal, it just means we leave orphan items
 	 * in the tree.  They will be cleaned up on the next mount.
 	 */
-	if (ret == 0) {
-		trans->block_rsv = root->orphan_block_rsv;
-		btrfs_orphan_del(trans, BTRFS_I(inode));
-	} else {
-		btrfs_orphan_del(NULL, BTRFS_I(inode));
-	}
+	trans->block_rsv = root->orphan_block_rsv;
+	btrfs_orphan_del(trans, BTRFS_I(inode));
 
 	trans->block_rsv = &fs_info->trans_block_rsv;
 	if (!(root == fs_info->tree_root ||



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 106/336] Btrfs: dont BUG_ON() in btrfs_truncate_inode_items()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 105/336] Btrfs: dont return ino to ino cache if inode item removal fails Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 107/336] btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Omar Sandoval,
	David Sterba, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <osandov@fb.com>

[ Upstream commit 0552210997badb6a60740a26ff9d976a416510f0 ]

btrfs_free_extent() can fail because of ENOMEM. There's no reason to
panic here, we can just abort the transaction.

Fixes: f4b9aa8d3b87 ("btrfs_truncate")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4671,7 +4671,10 @@ delete:
 						extent_num_bytes, 0,
 						btrfs_header_owner(leaf),
 						ino, extent_offset);
-			BUG_ON(ret);
+			if (ret) {
+				btrfs_abort_transaction(trans, ret);
+				break;
+			}
 			if (btrfs_should_throttle_delayed_refs(trans, fs_info))
 				btrfs_async_run_delayed_refs(fs_info,
 					trans->delayed_ref_updates * 2,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 107/336] btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 106/336] Btrfs: dont BUG_ON() in btrfs_truncate_inode_items() Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 108/336] btrfs: qgroup: Finish rescan when hit the last leaf of extent tree Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, David Sterba, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Sterba <dsterba@suse.com>

[ Upstream commit 3d3a2e610ea5e7c6d4f9481ecce5d8e2d8317843 ]

Currently the code assumes that there's an implied barrier by the
sequence of code preceding the wakeup, namely the mutex unlock.

As Nikolay pointed out:

I think this is wrong (not your code) but the original assumption that
the RELEASE semantics provided by mutex_unlock is sufficient.
According to memory-barriers.txt:

Section 'LOCK ACQUISITION FUNCTIONS' states:

 (2) RELEASE operation implication:

     Memory operations issued before the RELEASE will be completed before the
     RELEASE operation has completed.

     Memory operations issued after the RELEASE *may* be completed before the
     RELEASE operation has completed.

(I've bolded the may portion)

The example given there:

As an example, consider the following:

    *A = a;
    *B = b;
    ACQUIRE
    *C = c;
    *D = d;
    RELEASE
    *E = e;
    *F = f;

The following sequence of events is acceptable:

    ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE

So if we assume that *C is modifying the flag which the waitqueue is checking,
and *E is the actual wakeup, then those accesses can be re-ordered...

IMHO this code should be considered broken...
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

To be on the safe side, add the barriers. The synchronization logic
around log using the mutexes and several other threads does not make it
easy to reason for/against the barrier.

CC: Nikolay Borisov <nborisov@suse.com>
Link: https://lkml.kernel.org/r/6ee068d8-1a69-3728-00d1-d86293d43c9f@suse.com
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3116,8 +3116,11 @@ out_wake_log_root:
 	mutex_unlock(&log_root_tree->log_mutex);
 
 	/*
-	 * The barrier before waitqueue_active is implied by mutex_unlock
+	 * The barrier before waitqueue_active is needed so all the updates
+	 * above are seen by the woken threads. It might not be necessary, but
+	 * proving that seems to be hard.
 	 */
+	smp_mb();
 	if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
 		wake_up(&log_root_tree->log_commit_wait[index2]);
 out:
@@ -3128,8 +3131,11 @@ out:
 	mutex_unlock(&root->log_mutex);
 
 	/*
-	 * The barrier before waitqueue_active is implied by mutex_unlock
+	 * The barrier before waitqueue_active is needed so all the updates
+	 * above are seen by the woken threads. It might not be necessary, but
+	 * proving that seems to be hard.
 	 */
+	smp_mb();
 	if (waitqueue_active(&root->log_commit_wait[index1]))
 		wake_up(&root->log_commit_wait[index1]);
 	return ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 108/336] btrfs: qgroup: Finish rescan when hit the last leaf of extent tree
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 107/336] btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 109/336] x86/microcode: Make the late update update_lock a raw lock for RT Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Qu Wenruo,
	David Sterba, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <wqu@suse.com>

[ Upstream commit ff3d27a048d926b3920ccdb75d98788c567cae0d ]

Under the following case, qgroup rescan can double account cowed tree
blocks:

In this case, extent tree only has one tree block.

-
| transid=5 last committed=4
| btrfs_qgroup_rescan_worker()
| |- btrfs_start_transaction()
| |  transid = 5
| |- qgroup_rescan_leaf()
|    |- btrfs_search_slot_for_read() on extent tree
|       Get the only extent tree block from commit root (transid = 4).
|       Scan it, set qgroup_rescan_progress to the last
|       EXTENT/META_ITEM + 1
|       now qgroup_rescan_progress = A + 1.
|
| fs tree get CoWed, new tree block is at A + 16K
| transid 5 get committed
-
| transid=6 last committed=5
| btrfs_qgroup_rescan_worker()
| btrfs_qgroup_rescan_worker()
| |- btrfs_start_transaction()
| |  transid = 5
| |- qgroup_rescan_leaf()
|    |- btrfs_search_slot_for_read() on extent tree
|       Get the only extent tree block from commit root (transid = 5).
|       scan it using qgroup_rescan_progress (A + 1).
|       found new tree block beyong A, and it's fs tree block,
|       account it to increase qgroup numbers.
-

In above case, tree block A, and tree block A + 16K get accounted twice,
while qgroup rescan should stop when it already reach the last leaf,
other than continue using its qgroup_rescan_progress.

Such case could happen by just looping btrfs/017 and with some
possibility it can hit such double qgroup accounting problem.

Fix it by checking the path to determine if we should finish qgroup
rescan, other than relying on next loop to exit.

Reported-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/qgroup.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2580,6 +2580,21 @@ out:
 }
 
 /*
+ * Check if the leaf is the last leaf. Which means all node pointers
+ * are at their last position.
+ */
+static bool is_last_leaf(struct btrfs_path *path)
+{
+	int i;
+
+	for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) {
+		if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1)
+			return false;
+	}
+	return true;
+}
+
+/*
  * returns < 0 on error, 0 when more leafs are to be scanned.
  * returns 1 when done.
  */
@@ -2592,6 +2607,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
 	struct ulist *roots = NULL;
 	struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem);
 	u64 num_bytes;
+	bool done;
 	int slot;
 	int ret;
 
@@ -2620,6 +2636,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
 		mutex_unlock(&fs_info->qgroup_rescan_lock);
 		return ret;
 	}
+	done = is_last_leaf(path);
 
 	btrfs_item_key_to_cpu(path->nodes[0], &found,
 			      btrfs_header_nritems(path->nodes[0]) - 1);
@@ -2666,6 +2683,8 @@ out:
 	}
 	btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
 
+	if (done && !ret)
+		ret = 1;
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 109/336] x86/microcode: Make the late update update_lock a raw lock for RT
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 108/336] btrfs: qgroup: Finish rescan when hit the last leaf of extent tree Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 110/336] PM / wakeup: Make s2idle_lock a RAW_SPINLOCK Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Scott Wood, Borislav Petkov,
	Thomas Gleixner, Ashok Raj, Clark Williams, Pei Zhang, x86-ml,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Scott Wood <swood@redhat.com>

[ Upstream commit ff987fcf011d20c53b3a613edf6e2055ea48e26e ]

__reload_late() is called from stop_machine context and thus cannot
acquire a non-raw spinlock on PREEMPT_RT.

Signed-off-by: Scott Wood <swood@redhat.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Clark Williams <williams@redhat.com>
Cc: Pei Zhang <pezhang@redhat.com>
Cc: x86-ml <x86@kernel.org>
Link: http://lkml.kernel.org/r/20180524154420.24455-1-swood@redhat.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/microcode/core.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex);
 /*
  * Serialize late loading so that CPUs get updated one-by-one.
  */
-static DEFINE_SPINLOCK(update_lock);
+static DEFINE_RAW_SPINLOCK(update_lock);
 
 struct ucode_cpu_info		ucode_cpu_info[NR_CPUS];
 
@@ -560,9 +560,9 @@ static int __reload_late(void *info)
 	if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC))
 		return -1;
 
-	spin_lock(&update_lock);
+	raw_spin_lock(&update_lock);
 	apply_microcode_local(&err);
-	spin_unlock(&update_lock);
+	raw_spin_unlock(&update_lock);
 
 	/* siblings return UCODE_OK because their engine got updated already */
 	if (err > UCODE_NFOUND) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 110/336] PM / wakeup: Make s2idle_lock a RAW_SPINLOCK
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 109/336] x86/microcode: Make the late update update_lock a raw lock for RT Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 111/336] PCI: Prevent sysfs disable of device while driver is attached Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Rafael J. Wysocki, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit 62fc00a6611a0014c85763f9def1fc07c15d1302 ]

The `s2idle_lock' is acquired during suspend while interrupts are
disabled even on RT. The lock is acquired for short sections only.
Make it a RAW lock which avoids "sleeping while atomic" warnings on RT.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/power/suspend.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops
 static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head);
 
 enum s2idle_states __read_mostly s2idle_state;
-static DEFINE_SPINLOCK(s2idle_lock);
+static DEFINE_RAW_SPINLOCK(s2idle_lock);
 
 void s2idle_set_ops(const struct platform_s2idle_ops *ops)
 {
@@ -78,12 +78,12 @@ static void s2idle_enter(void)
 {
 	trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true);
 
-	spin_lock_irq(&s2idle_lock);
+	raw_spin_lock_irq(&s2idle_lock);
 	if (pm_wakeup_pending())
 		goto out;
 
 	s2idle_state = S2IDLE_STATE_ENTER;
-	spin_unlock_irq(&s2idle_lock);
+	raw_spin_unlock_irq(&s2idle_lock);
 
 	get_online_cpus();
 	cpuidle_resume();
@@ -97,11 +97,11 @@ static void s2idle_enter(void)
 	cpuidle_pause();
 	put_online_cpus();
 
-	spin_lock_irq(&s2idle_lock);
+	raw_spin_lock_irq(&s2idle_lock);
 
  out:
 	s2idle_state = S2IDLE_STATE_NONE;
-	spin_unlock_irq(&s2idle_lock);
+	raw_spin_unlock_irq(&s2idle_lock);
 
 	trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false);
 }
@@ -156,12 +156,12 @@ void s2idle_wake(void)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&s2idle_lock, flags);
+	raw_spin_lock_irqsave(&s2idle_lock, flags);
 	if (s2idle_state > S2IDLE_STATE_NONE) {
 		s2idle_state = S2IDLE_STATE_WAKE;
 		wake_up(&s2idle_wait_head);
 	}
-	spin_unlock_irqrestore(&s2idle_lock, flags);
+	raw_spin_unlock_irqrestore(&s2idle_lock, flags);
 }
 EXPORT_SYMBOL_GPL(s2idle_wake);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 111/336] PCI: Prevent sysfs disable of device while driver is attached
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 110/336] PM / wakeup: Make s2idle_lock a RAW_SPINLOCK Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 112/336] soc: qcom: qmi: fix a buffer sizing bug Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Bjorn Helgaas,
	Johannes Thumshirn, Keith Busch, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@lst.de>

[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ]

Manipulating the enable_cnt behind the back of the driver will wreak
complete havoc with the kernel state, so disallow it.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci-sysfs.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -288,13 +288,16 @@ static ssize_t enable_store(struct devic
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	if (!val) {
-		if (pci_is_enabled(pdev))
-			pci_disable_device(pdev);
-		else
-			result = -EIO;
-	} else
+	device_lock(dev);
+	if (dev->driver)
+		result = -EBUSY;
+	else if (val)
 		result = pci_enable_device(pdev);
+	else if (pci_is_enabled(pdev))
+		pci_disable_device(pdev);
+	else
+		result = -EIO;
+	device_unlock(dev);
 
 	return result < 0 ? result : count;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 112/336] soc: qcom: qmi: fix a buffer sizing bug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 111/336] PCI: Prevent sysfs disable of device while driver is attached Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 113/336] soc: qcom: smem: fix qcom_smem_set_global_partition() Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Elder, Bjorn Andersson,
	Andy Gross, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Elder <elder@linaro.org>

[ Upstream commit 7df5ff258bd27900d516fea88da10d05602bf8c7 ]

In qmi_handle_init(), a buffer is allocated for to hold messages
received through the handle's socket.  Any "normal" messages
(expected by the caller) will have a header prepended, so the
buffer size is adjusted to accomodate that.

The buffer must also be of sufficient size to receive control
messages, so the size is increased if necessary to ensure these
will fit.

Unfortunately the calculation is done wrong, making it possible
for the calculated buffer size to be too small to hold a "normal"
message.  Specifically, if:

  recv_buf_size > sizeof(struct qrtr_ctrl_pkt) - sizeof(struct qmi_header)
		AND
  recv_buf_size < sizeof(struct qrtr_ctrl_pkt)

the current logic will use sizeof(struct qrtr_ctrl_pkt) as the
receive buffer size, which is not enough to hold the maximum
"normal" message plus its header.  Currently this problem occurs
for (13 < recv_buf_size < 20).

This patch corrects this.

Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/qcom/qmi_interface.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/soc/qcom/qmi_interface.c
+++ b/drivers/soc/qcom/qmi_interface.c
@@ -639,10 +639,11 @@ int qmi_handle_init(struct qmi_handle *q
 	if (ops)
 		qmi->ops = *ops;
 
+	/* Make room for the header */
+	recv_buf_size += sizeof(struct qmi_header);
+	/* Must also be sufficient to hold a control packet */
 	if (recv_buf_size < sizeof(struct qrtr_ctrl_pkt))
 		recv_buf_size = sizeof(struct qrtr_ctrl_pkt);
-	else
-		recv_buf_size += sizeof(struct qmi_header);
 
 	qmi->recv_buf_size = recv_buf_size;
 	qmi->recv_buf = kzalloc(recv_buf_size, GFP_KERNEL);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 113/336] soc: qcom: smem: fix qcom_smem_set_global_partition()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 112/336] soc: qcom: qmi: fix a buffer sizing bug Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 114/336] soc: qcom: smem: byte swap values properly Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Elder, Bjorn Andersson,
	Andy Gross, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Elder <elder@linaro.org>

[ Upstream commit 8fa1a21409da6abfe890f66532f9fcd8d2c25a3d ]

If there is at least one entry in the partition table, but no global
entry, the qcom_smem_set_global_partition() should return an error
just like it does if there are no partition table entries.

It turns out the function still returns an error in this case, but
it waits to do so until it has mistakenly treated the last entry in
the table as if it were the global entry found.

Fix the function to return immediately if no global entry is found
in the table.

Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/qcom/smem.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/soc/qcom/smem.c
+++ b/drivers/soc/qcom/smem.c
@@ -695,9 +695,10 @@ static u32 qcom_smem_get_item_count(stru
 static int qcom_smem_set_global_partition(struct qcom_smem *smem)
 {
 	struct smem_partition_header *header;
-	struct smem_ptable_entry *entry = NULL;
+	struct smem_ptable_entry *entry;
 	struct smem_ptable *ptable;
 	u32 host0, host1, size;
+	bool found = false;
 	int i;
 
 	ptable = qcom_smem_get_ptable(smem);
@@ -709,11 +710,13 @@ static int qcom_smem_set_global_partitio
 		host0 = le16_to_cpu(entry->host0);
 		host1 = le16_to_cpu(entry->host1);
 
-		if (host0 == SMEM_GLOBAL_HOST && host0 == host1)
+		if (host0 == SMEM_GLOBAL_HOST && host0 == host1) {
+			found = true;
 			break;
+		}
 	}
 
-	if (!entry) {
+	if (!found) {
 		dev_err(smem->dev, "Missing entry for global partition\n");
 		return -EINVAL;
 	}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 114/336] soc: qcom: smem: byte swap values properly
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 113/336] soc: qcom: smem: fix qcom_smem_set_global_partition() Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 115/336] nvme-rdma: stop admin queue before freeing it Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Elder, Bjorn Andersson,
	Andy Gross, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Elder <elder@linaro.org>

[ Upstream commit 04a512fea333369cc0b550f3b90df0d638e34d00 ]

Two places report an error when a partition header is found to
not contain the right canary value.  The error messages do not
properly byte swap the host ids.  Fix this, and adjust the format
specificier to match the 16-bit unsigned data type.

Move the error handling for a bad canary value to the end of
qcom_smem_alloc_private().  This avoids some long lines, and
reduces the distraction of handling this unexpected problem.

Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/qcom/smem.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

--- a/drivers/soc/qcom/smem.c
+++ b/drivers/soc/qcom/smem.c
@@ -362,13 +362,8 @@ static int qcom_smem_alloc_private(struc
 	cached = phdr_to_last_cached_entry(phdr);
 
 	while (hdr < end) {
-		if (hdr->canary != SMEM_PRIVATE_CANARY) {
-			dev_err(smem->dev,
-				"Found invalid canary in hosts %d:%d partition\n",
-				phdr->host0, phdr->host1);
-			return -EINVAL;
-		}
-
+		if (hdr->canary != SMEM_PRIVATE_CANARY)
+			goto bad_canary;
 		if (le16_to_cpu(hdr->item) == item)
 			return -EEXIST;
 
@@ -397,6 +392,11 @@ static int qcom_smem_alloc_private(struc
 	le32_add_cpu(&phdr->offset_free_uncached, alloc_size);
 
 	return 0;
+bad_canary:
+	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
+		le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
+
+	return -EINVAL;
 }
 
 static int qcom_smem_alloc_global(struct qcom_smem *smem,
@@ -560,8 +560,8 @@ static void *qcom_smem_get_private(struc
 	return ERR_PTR(-ENOENT);
 
 invalid_canary:
-	dev_err(smem->dev, "Found invalid canary in hosts %d:%d partition\n",
-			phdr->host0, phdr->host1);
+	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
+			le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
 
 	return ERR_PTR(-EINVAL);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 115/336] nvme-rdma: stop admin queue before freeing it
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 114/336] soc: qcom: smem: byte swap values properly Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 116/336] nvme-pci: Fix AER reset handling Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jianchao Wang, Sagi Grimberg,
	Max Gurtovoy, Christoph Hellwig, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jianchao Wang <jianchao.w.wang@oracle.com>

[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ]

For any failure after nvme_rdma_start_queue in
nvme_rdma_configure_admin_queue, the admin queue will be freed with the
NVME_RDMA_Q_LIVE flag still set.  Once nvme_rdma_stop_queue is invoked,
that will cause a use-after-free.
BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm]

To fix it, call nvme_rdma_stop_queue for all the failed cases after
nvme_rdma_start_queue.

Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
Suggested-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/rdma.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -778,7 +778,7 @@ static int nvme_rdma_configure_admin_que
 	if (error) {
 		dev_err(ctrl->ctrl.device,
 			"prop_get NVME_REG_CAP failed\n");
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 	}
 
 	ctrl->ctrl.sqsize =
@@ -786,23 +786,25 @@ static int nvme_rdma_configure_admin_que
 
 	error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	ctrl->ctrl.max_hw_sectors =
 		(ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
 
 	error = nvme_init_identify(&ctrl->ctrl);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev,
 			&ctrl->async_event_sqe, sizeof(struct nvme_command),
 			DMA_TO_DEVICE);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	return 0;
 
+out_stop_queue:
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 out_cleanup_queue:
 	if (new)
 		blk_cleanup_queue(ctrl->ctrl.admin_q);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 116/336] nvme-pci: Fix AER reset handling
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 115/336] nvme-rdma: stop admin queue before freeing it Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 117/336] ath: Add regulatory mapping for FCC3_ETSIC Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Gagniuc, Keith Busch,
	Christoph Hellwig, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Keith Busch <keith.busch@intel.com>

[ Upstream commit 72cd4cc28e234ed7189ee508ed65ab60c80a97c8 ]

The nvme timeout handling doesn't do anything if the pci channel is
offline, which is the case when recovering from PCI error event, so it
was a bad idea to sync the controller reset in this state. This patch
flushes the reset work in the error_resume callback instead when the
channel is back to online. This keeps AER handling serialized and
can recover from timeouts.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=199757
Fixes: cc1d5e749a2e ("nvme/pci: Sync controller reset for AER slot_reset")
Reported-by: Alex Gagniuc <mr.nuke.me@gmail.com>
Tested-by: Alex Gagniuc <mr.nuke.me@gmail.com>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/pci.c |   14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2679,19 +2679,15 @@ static pci_ers_result_t nvme_slot_reset(
 
 	dev_info(dev->ctrl.device, "restart after slot reset\n");
 	pci_restore_state(pdev);
-	nvme_reset_ctrl_sync(&dev->ctrl);
-
-	switch (dev->ctrl.state) {
-	case NVME_CTRL_LIVE:
-	case NVME_CTRL_ADMIN_ONLY:
-		return PCI_ERS_RESULT_RECOVERED;
-	default:
-		return PCI_ERS_RESULT_DISCONNECT;
-	}
+	nvme_reset_ctrl(&dev->ctrl);
+	return PCI_ERS_RESULT_RECOVERED;
 }
 
 static void nvme_error_resume(struct pci_dev *pdev)
 {
+	struct nvme_dev *dev = pci_get_drvdata(pdev);
+
+	flush_work(&dev->ctrl.reset_work);
 	pci_cleanup_aer_uncorrect_error_status(pdev);
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 117/336] ath: Add regulatory mapping for FCC3_ETSIC
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 116/336] nvme-pci: Fix AER reset handling Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 118/336] ath: Add regulatory mapping for ETSI8_WORLD Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ]

The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -35,6 +35,7 @@ enum EnumRd {
 	FRANCE_RES = 0x31,
 	FCC3_FCCA = 0x3A,
 	FCC3_WORLD = 0x3B,
+	FCC3_ETSIC = 0x3F,
 
 	ETSI1_WORLD = 0x37,
 	ETSI3_ETSIA = 0x32,
@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo
 	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC3_FCCA, CTL_FCC, CTL_FCC},
 	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
+	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC4_FCCA, CTL_FCC, CTL_FCC},
 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
 	{FCC6_FCCA, CTL_FCC, CTL_FCC},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 118/336] ath: Add regulatory mapping for ETSI8_WORLD
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 117/336] ath: Add regulatory mapping for FCC3_ETSIC Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 119/336] ath: Add regulatory mapping for APL13_WORLD Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ]

The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -45,6 +45,7 @@ enum EnumRd {
 	ETSI4_ETSIC = 0x38,
 	ETSI5_WORLD = 0x39,
 	ETSI6_WORLD = 0x34,
+	ETSI8_WORLD = 0x3D,
 	ETSI_RESERVED = 0x33,
 
 	MKK1_MKKA = 0x40,
@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo
 	{ETSI4_WORLD, CTL_ETSI, CTL_ETSI},
 	{ETSI5_WORLD, CTL_ETSI, CTL_ETSI},
 	{ETSI6_WORLD, CTL_ETSI, CTL_ETSI},
+	{ETSI8_WORLD, CTL_ETSI, CTL_ETSI},
 
 	/* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */
 	{ETSI3_ETSIA, CTL_ETSI, CTL_ETSI},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 119/336] ath: Add regulatory mapping for APL13_WORLD
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 118/336] ath: Add regulatory mapping for ETSI8_WORLD Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 120/336] ath: Add regulatory mapping for APL2_FCCA Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ]

The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -69,6 +69,7 @@ enum EnumRd {
 	APL1_ETSIC = 0x55,
 	APL2_ETSIC = 0x56,
 	APL5_WORLD = 0x58,
+	APL13_WORLD = 0x5A,
 	APL6_WORLD = 0x5B,
 	APL7_FCCA = 0x5C,
 	APL8_WORLD = 0x5D,
@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo
 	{APL3_WORLD, CTL_FCC, CTL_ETSI},
 	{APL4_WORLD, CTL_FCC, CTL_ETSI},
 	{APL5_WORLD, CTL_FCC, CTL_ETSI},
+	{APL13_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL6_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL8_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL9_WORLD, CTL_ETSI, CTL_ETSI},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 120/336] ath: Add regulatory mapping for APL2_FCCA
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 119/336] ath: Add regulatory mapping for APL13_WORLD Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 121/336] ath: Add regulatory mapping for Uganda Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ]

The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: FCC
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -61,6 +61,7 @@ enum EnumRd {
 	MKK1_MKKA1 = 0x4A,
 	MKK1_MKKA2 = 0x4B,
 	MKK1_MKKC = 0x4C,
+	APL2_FCCA = 0x4D,
 
 	APL3_FCCA = 0x50,
 	APL1_WORLD = 0x52,
@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo
 	{FCC1_FCCA, CTL_FCC, CTL_FCC},
 	{APL1_WORLD, CTL_FCC, CTL_ETSI},
 	{APL2_WORLD, CTL_FCC, CTL_ETSI},
+	{APL2_FCCA, CTL_FCC, CTL_FCC},
 	{APL3_WORLD, CTL_FCC, CTL_ETSI},
 	{APL4_WORLD, CTL_FCC, CTL_ETSI},
 	{APL5_WORLD, CTL_FCC, CTL_ETSI},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 121/336] ath: Add regulatory mapping for Uganda
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 120/336] ath: Add regulatory mapping for APL2_FCCA Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 122/336] ath: Add regulatory mapping for Tanzania Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -175,6 +175,7 @@ enum CountryCode {
 	CTRY_TUNISIA = 788,
 	CTRY_TURKEY = 792,
 	CTRY_UAE = 784,
+	CTRY_UGANDA = 800,
 	CTRY_UKRAINE = 804,
 	CTRY_UNITED_KINGDOM = 826,
 	CTRY_UNITED_STATES = 840,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
 	{CTRY_TUNISIA, ETSI3_WORLD, "TN"},
 	{CTRY_TURKEY, ETSI3_WORLD, "TR"},
+	{CTRY_UGANDA, FCC3_WORLD, "UG"},
 	{CTRY_UKRAINE, NULL1_WORLD, "UA"},
 	{CTRY_UAE, NULL1_WORLD, "AE"},
 	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 122/336] ath: Add regulatory mapping for Tanzania
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 121/336] ath: Add regulatory mapping for Uganda Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 123/336] ath: Add regulatory mapping for Serbia Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -170,6 +170,7 @@ enum CountryCode {
 	CTRY_SWITZERLAND = 756,
 	CTRY_SYRIA = 760,
 	CTRY_TAIWAN = 158,
+	CTRY_TANZANIA = 834,
 	CTRY_THAILAND = 764,
 	CTRY_TRINIDAD_Y_TOBAGO = 780,
 	CTRY_TUNISIA = 788,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_SWITZERLAND, ETSI1_WORLD, "CH"},
 	{CTRY_SYRIA, NULL1_WORLD, "SY"},
 	{CTRY_TAIWAN, APL3_FCCA, "TW"},
+	{CTRY_TANZANIA, APL1_WORLD, "TZ"},
 	{CTRY_THAILAND, FCC3_WORLD, "TH"},
 	{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
 	{CTRY_TUNISIA, ETSI3_WORLD, "TN"},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 123/336] ath: Add regulatory mapping for Serbia
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 122/336] ath: Add regulatory mapping for Tanzania Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 124/336] ath: Add regulatory mapping for Bermuda Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -159,6 +159,7 @@ enum CountryCode {
 	CTRY_ROMANIA = 642,
 	CTRY_RUSSIA = 643,
 	CTRY_SAUDI_ARABIA = 682,
+	CTRY_SERBIA = 688,
 	CTRY_SERBIA_MONTENEGRO = 891,
 	CTRY_SINGAPORE = 702,
 	CTRY_SLOVAKIA = 703,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_ROMANIA, NULL1_WORLD, "RO"},
 	{CTRY_RUSSIA, NULL1_WORLD, "RU"},
 	{CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
+	{CTRY_SERBIA, ETSI1_WORLD, "RS"},
 	{CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"},
 	{CTRY_SINGAPORE, APL6_WORLD, "SG"},
 	{CTRY_SLOVAKIA, ETSI1_WORLD, "SK"},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 124/336] ath: Add regulatory mapping for Bermuda
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 123/336] ath: Add regulatory mapping for Serbia Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 125/336] ath: Add regulatory mapping for Bahamas Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: FCC
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -74,6 +74,7 @@ enum CountryCode {
 	CTRY_BELARUS = 112,
 	CTRY_BELGIUM = 56,
 	CTRY_BELIZE = 84,
+	CTRY_BERMUDA = 60,
 	CTRY_BOLIVIA = 68,
 	CTRY_BOSNIA_HERZ = 70,
 	CTRY_BRAZIL = 76,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_BELGIUM, ETSI1_WORLD, "BE"},
 	{CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
 	{CTRY_BELIZE, APL1_ETSIC, "BZ"},
+	{CTRY_BERMUDA, FCC3_FCCA, "BM"},
 	{CTRY_BOLIVIA, APL1_ETSIC, "BO"},
 	{CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"},
 	{CTRY_BRAZIL, FCC3_WORLD, "BR"},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 125/336] ath: Add regulatory mapping for Bahamas
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 124/336] ath: Add regulatory mapping for Bermuda Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 126/336] sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven.eckelmann@openmesh.com>

[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:

  Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -68,6 +68,7 @@ enum CountryCode {
 	CTRY_AUSTRALIA = 36,
 	CTRY_AUSTRIA = 40,
 	CTRY_AZERBAIJAN = 31,
+	CTRY_BAHAMAS = 44,
 	CTRY_BAHRAIN = 48,
 	CTRY_BANGLADESH = 50,
 	CTRY_BARBADOS = 52,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
 	{CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
 	{CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
+	{CTRY_BAHAMAS, FCC3_WORLD, "BS"},
 	{CTRY_BAHRAIN, APL6_WORLD, "BH"},
 	{CTRY_BANGLADESH, NULL1_WORLD, "BD"},
 	{CTRY_BARBADOS, FCC2_WORLD, "BB"},



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 126/336] sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 125/336] ath: Add regulatory mapping for Bahamas Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47   ` Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Guittot, Patrick Bellasi,
	Peter Zijlstra (Intel),
	Thomas Gleixner, Viresh Kumar, Dietmar Eggemann, Joel Fernandes,
	Juri Lelli, Linus Torvalds, Morten Rasmussen, Rafael J . Wysocki,
	Steve Muckle, Ingo Molnar, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrick Bellasi <patrick.bellasi@arm.com>

[ Upstream commit 8ecf04e11283a28ca88b8b8049ac93c3a99fcd2c ]

Since the refactoring introduced by:

   commit 8f111bc357aa ("cpufreq/schedutil: Rewrite CPUFREQ_RT support")

we aggregate FAIR utilization only if this class has runnable tasks.

This was mainly due to avoid the risk to stay on an high frequency just
because of the blocked utilization of a CPU not being properly decayed
while the CPU was idle.

However, since:

   commit 31e77c93e432 ("sched/fair: Update blocked load when newly idle")

the FAIR blocked utilization is properly decayed also for IDLE CPUs.

This allows us to use the FAIR blocked utilization as a safe mechanism
to gracefully reduce the frequency only if no FAIR tasks show up on a
CPU for a reasonable period of time.

Moreover, we also reduce the frequency drops of CPUs running periodic
tasks which, depending on the task periodicity and the time required
for a frequency switch, was increasing the chances to introduce some
undesirable performance variations.

Reported-by: Vincent Guittot <vincent.guittot@linaro.org>
Tested-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Patrick Bellasi <patrick.bellasi@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Morten Rasmussen <morten.rasmussen@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rafael J . Wysocki <rafael.j.wysocki@intel.com>
Cc: Steve Muckle <smuckle@google.com>
Link: http://lkml.kernel.org/r/20180524141023.13765-2-patrick.bellasi@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/sched/cpufreq_schedutil.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -183,22 +183,21 @@ static void sugov_get_util(struct sugov_
 static unsigned long sugov_aggregate_util(struct sugov_cpu *sg_cpu)
 {
 	struct rq *rq = cpu_rq(sg_cpu->cpu);
-	unsigned long util;
 
-	if (rq->rt.rt_nr_running) {
-		util = sg_cpu->max;
-	} else {
-		util = sg_cpu->util_dl;
-		if (rq->cfs.h_nr_running)
-			util += sg_cpu->util_cfs;
-	}
+	if (rq->rt.rt_nr_running)
+		return sg_cpu->max;
 
 	/*
+	 * Utilization required by DEADLINE must always be granted while, for
+	 * FAIR, we use blocked utilization of IDLE CPUs as a mechanism to
+	 * gracefully reduce the frequency when no tasks show up for longer
+	 * periods of time.
+	 *
 	 * Ideally we would like to set util_dl as min/guaranteed freq and
 	 * util_cfs + util_dl as requested freq. However, cpufreq is not yet
 	 * ready for such an interface. So, we only do the latter for now.
 	 */
-	return min(util, sg_cpu->max);
+	return min(sg_cpu->max, (sg_cpu->util_dl + sg_cpu->util_cfs));
 }
 
 static void sugov_set_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, unsigned int flags)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 133/336] spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
@ 2018-08-01 16:47   ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
                     ` (310 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable,
	Renesas BSP team via Yoshihiro Shimoda, Geert Uytterhoeven,
	Simon Horman, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ]

According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in
the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit
must match the value of the SITMDR1.SYNCAC bit.  However,
sh_msiof_spi_setup() changes only the latter.

Fix this by updating the SIRMDR1 register like the SITMDR1 register,
taking into account register bits that exist in SITMDR1 only.

Reported-by: Renesas BSP team via Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Fixes: 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-sh-msiof.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -564,14 +564,16 @@ static int sh_msiof_spi_setup(struct spi
 
 	/* Configure native chip select mode/polarity early */
 	clr = MDR1_SYNCMD_MASK;
-	set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI;
+	set = MDR1_SYNCMD_SPI;
 	if (spi->mode & SPI_CS_HIGH)
 		clr |= BIT(MDR1_SYNCAC_SHIFT);
 	else
 		set |= BIT(MDR1_SYNCAC_SHIFT);
 	pm_runtime_get_sync(&p->pdev->dev);
 	tmp = sh_msiof_read(p, TMDR1) & ~clr;
-	sh_msiof_write(p, TMDR1, tmp | set);
+	sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON);
+	tmp = sh_msiof_read(p, RMDR1) & ~clr;
+	sh_msiof_write(p, RMDR1, tmp | set);
 	pm_runtime_put(&p->pdev->dev);
 	p->native_cs_high = spi->mode & SPI_CS_HIGH;
 	p->native_cs_inited = true;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 133/336] spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC
@ 2018-08-01 16:47   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable,
	Renesas BSP team via Yoshihiro Shimoda, Geert Uytterhoeven,
	Simon Horman, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ]

According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in
the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit
must match the value of the SITMDR1.SYNCAC bit.  However,
sh_msiof_spi_setup() changes only the latter.

Fix this by updating the SIRMDR1 register like the SITMDR1 register,
taking into account register bits that exist in SITMDR1 only.

Reported-by: Renesas BSP team via Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Fixes: 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-sh-msiof.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -564,14 +564,16 @@ static int sh_msiof_spi_setup(struct spi
 
 	/* Configure native chip select mode/polarity early */
 	clr = MDR1_SYNCMD_MASK;
-	set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI;
+	set = MDR1_SYNCMD_SPI;
 	if (spi->mode & SPI_CS_HIGH)
 		clr |= BIT(MDR1_SYNCAC_SHIFT);
 	else
 		set |= BIT(MDR1_SYNCAC_SHIFT);
 	pm_runtime_get_sync(&p->pdev->dev);
 	tmp = sh_msiof_read(p, TMDR1) & ~clr;
-	sh_msiof_write(p, TMDR1, tmp | set);
+	sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON);
+	tmp = sh_msiof_read(p, RMDR1) & ~clr;
+	sh_msiof_write(p, RMDR1, tmp | set);
 	pm_runtime_put(&p->pdev->dev);
 	p->native_cs_high = spi->mode & SPI_CS_HIGH;
 	p->native_cs_inited = true;

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 134/336] powerpc/8xx: fix invalid register expression in head_8xx.S
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2018-08-01 16:47   ` Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 135/336] pinctrl: at91-pio4: add missing of_node_put Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ]

New binutils generate the following warning

  AS      arch/powerpc/kernel/head_8xx.o
arch/powerpc/kernel/head_8xx.S: Assembler messages:
arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression

This patch fixes it.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/head_8xx.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -913,7 +913,7 @@ start_here:
 	tovirt(r6,r6)
 	lis	r5, abatron_pteptrs@h
 	ori	r5, r5, abatron_pteptrs@l
-	stw	r5, 0xf0(r0)	/* Must match your Abatron config file */
+	stw	r5, 0xf0(0)	/* Must match your Abatron config file */
 	tophys(r5,r5)
 	stw	r6, 0(r5)
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 135/336] pinctrl: at91-pio4: add missing of_node_put
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 134/336] powerpc/8xx: fix invalid register expression in head_8xx.S Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 136/336] pinctrl: msm: fix gpio-hog related boot issues Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julia Lawall, Ludovic Desroches,
	Linus Walleij, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Julia Lawall <Julia.Lawall@lip6.fr>

[ Upstream commit 21816364715f508c10da1e087e352bc1e326614f ]

The device node iterators perform an of_node_get on each iteration, so a
jump out of the loop requires an of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
+  of_node_put(child);
?  break;
   ...
}
... when != child
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-at91-pio4.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/pinctrl/pinctrl-at91-pio4.c
+++ b/drivers/pinctrl/pinctrl-at91-pio4.c
@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(str
 		for_each_child_of_node(np_config, np) {
 			ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map,
 						    &reserved_maps, num_maps);
-			if (ret < 0)
+			if (ret < 0) {
+				of_node_put(np);
 				break;
+			}
 		}
 	}
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 136/336] pinctrl: msm: fix gpio-hog related boot issues
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 135/336] pinctrl: at91-pio4: add missing of_node_put Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 137/336] bpf: fix multi-function JITed dump obtained via syscall Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Bjorn Andersson,
	Christian Lamparter, Linus Walleij, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christian Lamparter <chunkeey@gmail.com>

[ Upstream commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 ]

Sven Eckelmann reported an issue with the current IPQ4019 pinctrl.
Setting up any gpio-hog in the device-tree for his device would
"kill the bootup completely":

| [    0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [    0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe
| [    1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517
| [    1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register
| [    1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip
| [    1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [    1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri

This was also verified on a RT-AC58U (IPQ4018) which would
no longer boot, if a gpio-hog was specified. (Tried forcing
the USB LED PIN (GPIO0) to high.).

The problem is that Pinctrl+GPIO registration is currently
peformed in the following order in pinctrl-msm.c:
	1. pinctrl_register()
	2. gpiochip_add()
	3. gpiochip_add_pin_range()

The actual error code -517 == -EPROBE_DEFER is coming from
pinctrl_get_device_gpio_range(), which is called through:
        gpiochip_add
            of_gpiochip_add
                of_gpiochip_scan_gpios
                    gpiod_hog
                        gpiochip_request_own_desc
                            __gpiod_request
                                chip->request
                                    gpiochip_generic_request
                                       pinctrl_gpio_request
                                          pinctrl_get_device_gpio_range

pinctrl_get_device_gpio_range() is unable to find any valid
pin ranges, since nothing has been added to the pinctrldev_list yet.
so the range can't be found, and the operation fails with -EPROBE_DEFER.

This patch fixes the issue by adding the "gpio-ranges" property to
the pinctrl device node of all upstream Qcom SoC. The pin ranges are
then added by the gpio core.

In order to remain compatible with older, existing DTs (and ACPI)
a check for the "gpio-ranges" property has been added to
msm_gpio_init(). This prevents the driver of adding the same entry
to the pinctrldev_list twice.

Reported-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Tested-by: Sven Eckelmann <sven.eckelmann@openmesh.com> [ipq4019]
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/qcom/pinctrl-msm.c |   23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -890,11 +890,24 @@ static int msm_gpio_init(struct msm_pinc
 		return ret;
 	}
 
-	ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio);
-	if (ret) {
-		dev_err(pctrl->dev, "Failed to add pin range\n");
-		gpiochip_remove(&pctrl->chip);
-		return ret;
+	/*
+	 * For DeviceTree-supported systems, the gpio core checks the
+	 * pinctrl's device node for the "gpio-ranges" property.
+	 * If it is present, it takes care of adding the pin ranges
+	 * for the driver. In this case the driver can skip ahead.
+	 *
+	 * In order to remain compatible with older, existing DeviceTree
+	 * files which don't set the "gpio-ranges" property or systems that
+	 * utilize ACPI the driver has to call gpiochip_add_pin_range().
+	 */
+	if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
+		ret = gpiochip_add_pin_range(&pctrl->chip,
+			dev_name(pctrl->dev), 0, 0, chip->ngpio);
+		if (ret) {
+			dev_err(pctrl->dev, "Failed to add pin range\n");
+			gpiochip_remove(&pctrl->chip);
+			return ret;
+		}
 	}
 
 	ret = gpiochip_irqchip_add(chip,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 137/336] bpf: fix multi-function JITed dump obtained via syscall
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 136/336] pinctrl: msm: fix gpio-hog related boot issues Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 138/336] bpf: powerpc64: pad function address loads with NOPs Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sandipan Das, Daniel Borkmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sandipan Das <sandipan@linux.vnet.ibm.com>

[ Upstream commit 4d56a76ead2fcd856e677cdc9445ad331a409b8c ]

Currently, for multi-function programs, we cannot get the JITed
instructions using the bpf system call's BPF_OBJ_GET_INFO_BY_FD
command. Because of this, userspace tools such as bpftool fail
to identify a multi-function program as being JITed or not.

With the JIT enabled and the test program running, this can be
verified as follows:

  # cat /proc/sys/net/core/bpf_jit_enable
  1

Before applying this patch:

  # bpftool prog list
  1: kprobe  name foo  tag b811aab41a39ad3d  gpl
          loaded_at 2018-05-16T11:43:38+0530  uid 0
          xlated 216B  not jited  memlock 65536B
  ...

  # bpftool prog dump jited id 1
  no instructions returned

After applying this patch:

  # bpftool prog list
  1: kprobe  name foo  tag b811aab41a39ad3d  gpl
          loaded_at 2018-05-16T12:13:01+0530  uid 0
          xlated 216B  jited 308B  memlock 65536B
  ...

  # bpftool prog dump jited id 1
     0:   nop
     4:   nop
     8:   mflr    r0
     c:   std     r0,16(r1)
    10:   stdu    r1,-112(r1)
    14:   std     r31,104(r1)
    18:   addi    r31,r1,48
    1c:   li      r3,10
  ...

Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/syscall.c |   37 ++++++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1946,13 +1946,44 @@ static int bpf_prog_get_info_by_fd(struc
 	 * for offload.
 	 */
 	ulen = info.jited_prog_len;
-	info.jited_prog_len = prog->jited_len;
+	if (prog->aux->func_cnt) {
+		u32 i;
+
+		info.jited_prog_len = 0;
+		for (i = 0; i < prog->aux->func_cnt; i++)
+			info.jited_prog_len += prog->aux->func[i]->jited_len;
+	} else {
+		info.jited_prog_len = prog->jited_len;
+	}
+
 	if (info.jited_prog_len && ulen) {
 		if (bpf_dump_raw_ok()) {
 			uinsns = u64_to_user_ptr(info.jited_prog_insns);
 			ulen = min_t(u32, info.jited_prog_len, ulen);
-			if (copy_to_user(uinsns, prog->bpf_func, ulen))
-				return -EFAULT;
+
+			/* for multi-function programs, copy the JITed
+			 * instructions for all the functions
+			 */
+			if (prog->aux->func_cnt) {
+				u32 len, free, i;
+				u8 *img;
+
+				free = ulen;
+				for (i = 0; i < prog->aux->func_cnt; i++) {
+					len = prog->aux->func[i]->jited_len;
+					len = min_t(u32, len, free);
+					img = (u8 *) prog->aux->func[i]->bpf_func;
+					if (copy_to_user(uinsns, img, len))
+						return -EFAULT;
+					uinsns += len;
+					free -= len;
+					if (!free)
+						break;
+				}
+			} else {
+				if (copy_to_user(uinsns, prog->bpf_func, ulen))
+					return -EFAULT;
+			}
 		} else {
 			info.jited_prog_insns = 0;
 		}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 138/336] bpf: powerpc64: pad function address loads with NOPs
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 137/336] bpf: fix multi-function JITed dump obtained via syscall Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 139/336] PCI: pciehp: Request control of native hotplug only if supported Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sandipan Das, Daniel Borkmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sandipan Das <sandipan@linux.vnet.ibm.com>

[ Upstream commit 4ea69b2fd623dee2bbc77d3b6b7d8c0924e2026a ]

For multi-function programs, loading the address of a callee
function to a register requires emitting instructions whose
count varies from one to five depending on the nature of the
address.

Since we come to know of the callee's address only before the
extra pass, the number of instructions required to load this
address may vary from what was previously generated. This can
make the JITed image grow or shrink.

To avoid this, we should generate a constant five-instruction
when loading function addresses by padding the optimized load
sequence with NOPs.

Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/net/bpf_jit_comp64.c |   34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -202,25 +202,37 @@ static void bpf_jit_build_epilogue(u32 *
 
 static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
 {
+	unsigned int i, ctx_idx = ctx->idx;
+
+	/* Load function address into r12 */
+	PPC_LI64(12, func);
+
+	/* For bpf-to-bpf function calls, the callee's address is unknown
+	 * until the last extra pass. As seen above, we use PPC_LI64() to
+	 * load the callee's address, but this may optimize the number of
+	 * instructions required based on the nature of the address.
+	 *
+	 * Since we don't want the number of instructions emitted to change,
+	 * we pad the optimized PPC_LI64() call with NOPs to guarantee that
+	 * we always have a five-instruction sequence, which is the maximum
+	 * that PPC_LI64() can emit.
+	 */
+	for (i = ctx->idx - ctx_idx; i < 5; i++)
+		PPC_NOP();
+
 #ifdef PPC64_ELF_ABI_v1
-	/* func points to the function descriptor */
-	PPC_LI64(b2p[TMP_REG_2], func);
-	/* Load actual entry point from function descriptor */
-	PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
-	/* ... and move it to LR */
-	PPC_MTLR(b2p[TMP_REG_1]);
 	/*
 	 * Load TOC from function descriptor at offset 8.
 	 * We can clobber r2 since we get called through a
 	 * function pointer (so caller will save/restore r2)
 	 * and since we don't use a TOC ourself.
 	 */
-	PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
-#else
-	/* We can clobber r12 */
-	PPC_FUNC_ADDR(12, func);
-	PPC_MTLR(12);
+	PPC_BPF_LL(2, 12, 8);
+	/* Load actual entry point from function descriptor */
+	PPC_BPF_LL(12, 12, 0);
 #endif
+
+	PPC_MTLR(12);
 	PPC_BLRL();
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 139/336] PCI: pciehp: Request control of native hotplug only if supported
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 138/336] bpf: powerpc64: pad function address loads with NOPs Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 141/336] mwifiex: correct histogram data with appropriate index Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Mika Westerberg,
	Rafael J. Wysocki, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <mika.westerberg@linux.intel.com>

[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ]

Currently we request control of native PCIe hotplug unconditionally.
Native PCIe hotplug events are handled by the pciehp driver, and if it is
not enabled those events will be lost.

Request control of native PCIe hotplug only if the pciehp driver is
enabled, so we will actually handle native PCIe hotplug events.

Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/pci_root.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -472,9 +472,11 @@ static void negotiate_os_control(struct
 	}
 
 	control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL
-		| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
 		| OSC_PCI_EXPRESS_PME_CONTROL;
 
+	if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
+		control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL;
+
 	if (pci_aer_available()) {
 		if (aer_acpi_firmware_first())
 			dev_info(&device->dev,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 141/336] mwifiex: correct histogram data with appropriate index
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 139/336] PCI: pciehp: Request control of native hotplug only if supported Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 142/336] mt76x2: apply coverage class on slot time too Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xinming Hu, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xinming Hu <huxm@marvell.com>

[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ]

Correct snr/nr/rssi data index to avoid possible buffer underflow.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/util.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifie
 			   s8 nflr)
 {
 	struct mwifiex_histogram_data *phist_data = priv->hist_data;
+	s8 nf   = -nflr;
+	s8 rssi = snr - nflr;
 
 	atomic_inc(&phist_data->num_samples);
 	atomic_inc(&phist_data->rx_rate[rx_rate]);
-	atomic_inc(&phist_data->snr[snr]);
-	atomic_inc(&phist_data->noise_flr[128 + nflr]);
-	atomic_inc(&phist_data->sig_str[nflr - snr]);
+	atomic_inc(&phist_data->snr[snr + 128]);
+	atomic_inc(&phist_data->noise_flr[nf + 128]);
+	atomic_inc(&phist_data->sig_str[rssi + 128]);
 }
 
 /* function to reset histogram data during init/reset */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 142/336] mt76x2: apply coverage class on slot time too
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 141/336] mwifiex: correct histogram data with appropriate index Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 143/336] ima: based on policy verify firmware signatures (pre-allocated buffer) Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luca Bisti, Gaetano Catalli,
	Lorenzo Bianconi, Felix Fietkau, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

[ Upstream commit 0d45d3fe42efc76b6c4f5a62f8d110c7a2e6f83f ]

According to 802.11-2007 17.3.8.6 (slot time), the slot time should
be increased by 3 us * coverage class. Taking into account coverage
class in slot time configuration allows to increase by an order of
magnitude the throughput on a 4Km link in a noisy environment

Tested-by: Luca Bisti <luca.bisti@gmail.com>
Tested-by: Gaetano Catalli <gaetano.catalli@gmail.com>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x2_init.c |    3 +++
 drivers/net/wireless/mediatek/mt76/mt76x2_main.c |    3 +--
 2 files changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
@@ -482,7 +482,10 @@ void mt76x2_set_tx_ackto(struct mt76x2_d
 {
 	u8 ackto, sifs, slottime = dev->slottime;
 
+	/* As defined by IEEE 802.11-2007 17.3.8.6 */
 	slottime += 3 * dev->coverage_class;
+	mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
+		       MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
 
 	sifs = mt76_get_field(dev, MT_XIFS_TIME_CFG,
 			      MT_XIFS_TIME_CFG_OFDM_SIFS);
--- a/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
@@ -247,8 +247,7 @@ mt76x2_bss_info_changed(struct ieee80211
 		int slottime = info->use_short_slot ? 9 : 20;
 
 		dev->slottime = slottime;
-		mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
-			       MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
+		mt76x2_set_tx_ackto(dev);
 	}
 
 	mutex_unlock(&dev->mutex);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 143/336] ima: based on policy verify firmware signatures (pre-allocated buffer)
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 142/336] mt76x2: apply coverage class on slot time too Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:47 ` [PATCH 4.17 144/336] watchdog: renesas-wdt: Add support for the R8A77965 WDT Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Luis R. Rodriguez,
	David Howells, Kees Cook, Serge E. Hallyn, Stephen Boyd,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

[ Upstream commit fd90bc559bfba743ae8de87ff23b92a5e4668062 ]

Don't differentiate, for now, between kernel_read_file_id READING_FIRMWARE
and READING_FIRMWARE_PREALLOC_BUFFER enumerations.

Fixes: a098ecd firmware: support loading into a pre-allocated buffer (since 4.8)
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/ima/ima_main.c |    1 +
 1 file changed, 1 insertion(+)

--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -449,6 +449,7 @@ int ima_read_file(struct file *file, enu
 
 static int read_idmap[READING_MAX_ID] = {
 	[READING_FIRMWARE] = FIRMWARE_CHECK,
+	[READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK,
 	[READING_MODULE] = MODULE_CHECK,
 	[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
 	[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 144/336] watchdog: renesas-wdt: Add support for the R8A77965 WDT
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 143/336] ima: based on policy verify firmware signatures (pre-allocated buffer) Greg Kroah-Hartman
@ 2018-08-01 16:47 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 145/336] drivers/perf: arm-ccn: dont log to dmesg in event_init Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Takeshi Kihara, Wolfram Sang,
	Geert Uytterhoeven, Guenter Roeck, Wim Van Sebroeck, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wolfram Sang <wsa+renesas@sang-engineering.com>

[ Upstream commit b1eb8fedc01499132ced4b2a44b3ab3855c4e681 ]

Document support for the Watchdog Timer (WDT) Controller in the Renesas
R-Car M3-N (R8A77965) SoC. No driver update is needed.

Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
[wsa: rebased to v4.17-rc3]
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/watchdog/renesas-wdt.txt |    1 +
 1 file changed, 1 insertion(+)

--- a/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
@@ -7,6 +7,7 @@ Required properties:
 	         - "renesas,r7s72100-wdt" (RZ/A1)
 	         - "renesas,r8a7795-wdt" (R-Car H3)
 	         - "renesas,r8a7796-wdt" (R-Car M3-W)
+		 - "renesas,r8a77965-wdt" (R-Car M3-N)
 	         - "renesas,r8a77970-wdt" (R-Car V3M)
 	         - "renesas,r8a77995-wdt" (R-Car D3)
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 145/336] drivers/perf: arm-ccn: dont log to dmesg in event_init
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2018-08-01 16:47 ` [PATCH 4.17 144/336] watchdog: renesas-wdt: Add support for the R8A77965 WDT Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 146/336] spi: Add missing pm_runtime_put_noidle() after failed get Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Pawel Moll,
	Will Deacon, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

[ Upstream commit 1898eb61fbc9703efee886d3abec27a388cf28c3 ]

The ARM CCN PMU driver uses dev_warn() to complain about parameters in
the user-provided perf_event_attr. This means that under normal
operation (e.g. a single invocation of the perf tool), a number of
messages warnings may be logged to dmesg.

Tools may issue multiple syscalls to probe for feature support, and
multiple applications (from multiple users) can attempt to open events
simultaneously, so this is not very helpful, even if a user happens to
have access to dmesg. Worse, this can push important information out of
the dmesg ring buffer, and can significantly slow down syscall fuzzers,
vastly increasing the time it takes to find critical bugs.

Demote the dev_warn() instances to dev_dbg(), as is the case for all
other PMU drivers under drivers/perf/. Users who wish to debug PMU event
initialisation can enable dynamic debug to receive these messages.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/perf/arm-ccn.c |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

--- a/drivers/perf/arm-ccn.c
+++ b/drivers/perf/arm-ccn.c
@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct
 	ccn = pmu_to_arm_ccn(event->pmu);
 
 	if (hw->sample_period) {
-		dev_warn(ccn->dev, "Sampling not supported!\n");
+		dev_dbg(ccn->dev, "Sampling not supported!\n");
 		return -EOPNOTSUPP;
 	}
 
@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct
 			event->attr.exclude_kernel || event->attr.exclude_hv ||
 			event->attr.exclude_idle || event->attr.exclude_host ||
 			event->attr.exclude_guest) {
-		dev_warn(ccn->dev, "Can't exclude execution levels!\n");
+		dev_dbg(ccn->dev, "Can't exclude execution levels!\n");
 		return -EINVAL;
 	}
 
 	if (event->cpu < 0) {
-		dev_warn(ccn->dev, "Can't provide per-task data!\n");
+		dev_dbg(ccn->dev, "Can't provide per-task data!\n");
 		return -EOPNOTSUPP;
 	}
 	/*
@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct
 	switch (type) {
 	case CCN_TYPE_MN:
 		if (node_xp != ccn->mn_id) {
-			dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		break;
 	case CCN_TYPE_XP:
 		if (node_xp >= ccn->num_xps) {
-			dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		break;
@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct
 		break;
 	default:
 		if (node_xp >= ccn->num_nodes) {
-			dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) {
-			dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n",
+			dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n",
 					type, node_xp);
 			return -EINVAL;
 		}
@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct
 		if (event_id != e->event)
 			continue;
 		if (e->num_ports && port >= e->num_ports) {
-			dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n",
+			dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n",
 					port, node_xp);
 			return -EINVAL;
 		}
 		if (e->num_vcs && vc >= e->num_vcs) {
-			dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n",
+			dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n",
 					vc, node_xp);
 			return -EINVAL;
 		}
 		valid = 1;
 	}
 	if (!valid) {
-		dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
+		dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
 				event_id, node_xp);
 		return -EINVAL;
 	}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 146/336] spi: Add missing pm_runtime_put_noidle() after failed get
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 145/336] drivers/perf: arm-ccn: dont log to dmesg in event_init Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 147/336] net: hns3: Fix for CMDQ and Misc. interrupt init order problem Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 7e48e23a1f4a50f93ac1073f1326e0a73829b631 ]

If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle().
This is probably not a critical fix as we should only hit this when
things are broken elsewhere.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct s
 	if (!was_busy && ctlr->auto_runtime_pm) {
 		ret = pm_runtime_get_sync(ctlr->dev.parent);
 		if (ret < 0) {
+			pm_runtime_put_noidle(ctlr->dev.parent);
 			dev_err(&ctlr->dev, "Failed to power device: %d\n",
 				ret);
 			mutex_unlock(&ctlr->io_mutex);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 147/336] net: hns3: Fix for CMDQ and Misc. interrupt init order problem
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 146/336] spi: Add missing pm_runtime_put_noidle() after failed get Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 148/336] net: hns3: Fix the missing client list node initialization Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunsheng Lin, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit eddf04626d1d6d0bcd01ac6a287e49f5ddb90a26 ]

When vf module is loading, the cmd queue initialization should
happen before misc interrupt initialization, otherwise the misc
interrupt handle will cause using uninitialized cmd queue problem.
There is also the same issue when vf module is unloading.

This patch fixes it by adjusting the location of some function.

Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |   16 +++++++-------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1631,6 +1631,10 @@ static int hclgevf_init_hdev(struct hclg
 
 	hclgevf_state_init(hdev);
 
+	ret = hclgevf_cmd_init(hdev);
+	if (ret)
+		goto err_cmd_init;
+
 	ret = hclgevf_misc_irq_init(hdev);
 	if (ret) {
 		dev_err(&pdev->dev, "failed(%d) to init Misc IRQ(vector0)\n",
@@ -1638,10 +1642,6 @@ static int hclgevf_init_hdev(struct hclg
 		goto err_misc_irq_init;
 	}
 
-	ret = hclgevf_cmd_init(hdev);
-	if (ret)
-		goto err_cmd_init;
-
 	ret = hclgevf_configure(hdev);
 	if (ret) {
 		dev_err(&pdev->dev, "failed(%d) to fetch configuration\n", ret);
@@ -1689,10 +1689,10 @@ static int hclgevf_init_hdev(struct hclg
 	return 0;
 
 err_config:
-	hclgevf_cmd_uninit(hdev);
-err_cmd_init:
 	hclgevf_misc_irq_uninit(hdev);
 err_misc_irq_init:
+	hclgevf_cmd_uninit(hdev);
+err_cmd_init:
 	hclgevf_state_uninit(hdev);
 	hclgevf_uninit_msi(hdev);
 err_irq_init:
@@ -1702,9 +1702,9 @@ err_irq_init:
 
 static void hclgevf_uninit_hdev(struct hclgevf_dev *hdev)
 {
-	hclgevf_cmd_uninit(hdev);
-	hclgevf_misc_irq_uninit(hdev);
 	hclgevf_state_uninit(hdev);
+	hclgevf_misc_irq_uninit(hdev);
+	hclgevf_cmd_uninit(hdev);
 	hclgevf_uninit_msi(hdev);
 	hclgevf_pci_uninit(hdev);
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 148/336] net: hns3: Fix the missing client list node initialization
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 147/336] net: hns3: Fix for CMDQ and Misc. interrupt init order problem Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 149/336] net: hns3: Fix for hns3 module is loaded multiple times problem Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit 13562d1f5e2fbe2cf33b23a00abca3f71264c4ac ]

This patch fixes the missing initialization of the client list node
in the hnae3_register_client() function.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -3602,6 +3602,8 @@ static int __init hns3_init_module(void)
 
 	client.ops = &client_ops;
 
+	INIT_LIST_HEAD(&client.node);
+
 	ret = hnae3_register_client(&client);
 	if (ret)
 		return ret;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 149/336] net: hns3: Fix for hns3 module is loaded multiple times problem
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 148/336] net: hns3: Fix the missing client list node initialization Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 150/336] fscrypt: use unbound workqueue for decryption Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit 3c7624d8fc0b893b644b945ab904c629ebc9611e ]

If the hns3 driver has been built into kernel and then loaded with
the same driver which built as KLM, it may trigger an error like
below:

[   20.009555] hns3: Hisilicon Ethernet Network Driver for Hip08 Family - version
[   20.016789] hns3: Copyright (c) 2017 Huawei Corporation.
[   20.022100] Error: Driver 'hns3' is already registered, aborting...
[   23.517397] Unable to handle kernel NULL pointer dereference at virtual address 00000000
...
[   23.691583] Process insmod (pid: 1982, stack limit = 0x00000000cd5f21cb)
[   23.698270] Call trace:
[   23.700705]  __list_del_entry_valid+0x2c/0xd8
[   23.705049]  hnae3_unregister_client+0x68/0xa8
[   23.709487]  hns3_init_module+0x98/0x1000 [hns3]
[   23.714093]  do_one_initcall+0x5c/0x170
[   23.717918]  do_init_module+0x64/0x1f4
[   23.721654]  load_module+0x1d14/0x24b0
[   23.725390]  SyS_init_module+0x158/0x208
[   23.729300]  el0_svc_naked+0x30/0x34

This patch fixes it by adding module version info.

Fixes: 38caee9d3ee8 ("net: hns3: Add support of the HNAE3 framework")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hnae3.c               |    1 +
 drivers/net/ethernet/hisilicon/hns3/hnae3.h               |    2 ++
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c           |    1 +
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h           |    2 ++
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h   |    2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h |    2 +-
 6 files changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -283,3 +283,4 @@ EXPORT_SYMBOL(hnae3_unregister_ae_dev);
 MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("HNAE3(Hisilicon Network Acceleration Engine) Framework");
+MODULE_VERSION(HNAE3_MOD_VERSION);
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -36,6 +36,8 @@
 #include <linux/pci.h>
 #include <linux/types.h>
 
+#define HNAE3_MOD_VERSION "1.0"
+
 /* Device IDs */
 #define HNAE3_DEV_ID_GE				0xA220
 #define HNAE3_DEV_ID_25GE			0xA221
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -3631,3 +3631,4 @@ MODULE_DESCRIPTION("HNS3: Hisilicon Ethe
 MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("pci:hns-nic");
+MODULE_VERSION(HNS3_MOD_VERSION);
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -14,6 +14,8 @@
 
 #include "hnae3.h"
 
+#define HNS3_MOD_VERSION "1.0"
+
 extern const char hns3_driver_version[];
 
 enum hns3_nic_state {
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -15,7 +15,7 @@
 #include "hclge_cmd.h"
 #include "hnae3.h"
 
-#define HCLGE_MOD_VERSION "v1.0"
+#define HCLGE_MOD_VERSION "1.0"
 #define HCLGE_DRIVER_NAME "hclge"
 
 #define HCLGE_INVALID_VPORT 0xffff
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
@@ -9,7 +9,7 @@
 #include "hclgevf_cmd.h"
 #include "hnae3.h"
 
-#define HCLGEVF_MOD_VERSION "v1.0"
+#define HCLGEVF_MOD_VERSION "1.0"
 #define HCLGEVF_DRIVER_NAME "hclgevf"
 
 #define HCLGEVF_ROCEE_VECTOR_NUM	0



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 150/336] fscrypt: use unbound workqueue for decryption
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 149/336] net: hns3: Fix for hns3 module is loaded multiple times problem Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 151/336] net: mvpp2: Add missing VLAN tag detection Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Theodore Tso, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit 36dd26e0c8d42699eeba87431246c07c28075bae ]

Improve fscrypt read performance by switching the decryption workqueue
from bound to unbound.  With the bound workqueue, when multiple bios
completed on the same CPU, they were decrypted on that same CPU.  But
with the unbound queue, they are now decrypted in parallel on any CPU.

Although fscrypt read performance can be tough to measure due to the
many sources of variation, this change is most beneficial when
decryption is slow, e.g. on CPUs without AES instructions.  For example,
I timed tarring up encrypted directories on f2fs.  On x86 with AES-NI
instructions disabled, the unbound workqueue improved performance by
about 25-35%, using 1 to NUM_CPUs jobs with 4 or 8 CPUs available.  But
with AES-NI enabled, performance was unchanged to within ~2%.

I also did the same test on a quad-core ARM CPU using xts-speck128-neon
encryption.  There performance was usually about 10% better with the
unbound workqueue, bringing it closer to the unencrypted speed.

The unbound workqueue may be worse in some cases due to worse locality,
but I think it's still the better default.  dm-crypt uses an unbound
workqueue by default too, so this change makes fscrypt match.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/crypto/crypto.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -427,8 +427,17 @@ fail:
  */
 static int __init fscrypt_init(void)
 {
+	/*
+	 * Use an unbound workqueue to allow bios to be decrypted in parallel
+	 * even when they happen to complete on the same CPU.  This sacrifices
+	 * locality, but it's worthwhile since decryption is CPU-intensive.
+	 *
+	 * Also use a high-priority workqueue to prioritize decryption work,
+	 * which blocks reads from completing, over regular application tasks.
+	 */
 	fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue",
-							WQ_HIGHPRI, 0);
+						 WQ_UNBOUND | WQ_HIGHPRI,
+						 num_online_cpus());
 	if (!fscrypt_read_workqueue)
 		goto fail;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 151/336] net: mvpp2: Add missing VLAN tag detection
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 150/336] fscrypt: use unbound workqueue for decryption Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 152/336] scsi: ufs: ufshcd: fix possible unclocked register access Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Chevallier, David S. Miller,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maxime Chevallier <maxime.chevallier@bootlin.com>

[ Upstream commit 62c8a069b510d905039abd4097434f190a316941 ]

Marvell PPv2 Header Parser sets some bits in the 'result_info' field in
each lookup iteration, to identify different packet attributes such as
DSA / VLAN tag, protocol infos, etc. This is used in further
classification stages in the controller.

It's the DSA tag detection entry that is in charge of detecting when there
is a single VLAN tag.

This commits adds the missing update of the result_info in this case.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/marvell/mvpp2.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -2109,6 +2109,9 @@ static void mvpp2_prs_dsa_tag_set(struct
 				mvpp2_prs_sram_ai_update(&pe, 0,
 							MVPP2_PRS_SRAM_AI_MASK);
 
+			/* Set result info bits to 'single vlan' */
+			mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_VLAN_SINGLE,
+						 MVPP2_PRS_RI_VLAN_MASK);
 			/* If packet is tagged continue check vid filtering */
 			mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_VID);
 		} else {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 152/336] scsi: ufs: ufshcd: fix possible unclocked register access
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 151/336] net: mvpp2: Add missing VLAN tag detection Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 153/336] scsi: ufs: fix exception event handling Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subhash Jadavani,
	Venkat Gopalakrishnan, Can Guo, Asutosh Das, Martin K. Petersen,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Subhash Jadavani <subhashj@codeaurora.org>

[ Upstream commit b334456ec2021b1addc19806990115e69ec4ac32 ]

Vendor specific setup_clocks ops may depend on clocks managed by ufshcd
driver so if the vendor specific setup_clocks callback is called when
the required clocks are turned off, it results into unclocked register
access.

This change make sure that required clocks are enabled before vendor
specific setup_clocks callback is called.

Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/ufs/ufshcd.c |   26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -6799,9 +6799,16 @@ static int __ufshcd_setup_clocks(struct
 	if (list_empty(head))
 		goto out;
 
-	ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
-	if (ret)
-		return ret;
+	/*
+	 * vendor specific setup_clocks ops may depend on clocks managed by
+	 * this standard driver hence call the vendor specific setup_clocks
+	 * before disabling the clocks managed here.
+	 */
+	if (!on) {
+		ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
+		if (ret)
+			return ret;
+	}
 
 	list_for_each_entry(clki, head, list) {
 		if (!IS_ERR_OR_NULL(clki->clk)) {
@@ -6825,9 +6832,16 @@ static int __ufshcd_setup_clocks(struct
 		}
 	}
 
-	ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
-	if (ret)
-		return ret;
+	/*
+	 * vendor specific setup_clocks ops may depend on clocks managed by
+	 * this standard driver hence call the vendor specific setup_clocks
+	 * after enabling the clocks managed here.
+	 */
+	if (on) {
+		ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
+		if (ret)
+			return ret;
+	}
 
 out:
 	if (ret) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 153/336] scsi: ufs: fix exception event handling
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 152/336] scsi: ufs: ufshcd: fix possible unclocked register access Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 154/336] scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subhash Jadavani, Maya Erez, Can Guo,
	Asutosh Das, Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maya Erez <merez@codeaurora.org>

[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ]

The device can set the exception event bit in one of the response UPIU,
for example to notify the need for urgent BKOPs operation.  In such a
case, the host driver calls ufshcd_exception_event_handler to handle
this notification.  When trying to check the exception event status (for
finding the cause for the exception event), the device may be busy with
additional SCSI commands handling and may not respond within the 100ms
timeout.

To prevent that, we need to block SCSI commands during handling of
exception events and allow retransmissions of the query requests, in
case of timeout.

Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Reviewed-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/ufs/ufshcd.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -4969,6 +4969,7 @@ static void ufshcd_exception_event_handl
 	hba = container_of(work, struct ufs_hba, eeh_work);
 
 	pm_runtime_get_sync(hba->dev);
+	scsi_block_requests(hba->host);
 	err = ufshcd_get_ee_status(hba, &status);
 	if (err) {
 		dev_err(hba->dev, "%s: failed to get exception status %d\n",
@@ -4982,6 +4983,7 @@ static void ufshcd_exception_event_handl
 		ufshcd_bkops_exception_event_handler(hba);
 
 out:
+	scsi_unblock_requests(hba->host);
 	pm_runtime_put_sync(hba->dev);
 	return;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 154/336] scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 153/336] scsi: ufs: fix exception event handling Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 155/336] drm/nouveau: remove fence wait code from deferred client work handler Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steffen Maier, Jens Remus,
	Benjamin Block, Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jens Remus <jremus@linux.ibm.com>

[ Upstream commit 9e156c54ace310ce7fb1cd960e62416947f3d47c ]

Otherwise iterating with list_for_each() over the adapter->erp_ready_head
and adapter->erp_running_head lists can lead to an infinite loop. See commit
"zfcp: fix infinite iteration on erp_ready_head list".

The run-time check is only performed for debug kernels which have the kernel
lock validator enabled. Following is an example of the warning that is
reported, if the ERP lock is not held when calling zfcp_dbf_rec_trig():

WARNING: CPU: 0 PID: 604 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x172/0x188
Modules linked in: ...
CPU: 0 PID: 604 Comm: kworker/u128:3 Not tainted 4.16.0-... #1
Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
Workqueue: zfcp_q_0.0.1906 zfcp_scsi_rport_work
Krnl PSW : 00000000330fdbf9 00000000367e9728 (zfcp_dbf_rec_trig+0x172/0x188)
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
Krnl GPRS: 00000000c57a5d99 3288200000000000 0000000000000000 000000006cc82740
           00000000009d09d6 0000000000000000 00000000000000ff 0000000000000000
           0000000000000000 0000000000e1b5fe 000000006de01d38 0000000076130958
           000000006cc82548 000000006de01a98 00000000009d09d6 000000006a6d3c80
Krnl Code: 00000000009d0ad2: eb7ff0b80004        lmg        %r7,%r15,184(%r15)
           00000000009d0ad8: c0f4000d7dd0        brcl       15,b80678
          #00000000009d0ade: a7f40001            brc        15,9d0ae0
          >00000000009d0ae2: a7f4ff7d            brc        15,9d09dc
           00000000009d0ae6: e340f0f00004        lg         %r4,240(%r15)
           00000000009d0aec: eb7ff0b80004        lmg        %r7,%r15,184(%r15)
           00000000009d0af2: 07f4                bcr        15,%r4
           00000000009d0af4: 0707                bcr        0,%r7
Call Trace:
([<00000000009d09d6>] zfcp_dbf_rec_trig+0x66/0x188)
 [<00000000009dd740>] zfcp_scsi_rport_work+0x98/0x190
 [<0000000000169b34>] process_one_work+0x3d4/0x6f8
 [<000000000016a08a>] worker_thread+0x232/0x418
 [<000000000017219e>] kthread+0x166/0x178
 [<0000000000b815ea>] kernel_thread_starter+0x6/0xc
 [<0000000000b815e4>] kernel_thread_starter+0x0/0xc
2 locks held by kworker/u128:3/604:
 #0:  ((wq_completion)name){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
 #1:  ((work_completion)(&port->rport_work)){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
Last Breaking-Event-Address:
 [<00000000009d0ade>] zfcp_dbf_rec_trig+0x16e/0x188
---[ end trace b2f4020572e2c124 ]---

Suggested-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jens Remus <jremus@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/scsi/zfcp_dbf.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct
 	struct list_head *entry;
 	unsigned long flags;
 
+	lockdep_assert_held(&adapter->erp_lock);
+
 	if (unlikely(!debug_level_enabled(dbf->rec, level)))
 		return;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 155/336] drm/nouveau: remove fence wait code from deferred client work handler
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 154/336] scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 156/336] drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

[ Upstream commit 11e451e74050d9e9030581ce40337838acfcea5b ]

Fences attached to deferred client work items now originate from channels
belonging to the client, meaning we can be certain they've been signalled
before we destroy a client.

This closes a race that could happen if the dma_fence_wait_timeout() call
didn't succeed.  When the fence was later signalled, a use-after-free was
possible.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/nouveau_drm.c |   30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -116,24 +116,22 @@ nouveau_name(struct drm_device *dev)
 }
 
 static inline bool
-nouveau_cli_work_ready(struct dma_fence *fence, bool wait)
+nouveau_cli_work_ready(struct dma_fence *fence)
 {
-	if (!dma_fence_is_signaled(fence)) {
-		if (!wait)
-			return false;
-		WARN_ON(dma_fence_wait_timeout(fence, false, 2 * HZ) <= 0);
-	}
+	if (!dma_fence_is_signaled(fence))
+		return false;
 	dma_fence_put(fence);
 	return true;
 }
 
 static void
-nouveau_cli_work_flush(struct nouveau_cli *cli, bool wait)
+nouveau_cli_work(struct work_struct *w)
 {
+	struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
 	struct nouveau_cli_work *work, *wtmp;
 	mutex_lock(&cli->lock);
 	list_for_each_entry_safe(work, wtmp, &cli->worker, head) {
-		if (!work->fence || nouveau_cli_work_ready(work->fence, wait)) {
+		if (!work->fence || nouveau_cli_work_ready(work->fence)) {
 			list_del(&work->head);
 			work->func(work);
 		}
@@ -162,16 +160,16 @@ nouveau_cli_work_queue(struct nouveau_cl
 }
 
 static void
-nouveau_cli_work(struct work_struct *w)
-{
-	struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
-	nouveau_cli_work_flush(cli, false);
-}
-
-static void
 nouveau_cli_fini(struct nouveau_cli *cli)
 {
-	nouveau_cli_work_flush(cli, true);
+	/* All our channels are dead now, which means all the fences they
+	 * own are signalled, and all callback functions have been called.
+	 *
+	 * So, after flushing the workqueue, there should be nothing left.
+	 */
+	flush_work(&cli->work);
+	WARN_ON(!list_empty(&cli->worker));
+
 	usif_client_fini(cli);
 	nouveau_vmm_fini(&cli->vmm);
 	nvif_mmu_fini(&cli->mmu);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 156/336] drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 155/336] drm/nouveau: remove fence wait code from deferred client work handler Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 157/336] drm/nouveau/fifo/gk104-: poll for runlist update completion Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

[ Upstream commit 19ca10d82e33bcfe92412c461fc3534ec1e14747 ]

We previously only did this for push buffers, but an upcoming patch will
need to attach fences to all VMAs to resolve another issue.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/nouveau_dma.c |   10 +---------
 drivers/gpu/drm/nouveau/nouveau_dma.h |    5 ++---
 drivers/gpu/drm/nouveau/nouveau_gem.c |   19 ++++++++++++++++---
 3 files changed, 19 insertions(+), 15 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -80,18 +80,10 @@ READ_GET(struct nouveau_channel *chan, u
 }
 
 void
-nv50_dma_push(struct nouveau_channel *chan, struct nouveau_bo *bo,
-	      int delta, int length)
+nv50_dma_push(struct nouveau_channel *chan, u64 offset, int length)
 {
-	struct nouveau_cli *cli = (void *)chan->user.client;
 	struct nouveau_bo *pb = chan->push.buffer;
-	struct nouveau_vma *vma;
 	int ip = (chan->dma.ib_put * 2) + chan->dma.ib_base;
-	u64 offset;
-
-	vma = nouveau_vma_find(bo, &cli->vmm);
-	BUG_ON(!vma);
-	offset = vma->addr + delta;
 
 	BUG_ON(chan->dma.ib_free < 1);
 
--- a/drivers/gpu/drm/nouveau/nouveau_dma.h
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.h
@@ -31,8 +31,7 @@
 #include "nouveau_chan.h"
 
 int nouveau_dma_wait(struct nouveau_channel *, int slots, int size);
-void nv50_dma_push(struct nouveau_channel *, struct nouveau_bo *,
-		   int delta, int length);
+void nv50_dma_push(struct nouveau_channel *, u64 addr, int length);
 
 /*
  * There's a hw race condition where you can't jump to your PUT offset,
@@ -151,7 +150,7 @@ FIRE_RING(struct nouveau_channel *chan)
 	chan->accel_done = true;
 
 	if (chan->dma.ib_max) {
-		nv50_dma_push(chan, chan->push.buffer, chan->dma.put << 2,
+		nv50_dma_push(chan, chan->push.addr + (chan->dma.put << 2),
 			      (chan->dma.cur - chan->dma.put) << 2);
 	} else {
 		WRITE_PUT(chan->dma.cur);
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -432,7 +432,20 @@ retry:
 			}
 		}
 
-		b->user_priv = (uint64_t)(unsigned long)nvbo;
+		if (cli->vmm.vmm.object.oclass >= NVIF_CLASS_VMM_NV50) {
+			struct nouveau_vmm *vmm = &cli->vmm;
+			struct nouveau_vma *vma = nouveau_vma_find(nvbo, vmm);
+			if (!vma) {
+				NV_PRINTK(err, cli, "vma not found!\n");
+				ret = -EINVAL;
+				break;
+			}
+
+			b->user_priv = (uint64_t)(unsigned long)vma;
+		} else {
+			b->user_priv = (uint64_t)(unsigned long)nvbo;
+		}
+
 		nvbo->reserved_by = file_priv;
 		nvbo->pbbo_index = i;
 		if ((b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
@@ -763,10 +776,10 @@ nouveau_gem_ioctl_pushbuf(struct drm_dev
 		}
 
 		for (i = 0; i < req->nr_push; i++) {
-			struct nouveau_bo *nvbo = (void *)(unsigned long)
+			struct nouveau_vma *vma = (void *)(unsigned long)
 				bo[push[i].bo_index].user_priv;
 
-			nv50_dma_push(chan, nvbo, push[i].offset,
+			nv50_dma_push(chan, vma->addr + push[i].offset,
 				      push[i].length);
 		}
 	} else



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 157/336] drm/nouveau/fifo/gk104-: poll for runlist update completion
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 156/336] drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48   ` Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Skeggs, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

[ Upstream commit 4f2fc25c0f8bcc8db1b8a7b21e88c3d7f35c5acb ]

Newer HW doesn't appear to send this event, which will cause long delays
in runlist updates if they don't complete immediately.

RM doesn't use these events anywhere, and an NVGPU commit message notes
that polling is the preferred method even on HW that supports the event.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_f
 				    (target << 28));
 	nvkm_wr32(device, 0x002274, (runl << 20) | nr);
 
-	if (wait_event_timeout(fifo->runlist[runl].wait,
-			       !(nvkm_rd32(device, 0x002284 + (runl * 0x08))
-				       & 0x00100000),
-			       msecs_to_jiffies(2000)) == 0)
+	if (nvkm_msec(device, 2000,
+		if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000))
+			break;
+	) < 0)
 		nvkm_error(subdev, "runlist %d update timeout\n", runl);
 unlock:
 	mutex_unlock(&subdev->mutex);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 158/336] Bluetooth: btusb: add ID for LiteOn 04ca:301a
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
@ 2018-08-01 16:48   ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
                     ` (310 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vic Wei, Matthias Kaehlcke,
	Marcel Holtmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vic Wei <vwei@codeaurora.org>

[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ]

Contains a QCA6174A chipset, with USB BT. Let's support loading
firmware on it.

>From usb-devices:
T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=301a Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: Vic Wei <vwei@codeaurora.org>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/btusb.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -276,6 +276,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
+	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 158/336] Bluetooth: btusb: add ID for LiteOn 04ca:301a
@ 2018-08-01 16:48   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vic Wei, Matthias Kaehlcke,
	Marcel Holtmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vic Wei <vwei@codeaurora.org>

[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ]

Contains a QCA6174A chipset, with USB BT. Let's support loading
firmware on it.

>>From usb-devices:
T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=301a Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: Vic Wei <vwei@codeaurora.org>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/btusb.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -276,6 +276,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
+	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 159/336] rtc: tps6586x: fix possible race condition
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2018-08-01 16:48   ` Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 160/336] rtc: vr41xx: " Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 63d22063073b0ab46d1e06fe633fb5de8f5c58e1 ]

The probe function is not allowed to fail after the RTC is registered
because the following may happen:

CPU0:                                CPU1:
sys_load_module()
 do_init_module()
  do_one_initcall()
   cmos_do_probe()
    rtc_device_register()
     __register_chrdev()
     cdev->owner = struct module*
                                     open("/dev/rtc0")
    rtc_device_unregister()
  module_put()
  free_module()
   module_free(mod->module_core)
   /* struct module *module is now
      freed */
                                      chrdev_open()
                                       spin_lock(cdev_lock)
                                       cdev_get()
                                        try_module_get()
                                         module_is_live()
                                         /* dereferences already
                                            freed struct module* */

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/rtc-tps6586x.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/drivers/rtc/rtc-tps6586x.c
+++ b/drivers/rtc/rtc-tps6586x.c
@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct pla
 	device_init_wakeup(&pdev->dev, 1);
 
 	platform_set_drvdata(pdev, rtc);
-	rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev),
-				       &tps6586x_rtc_ops, THIS_MODULE);
+	rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
 	if (IS_ERR(rtc->rtc)) {
 		ret = PTR_ERR(rtc->rtc);
-		dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
+		dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret);
 		goto fail_rtc_register;
 	}
 
+	rtc->rtc->ops = &tps6586x_rtc_ops;
+
 	ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL,
 				tps6586x_rtc_irq,
 				IRQF_ONESHOT,
@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct pla
 		goto fail_rtc_register;
 	}
 	disable_irq(rtc->irq);
+
+	ret = rtc_register_device(rtc->rtc);
+	if (ret) {
+		dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
+		goto fail_rtc_register;
+	}
+
 	return 0;
 
 fail_rtc_register:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 160/336] rtc: vr41xx: fix possible race condition
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 159/336] rtc: tps6586x: fix possible race condition Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 161/336] rtc: tps65910: " Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 9a99247c9c1d1c95c6e8153d013979aac6111c6e ]

The probe function is not allowed to fail after the RTC is registered
because the following may happen:

CPU0:                                CPU1:
sys_load_module()
 do_init_module()
  do_one_initcall()
   cmos_do_probe()
    rtc_device_register()
     __register_chrdev()
     cdev->owner = struct module*
                                     open("/dev/rtc0")
    rtc_device_unregister()
  module_put()
  free_module()
   module_free(mod->module_core)
   /* struct module *module is now
      freed */
                                      chrdev_open()
                                       spin_lock(cdev_lock)
                                       cdev_get()
                                        try_module_get()
                                         module_is_live()
                                         /* dereferences already
                                            freed struct module* */

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/rtc-vr41xx.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_dev
 		goto err_rtc1_iounmap;
 	}
 
-	rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops,
-					THIS_MODULE);
+	rtc = devm_rtc_allocate_device(&pdev->dev);
 	if (IS_ERR(rtc)) {
 		retval = PTR_ERR(rtc);
 		goto err_iounmap_all;
 	}
 
+	rtc->ops = &vr41xx_rtc_ops;
+
 	rtc->max_user_freq = MAX_PERIODIC_RATE;
 
 	spin_lock_irq(&rtc_lock);
@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_dev
 
 	dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n");
 
+	retval = rtc_register_device(rtc);
+	if (retval)
+		goto err_iounmap_all;
+
 	return 0;
 
 err_iounmap_all:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 161/336] rtc: tps65910: fix possible race condition
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 160/336] rtc: vr41xx: " Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 162/336] ALSA: emu10k1: Rate-limit error messages about page errors Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit e6000a438e534ee0afd9e83b67f4e23a26dd1067 ]

The IRQ is requested before the struct rtc is allocated and registered, but
this struct is used in the IRQ handler. This may lead to a NULL pointer
dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
before requesting the IRQ.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/rtc-tps65910.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/rtc/rtc-tps65910.c
+++ b/drivers/rtc/rtc-tps65910.c
@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct pla
 	if (!tps_rtc)
 		return -ENOMEM;
 
+	tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
+	if (IS_ERR(tps_rtc->rtc))
+		return PTR_ERR(tps_rtc->rtc);
+
 	/* Clear pending interrupts */
 	ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg);
 	if (ret < 0)
@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct pla
 	tps_rtc->irq = irq;
 	device_set_wakeup_capable(&pdev->dev, 1);
 
-	tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
-		&tps65910_rtc_ops, THIS_MODULE);
-	if (IS_ERR(tps_rtc->rtc)) {
-		ret = PTR_ERR(tps_rtc->rtc);
+	tps_rtc->rtc->ops = &tps65910_rtc_ops;
+
+	ret = rtc_register_device(tps_rtc->rtc);
+	if (ret) {
 		dev_err(&pdev->dev, "RTC device register: err %d\n", ret);
 		return ret;
 	}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 162/336] ALSA: emu10k1: Rate-limit error messages about page errors
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 161/336] rtc: tps65910: " Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 163/336] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ]

The error messages at sanity checks of memory pages tend to repeat too
many times once when it hits, and without the rate limit, it may flood
and become unreadable.  Replace such messages with the *_ratelimited()
variant.

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/emu10k1/memory.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/pci/emu10k1/memory.c
+++ b/sound/pci/emu10k1/memory.c
@@ -248,13 +248,13 @@ __found_pages:
 static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr)
 {
 	if (addr & ~emu->dma_mask) {
-		dev_err(emu->card->dev,
+		dev_err_ratelimited(emu->card->dev,
 			"max memory size is 0x%lx (addr = 0x%lx)!!\n",
 			emu->dma_mask, (unsigned long)addr);
 		return 0;
 	}
 	if (addr & (EMUPAGESIZE-1)) {
-		dev_err(emu->card->dev, "page is not aligned\n");
+		dev_err_ratelimited(emu->card->dev, "page is not aligned\n");
 		return 0;
 	}
 	return 1;
@@ -345,7 +345,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10
 		else
 			addr = snd_pcm_sgbuf_get_addr(substream, ofs);
 		if (! is_valid_page(emu, addr)) {
-			dev_err(emu->card->dev,
+			dev_err_ratelimited(emu->card->dev,
 				"emu: failure page = %d\n", idx);
 			mutex_unlock(&hdr->block_mutex);
 			return NULL;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 163/336] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 162/336] ALSA: emu10k1: Rate-limit error messages about page errors Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 164/336] md/raid1: add error handling of read error from FailFast device Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anson Huang, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anson Huang <Anson.Huang@nxp.com>

[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ]

If is_enabled() is not defined, regulator core will assume
this regulator is already enabled, then it can NOT be really
enabled after disabled.

Based on Li Jun's patch from the NXP kernel tree.

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/regulator/pfuze100-regulator.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze1
 static const struct regulator_ops pfuze100_swb_regulator_ops = {
 	.enable = regulator_enable_regmap,
 	.disable = regulator_disable_regmap,
+	.is_enabled = regulator_is_enabled_regmap,
 	.list_voltage = regulator_list_voltage_table,
 	.map_voltage = regulator_map_voltage_ascend,
 	.set_voltage_sel = regulator_set_voltage_sel_regmap,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 164/336] md/raid1: add error handling of read error from FailFast device
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 163/336] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 165/336] md: fix NULL dereference of mddev->pers in remove_and_add_spares() Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gioh Kim, Jack Wang, Shaohua Li, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gioh Kim <gi-oh.kim@profitbricks.com>

[ Upstream commit b33d10624fdc15cdf1495f3f00481afccec76783 ]

Current handle_read_error() function calls fix_read_error()
only if md device is RW and rdev does not include FailFast flag.
It does not handle a read error from a RW device including
FailFast flag.

I am not sure it is intended. But I found that write IO error
sets rdev faulty. The md module should handle the read IO error and
write IO error equally. So I think read IO error should set rdev faulty.

Signed-off-by: Gioh Kim <gi-oh.kim@profitbricks.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid1.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2474,6 +2474,8 @@ static void handle_read_error(struct r1c
 		fix_read_error(conf, r1_bio->read_disk,
 			       r1_bio->sector, r1_bio->sectors);
 		unfreeze_array(conf);
+	} else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) {
+		md_error(mddev, rdev);
 	} else {
 		r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED;
 	}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 165/336] md: fix NULL dereference of mddev->pers in remove_and_add_spares()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 164/336] md/raid1: add error handling of read error from FailFast device Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 166/336] ixgbevf: fix MAC address changes through ixgbevf_set_mac() Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yufen Yu, Shaohua Li, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yufen Yu <yuyufen@huawei.com>

[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ]

We met NULL pointer BUG as follow:

[  151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060
[  151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0
[  151.762039] Oops: 0000 [#1] SMP PTI
[  151.762406] Modules linked in:
[  151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238
[  151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
[  151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0
[  151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246
[  151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000
[  151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000
[  151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051
[  151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600
[  151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000
[  151.769160] FS:  00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000
[  151.769971] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0
[  151.771272] Call Trace:
[  151.771542]  md_ioctl+0x1df2/0x1e10
[  151.771906]  ? __switch_to+0x129/0x440
[  151.772295]  ? __schedule+0x244/0x850
[  151.772672]  blkdev_ioctl+0x4bd/0x970
[  151.773048]  block_ioctl+0x39/0x40
[  151.773402]  do_vfs_ioctl+0xa4/0x610
[  151.773770]  ? dput.part.23+0x87/0x100
[  151.774151]  ksys_ioctl+0x70/0x80
[  151.774493]  __x64_sys_ioctl+0x16/0x20
[  151.774877]  do_syscall_64+0x5b/0x180
[  151.775258]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

For raid6, when two disk of the array are offline, two spare disks can
be added into the array. Before spare disks recovery completing,
system reboot and mdadm thinks it is ok to restart the degraded
array by md_ioctl(). Since disks in raid6 is not only_parity(),
raid5_run() will abort, when there is no PPL feature or not setting
'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL.

But, mddev->raid_disks has been set and it will not be cleared when
raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to
remove a disk by mdadm, which will cause NULL pointer dereference
in remove_and_add_spares() finally.

Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6525,6 +6525,9 @@ static int hot_remove_disk(struct mddev
 	char b[BDEVNAME_SIZE];
 	struct md_rdev *rdev;
 
+	if (!mddev->pers)
+		return -ENODEV;
+
 	rdev = find_rdev(mddev, dev);
 	if (!rdev)
 		return -ENXIO;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 166/336] ixgbevf: fix MAC address changes through ixgbevf_set_mac()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 165/336] md: fix NULL dereference of mddev->pers in remove_and_add_spares() Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 167/336] gpu: host1x: Acquire a reference to the IOVA cache Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Emil Tantilov, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Emil Tantilov <emil.s.tantilov@intel.com>

[ Upstream commit 6e7d0ba1e59b1a306761a731e67634c0f2efea2a ]

Set hw->mac.perm_addr in ixgbevf_set_mac() in order to avoid losing the
custom MAC on reset. This can happen in the following case:

>ip link set $vf address $mac
>ethtool -r $vf

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -4187,6 +4187,7 @@ static int ixgbevf_set_mac(struct net_de
 		return -EPERM;
 
 	ether_addr_copy(hw->mac.addr, addr->sa_data);
+	ether_addr_copy(hw->mac.perm_addr, addr->sa_data);
 	ether_addr_copy(netdev->dev_addr, addr->sa_data);
 
 	return 0;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 167/336] gpu: host1x: Acquire a reference to the IOVA cache
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 166/336] ixgbevf: fix MAC address changes through ixgbevf_set_mac() Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 168/336] media: smiapp: fix timeout checking in smiapp_read_nvm Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thierry Reding <treding@nvidia.com>

[ Upstream commit f40e1590c5270e5559fb95a5a0a7c1f5266a522d ]

The IOVA API uses a memory cache to allocate IOVA nodes from. To make
sure that this cache is available, obtain a reference to it and release
the reference when the cache is no longer needed.

On 64-bit ARM this is hidden by the fact that the DMA mapping API gets
that reference and never releases it. On 32-bit ARM, this is papered
over by the Tegra DRM driver (the sole user of the host1x API requiring
the cache) acquiring a reference to the IOVA cache for its own purposes.
However, there may be additional users of this API in the future, so fix
this upfront to avoid surprises.

Fixes: 404bfb78daf3 ("gpu: host1x: Add IOMMU support")
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/host1x/dev.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -223,10 +223,14 @@ static int host1x_probe(struct platform_
 		struct iommu_domain_geometry *geometry;
 		unsigned long order;
 
+		err = iova_cache_get();
+		if (err < 0)
+			goto put_group;
+
 		host->domain = iommu_domain_alloc(&platform_bus_type);
 		if (!host->domain) {
 			err = -ENOMEM;
-			goto put_group;
+			goto put_cache;
 		}
 
 		err = iommu_attach_group(host->domain, host->group);
@@ -234,6 +238,7 @@ static int host1x_probe(struct platform_
 			if (err == -ENODEV) {
 				iommu_domain_free(host->domain);
 				host->domain = NULL;
+				iova_cache_put();
 				iommu_group_put(host->group);
 				host->group = NULL;
 				goto skip_iommu;
@@ -308,6 +313,9 @@ fail_detach_device:
 fail_free_domain:
 	if (host->domain)
 		iommu_domain_free(host->domain);
+put_cache:
+	if (host->group)
+		iova_cache_put();
 put_group:
 	iommu_group_put(host->group);
 
@@ -328,6 +336,7 @@ static int host1x_remove(struct platform
 		put_iova_domain(&host->iova);
 		iommu_detach_group(host->domain, host->group);
 		iommu_domain_free(host->domain);
+		iova_cache_put();
 		iommu_group_put(host->group);
 	}
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 168/336] media: smiapp: fix timeout checking in smiapp_read_nvm
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 167/336] gpu: host1x: Acquire a reference to the IOVA cache Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 169/336] PCI/DPC: Clear interrupt status in interrupt handler top half Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ]

The current code decrements the timeout counter i and the end of
each loop i is incremented, so the check for timeout will always
be false and hence the timeout mechanism is just a dead code path.
Potentially, if the RD_READY bit is not set, we could end up in
an infinite loop.

Fix this so the timeout starts from 1000 and decrements to zero,
if at the end of the loop i is zero we have a timeout condition.

Detected by CoverityScan, CID#1324008 ("Logically dead code")

Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/i2c/smiapp/smiapp-core.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp
 		if (rval)
 			goto out;
 
-		for (i = 0; i < 1000; i++) {
+		for (i = 1000; i > 0; i--) {
 			rval = smiapp_read(
 				sensor,
 				SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s);
@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp
 			if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
 				break;
 
-			if (--i == 0) {
-				rval = -ETIMEDOUT;
-				goto out;
-			}
-
+		}
+		if (!i) {
+			rval = -ETIMEDOUT;
+			goto out;
 		}
 
 		for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 169/336] PCI/DPC: Clear interrupt status in interrupt handler top half
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 168/336] media: smiapp: fix timeout checking in smiapp_read_nvm Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 171/336] net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oza Pawandeep, Bjorn Helgaas,
	Keith Busch, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oza Pawandeep <poza@codeaurora.org>

[ Upstream commit 56abbf8ad73c89d0a4c3c84b1449ceaaabd1b8c7 ]

The generic IRQ handling code ensures that an interrupt handler runs with
its interrupt masked or disabled.  If the interrupt is level-triggered, the
interrupt handler must tell its device to stop asserting the interrupt
before returning.  If it doesn't, we will immediately take the interrupt
again when the handler returns and the generic code unmasks the interrupt.

The driver doesn't know whether its interrupt is edge- or level-triggered,
so it must clear its interrupt source directly in its interrupt handler.

Previously we cleared the DPC interrupt status in the bottom half, i.e., in
deferred work, which can cause an interrupt storm if the DPC interrupt
happens to be level-triggered, e.g., if we're using INTx instead of MSI.

Clear the DPC interrupt status bit in the interrupt handler, not in the
deferred work.

Signed-off-by: Oza Pawandeep <poza@codeaurora.org>
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pcie/dpc.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/pci/pcie/dpc.c
+++ b/drivers/pci/pcie/dpc.c
@@ -113,7 +113,7 @@ static void dpc_work(struct work_struct
 	}
 
 	pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
-		PCI_EXP_DPC_STATUS_TRIGGER | PCI_EXP_DPC_STATUS_INTERRUPT);
+			      PCI_EXP_DPC_STATUS_TRIGGER);
 
 	pci_read_config_word(pdev, cap + PCI_EXP_DPC_CTL, &ctl);
 	pci_write_config_word(pdev, cap + PCI_EXP_DPC_CTL,
@@ -223,6 +223,9 @@ static irqreturn_t dpc_irq(int irq, void
 	if (dpc->rp_extensions && reason == 3 && ext_reason == 0)
 		dpc_process_rp_pio_error(dpc);
 
+	pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
+			      PCI_EXP_DPC_STATUS_INTERRUPT);
+
 	schedule_work(&dpc->work);
 
 	return IRQ_HANDLED;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 171/336] net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 169/336] PCI/DPC: Clear interrupt status in interrupt handler top half Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 172/336] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Grygorii Strashko, Sekhar Nori,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Grygorii Strashko <grygorii.strashko@ti.com>

[ Upstream commit c6213eb1aee308e67377fd1890d84f7284caf531 ]

This fixes klockworks warnings: Pointer 'dev' returned from call to
function 'bus_find_device' at line 179 may be NULL and will be dereferenced
at line 181.

    cpsw-phy-sel.c:179: 'dev' is assigned the return value from function 'bus_find_device'.
    bus.c:342: 'bus_find_device' explicitly returns a NULL value.
    cpsw-phy-sel.c:181: 'dev' is dereferenced by passing argument 1 to function 'dev_get_drvdata'.
    device.h:1024: 'dev' is passed to function 'dev_get_drvdata'.
    device.h:1026: 'dev' is explicitly dereferenced.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
[nsekhar@ti.com: add an error message, fix return path]
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ti/cpsw-phy-sel.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, ph
 	}
 
 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
-	of_node_put(node);
+	if (!dev) {
+		dev_err(dev, "unable to find platform device for %pOF\n", node);
+		goto out;
+	}
+
 	priv = dev_get_drvdata(dev);
 
 	priv->cpsw_phy_sel(priv, phy_mode, slave);
 
 	put_device(dev);
+out:
+	of_node_put(node);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 172/336] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 171/336] net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 173/336] net: hns3: Fix for fiber link up problem Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ]

retire_capture_urb() may print warning messages when the given URB
doesn't align, and this may flood the system log easily.
Put the rate limit to the message for avoiding it.

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct sn
 		if (bytes % (runtime->sample_bits >> 3) != 0) {
 			int oldbytes = bytes;
 			bytes = frames * stride;
-			dev_warn(&subs->dev->dev,
+			dev_warn_ratelimited(&subs->dev->dev,
 				 "Corrected urb data len. %d->%d\n",
 							oldbytes, bytes);
 		}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 173/336] net: hns3: Fix for fiber link up problem
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 172/336] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 175/336] media: staging: atomisp: Comment out several unused sensor resolutions Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunsheng Lin, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit be8d8cdb8ebf3afd841c109dd035fd789a0c7d53 ]

When hclge_ae_start is called, hdev->hw.mac.link may be set
to one after up/down multi-times, which does not correspond to
the link state of netdev when the netdev is up.

This fixes it by setting hdev->hw.mac.link to zero when
hclge_ae_start is called.

Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3783,6 +3783,7 @@ static int hclge_ae_start(struct hnae3_h
 	hclge_cfg_mac_mode(hdev, true);
 	clear_bit(HCLGE_STATE_DOWN, &hdev->state);
 	mod_timer(&hdev->service_timer, jiffies + HZ);
+	hdev->hw.mac.link = 0;
 
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);
@@ -3819,7 +3820,6 @@ static void hclge_ae_stop(struct hnae3_h
 
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);
-	hclge_update_link_status(hdev);
 }
 
 static int hclge_get_mac_vlan_cmd_status(struct hclge_vport *vport,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 175/336] media: staging: atomisp: Comment out several unused sensor resolutions
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 173/336] net: hns3: Fix for fiber link up problem Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 176/336] arm64: cmpwait: Clear event register before arming exclusive monitor Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[ Upstream commit db01f7ccfa6d4738e366077ce7423d1710b805f3 ]

The register settings for several resolutions aren't used
currently. So, comment them out.

Fix those warnings:

In file included from drivers/staging/media/atomisp/i2c/atomisp-gc2235.c:35:0:
drivers/staging/media/atomisp/i2c/gc2235.h:340:32: warning: 'gc2235_960_640_30fps' defined but not used [-Wunused-const-variable=]
 static struct gc2235_reg const gc2235_960_640_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/gc2235.h:287:32: warning: 'gc2235_1296_736_30fps' defined but not used [-Wunused-const-variable=]
 static struct gc2235_reg const gc2235_1296_736_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~
In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2722.c:35:0:
drivers/staging/media/atomisp/i2c/ov2722.h:999:32: warning: 'ov2722_720p_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_720p_30fps[] = {
                                ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:787:32: warning: 'ov2722_1M3_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_1M3_30fps[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:476:32: warning: 'ov2722_VGA_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_VGA_30fps[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:367:32: warning: 'ov2722_480P_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_480P_30fps[] = {
                                ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:257:32: warning: 'ov2722_QVGA_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_QVGA_30fps[] = {
                                ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function '__ov2680_set_exposure':
In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:35:0:
At top level:
drivers/staging/media/atomisp/i2c/ov2680.h:736:33: warning: 'ov2680_1616x1082_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:649:33: warning: 'ov2680_1456x1096_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_1456x1096_30fps[]= {
                                 ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:606:33: warning: 'ov2680_1296x976_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_1296x976_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:563:33: warning: 'ov2680_720p_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_720p_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:520:33: warning: 'ov2680_800x600_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_800x600_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:475:33: warning: 'ov2680_720x592_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_720x592_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:433:33: warning: 'ov2680_656x496_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_656x496_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:389:33: warning: 'ov2680_QVGA_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_QVGA_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:346:33: warning: 'ov2680_CIF_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_CIF_30fps[] = {
                                 ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:301:33: warning: 'ov2680_QCIF_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_QCIF_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
In file included from drivers/staging/media/atomisp/i2c/ov5693/atomisp-ov5693.c:36:0:
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:988:32: warning: 'ov5693_1424x1168_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:954:32: warning: 'ov5693_2592x1944_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:889:32: warning: 'ov5693_2592x1456_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_2592x1456_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:862:32: warning: 'ov5693_1940x1096' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1940x1096[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:796:32: warning: 'ov5693_1636p_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1636p_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:758:32: warning: 'ov5693_1296x736' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1296x736[] = {
                                ^~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:730:32: warning: 'ov5693_976x556' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_976x556[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:672:32: warning: 'ov5693_736x496' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_736x496[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:643:32: warning: 'ov5693_192x160' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_192x160[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:616:32: warning: 'ov5693_368x304' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_368x304[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:587:32: warning: 'ov5693_336x256' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_336x256[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:540:32: warning: 'ov5693_1296x976' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1296x976[] = {
                                ^~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:509:32: warning: 'ov5693_654x496' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_654x496[] = {
                                ^~~~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/media/atomisp/i2c/gc2235.h        |    9 ++++++++-
 drivers/staging/media/atomisp/i2c/ov2680.h        |    5 ++++-
 drivers/staging/media/atomisp/i2c/ov2722.h        |    6 ++++++
 drivers/staging/media/atomisp/i2c/ov5693/ov5693.h |   18 +++++++++++++++++-
 4 files changed, 35 insertions(+), 3 deletions(-)

--- a/drivers/staging/media/atomisp/i2c/gc2235.h
+++ b/drivers/staging/media/atomisp/i2c/gc2235.h
@@ -33,6 +33,11 @@
 
 #include "../include/linux/atomisp_platform.h"
 
+/*
+ * FIXME: non-preview resolutions are currently broken
+ */
+#define ENABLE_NON_PREVIEW     0
+
 /* Defines for register writes and register array processing */
 #define I2C_MSG_LENGTH		0x2
 #define I2C_RETRY_COUNT		5
@@ -284,6 +289,7 @@ static struct gc2235_reg const gc2235_in
 /*
  * Register settings for various resolution
  */
+#if ENABLE_NON_PREVIEW
 static struct gc2235_reg const gc2235_1296_736_30fps[] = {
 	{ GC2235_8BIT, 0x8b, 0xa0 },
 	{ GC2235_8BIT, 0x8c, 0x02 },
@@ -387,6 +393,7 @@ static struct gc2235_reg const gc2235_96
 	{ GC2235_8BIT, 0xfe, 0x00 }, /* switch to P0 */
 	{ GC2235_TOK_TERM, 0, 0 }
 };
+#endif
 
 static struct gc2235_reg const gc2235_1600_900_30fps[] = {
 	{ GC2235_8BIT, 0x8b, 0xa0 },
@@ -578,7 +585,7 @@ static struct gc2235_resolution gc2235_r
  * Disable non-preview configurations until the configuration selection is
  * improved.
  */
-#if 0
+#if ENABLE_NON_PREVIEW
 static struct gc2235_resolution gc2235_res_still[] = {
 	{
 		.desc = "gc2235_1600_900_30fps",
--- a/drivers/staging/media/atomisp/i2c/ov2680.h
+++ b/drivers/staging/media/atomisp/i2c/ov2680.h
@@ -295,6 +295,7 @@ struct ov2680_format {
 	};
 
 
+#if 0 /* None of the definitions below are used currently */
 	/*
 	 * 176x144 30fps  VBlanking 1lane 10Bit (binning)
 	 */
@@ -513,7 +514,6 @@ struct ov2680_format {
 	{OV2680_8BIT, 0x5081, 0x41},
     {OV2680_TOK_TERM, 0, 0}
 	};
-
 	/*
 	* 800x600 30fps  VBlanking 1lane 10Bit (binning)
 	*/
@@ -685,6 +685,7 @@ struct ov2680_format {
     // {OV2680_8BIT, 0x5090, 0x0c},
 	{OV2680_TOK_TERM, 0, 0}
 	};
+#endif
 
 	/*
 	 *1616x916  30fps  VBlanking 1lane 10bit
@@ -734,6 +735,7 @@ struct ov2680_format {
 	/*
 	 * 1612x1212 30fps VBlanking 1lane 10Bit
 	 */
+#if 0
 	static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
        {OV2680_8BIT, 0x3086, 0x00},
        {OV2680_8BIT, 0x3501, 0x48},
@@ -773,6 +775,7 @@ struct ov2680_format {
        {OV2680_8BIT, 0x5081, 0x41},
 		{OV2680_TOK_TERM, 0, 0}
         };
+#endif
 	/*
 	 * 1616x1216 30fps VBlanking 1lane 10Bit
 	 */
--- a/drivers/staging/media/atomisp/i2c/ov2722.h
+++ b/drivers/staging/media/atomisp/i2c/ov2722.h
@@ -254,6 +254,7 @@ struct ov2722_write_ctrl {
 /*
  * Register settings for various resolution
  */
+#if 0
 static struct ov2722_reg const ov2722_QVGA_30fps[] = {
 	{OV2722_8BIT, 0x3718, 0x10},
 	{OV2722_8BIT, 0x3702, 0x0c},
@@ -581,6 +582,7 @@ static struct ov2722_reg const ov2722_VG
 	{OV2722_8BIT, 0x3509, 0x10},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_reg const ov2722_1632_1092_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for
@@ -784,6 +786,7 @@ static struct ov2722_reg const ov2722_14
 	{OV2722_8BIT, 0x3509, 0x00},
 	{OV2722_TOK_TERM, 0, 0}
 };
+#if 0
 static struct ov2722_reg const ov2722_1M3_30fps[] = {
 	{OV2722_8BIT, 0x3718, 0x10},
 	{OV2722_8BIT, 0x3702, 0x24},
@@ -890,6 +893,7 @@ static struct ov2722_reg const ov2722_1M
 	{OV2722_8BIT, 0x3509, 0x10},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_reg const ov2722_1080p_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for a whole
@@ -996,6 +1000,7 @@ static struct ov2722_reg const ov2722_10
 	{OV2722_TOK_TERM, 0, 0}
 };
 
+#if 0 /* Currently unused */
 static struct ov2722_reg const ov2722_720p_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03},
 	{OV2722_8BIT, 0x3718, 0x10},
@@ -1095,6 +1100,7 @@ static struct ov2722_reg const ov2722_72
 	{OV2722_8BIT, 0x3509, 0x00},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_resolution ov2722_res_preview[] = {
 	{
--- a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
+++ b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
@@ -31,6 +31,12 @@
 
 #include "../../include/linux/atomisp_platform.h"
 
+/*
+ * FIXME: non-preview resolutions are currently broken
+ */
+#define ENABLE_NON_PREVIEW	0
+
+
 #define OV5693_POWER_UP_RETRY_NUM 5
 
 /* Defines for register writes and register array processing */
@@ -503,6 +509,7 @@ static struct ov5693_reg const ov5693_gl
 	{OV5693_TOK_TERM, 0, 0}
 };
 
+#if ENABLE_NON_PREVIEW
 /*
  * 654x496 30fps 17ms VBlanking 2lane 10Bit (Scaling)
  */
@@ -695,6 +702,7 @@ static struct ov5693_reg const ov5693_73
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
 static struct ov5693_reg const ov5693_736x496[] = {
@@ -727,6 +735,7 @@ static struct ov5693_reg const ov5693_73
 /*
  * 976x556 30fps 8.8ms VBlanking 2lane 10Bit (Scaling)
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_976x556[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},
@@ -819,6 +828,7 @@ static struct ov5693_reg const ov5693_16
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 static struct ov5693_reg const ov5693_1616x1216_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
@@ -859,6 +869,7 @@ static struct ov5693_reg const ov5693_16
 /*
  * 1940x1096 30fps 8.8ms VBlanking 2lane 10bit (Scaling)
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_1940x1096[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},
@@ -916,6 +927,7 @@ static struct ov5693_reg const ov5693_25
 	{OV5693_8BIT, 0x5002, 0x00},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 static struct ov5693_reg const ov5693_2576x1456_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
@@ -951,6 +963,7 @@ static struct ov5693_reg const ov5693_25
 /*
  * 2592x1944 30fps 0.6ms VBlanking 2lane 10Bit
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},
@@ -977,6 +990,7 @@ static struct ov5693_reg const ov5693_25
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
  * 11:9 Full FOV Output, expected FOV Res: 2346x1920
@@ -985,6 +999,7 @@ static struct ov5693_reg const ov5693_25
  *
  * WA: Left Offset: 8, Hor scal: 64
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x3b}, /* long exposure[15:8] */
 	{OV5693_8BIT, 0x3502, 0x80}, /* long exposure[7:0] */
@@ -1019,6 +1034,7 @@ static struct ov5693_reg const ov5693_14
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
  * 3:2 Full FOV Output, expected FOV Res: 2560x1706
@@ -1151,7 +1167,7 @@ static struct ov5693_resolution ov5693_r
  * Disable non-preview configurations until the configuration selection is
  * improved.
  */
-#if 0
+#if ENABLE_NON_PREVIEW
 struct ov5693_resolution ov5693_res_still[] = {
 	{
 		.desc = "ov5693_736x496_30fps",



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 176/336] arm64: cmpwait: Clear event register before arming exclusive monitor
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 175/336] media: staging: atomisp: Comment out several unused sensor resolutions Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 177/336] HID: hid-plantronics: Re-resend Update to map button for PTT products Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Will Deacon, Catalin Marinas, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

[ Upstream commit 1cfc63b5ae60fe7e01773f38132f98d8b13a99a0 ]

When waiting for a cacheline to change state in cmpwait, we may immediately
wake-up the first time around the outer loop if the event register was
already set (for example, because of the event stream).

Avoid these spurious wakeups by explicitly clearing the event register
before loading the cacheline and setting the exclusive monitor.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/cmpxchg.h |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -204,7 +204,9 @@ static inline void __cmpwait_case_##name
 	unsigned long tmp;						\
 									\
 	asm volatile(							\
-	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"		\
+	"	sevl\n"							\
+	"	wfe\n"							\
+	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"			\
 	"	eor	%" #w "[tmp], %" #w "[tmp], %" #w "[val]\n"	\
 	"	cbnz	%" #w "[tmp], 1f\n"				\
 	"	wfe\n"							\



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 177/336] HID: hid-plantronics: Re-resend Update to map button for PTT products
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 176/336] arm64: cmpwait: Clear event register before arming exclusive monitor Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 178/336] arm64: dts: renesas: salvator-common: use audio-graph-card for Sound Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Terry Junge, Jiri Kosina, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Terry Junge <terry.junge@plantronics.com>

[ Upstream commit 37e376df5f4993677c33968a0c19b0c5acbf1108 ]

Add a mapping for Push-To-Talk joystick trigger button.

Tested on ChromeBox/ChromeBook with various Plantronics devices.

Signed-off-by: Terry Junge <terry.junge@plantronics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-plantronics.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/hid/hid-plantronics.c
+++ b/drivers/hid/hid-plantronics.c
@@ -2,7 +2,7 @@
  *  Plantronics USB HID Driver
  *
  *  Copyright (c) 2014 JD Cole <jd.cole@plantronics.com>
- *  Copyright (c) 2015 Terry Junge <terry.junge@plantronics.com>
+ *  Copyright (c) 2015-2018 Terry Junge <terry.junge@plantronics.com>
  */
 
 /*
@@ -48,6 +48,10 @@ static int plantronics_input_mapping(str
 	unsigned short mapped_key;
 	unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
 
+	/* special case for PTT products */
+	if (field->application == HID_GD_JOYSTICK)
+		goto defaulted;
+
 	/* handle volume up/down mapping */
 	/* non-standard types or multi-HID interfaces - plt_type is PID */
 	if (!(plt_type & HID_USAGE_PAGE)) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 178/336] arm64: dts: renesas: salvator-common: use audio-graph-card for Sound
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 177/336] HID: hid-plantronics: Re-resend Update to map button for PTT products Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 179/336] drm/amd/display: remove need of modeset flag for overlay planes (V2) Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuninori Morimoto, Nguyen Viet Dung,
	Simon Horman, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>

[ Upstream commit 06a574c7ef69bd0bd26ed08e35967acb76622ab3 ]

Current Sound is using simple-audio-card which can't support HDMI.
To use HDMI sound, we need to use audio-graph-card.
But, one note is that r8a7795 has 2 HDMI ports, but r8a7796 has 1.
Because of this mismatch, supporting HDMI on salvator-common is
impossible.
Thus, this patch exchange sound card to audio-graph-card and keep
supporting ak4613 as 1st sound node.
r8a7795/r8a7796 salvator-x{s} need to add HDMI sound individually.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Tested-by: Nguyen Viet Dung <nv-dung@jinso.co.jp>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/renesas/salvator-common.dtsi |   38 +++++++++++++----------
 1 file changed, 22 insertions(+), 16 deletions(-)

--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -93,20 +93,12 @@
 		regulator-always-on;
 	};
 
-	rsnd_ak4613: sound {
-		compatible = "simple-audio-card";
+	sound_card: sound {
+		compatible = "audio-graph-card";
 
-		simple-audio-card,format = "left_j";
-		simple-audio-card,bitclock-master = <&sndcpu>;
-		simple-audio-card,frame-master = <&sndcpu>;
+		label = "rcar-sound";
 
-		sndcpu: simple-audio-card,cpu {
-			sound-dai = <&rcar_sound>;
-		};
-
-		sndcodec: simple-audio-card,codec {
-			sound-dai = <&ak4613>;
-		};
+		dais = <&rsnd_port0>;
 	};
 
 	vbus0_usb2: regulator-vbus0-usb2 {
@@ -322,6 +314,12 @@
 		asahi-kasei,out4-single-end;
 		asahi-kasei,out5-single-end;
 		asahi-kasei,out6-single-end;
+
+		port {
+			ak4613_endpoint: endpoint {
+				remote-endpoint = <&rsnd_endpoint0>;
+			};
+		};
 	};
 
 	cs2000: clk_multiplier@4f {
@@ -581,10 +579,18 @@
 		 <&audio_clk_c>,
 		 <&cpg CPG_CORE CPG_AUDIO_CLK_I>;
 
-	rcar_sound,dai {
-		dai0 {
-			playback = <&ssi0 &src0 &dvc0>;
-			capture  = <&ssi1 &src1 &dvc1>;
+	ports {
+		rsnd_port0: port@0 {
+			rsnd_endpoint0: endpoint {
+				remote-endpoint = <&ak4613_endpoint>;
+
+				dai-format = "left_j";
+				bitclock-master = <&rsnd_endpoint0>;
+				frame-master = <&rsnd_endpoint0>;
+
+				playback = <&ssi0 &src0 &dvc0>;
+				capture  = <&ssi1 &src1 &dvc1>;
+			};
 		};
 	};
 };



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 179/336] drm/amd/display: remove need of modeset flag for overlay planes (V2)
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 178/336] arm64: dts: renesas: salvator-common: use audio-graph-card for Sound Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 180/336] drm/radeon: fix mode_valids return type Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shirish S, Harry Wentland,
	Alex Deucher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shirish S <shirish.s@amd.com>

[ Upstream commit a2a330ad66313084c9432b32862aa7e1255da9b4 ]

This patch is in continuation to the
"843e3c7 drm/amd/display: defer modeset check in dm_update_planes_state"
where we started to eliminate the dependency on
DRM_MODE_ATOMIC_ALLOW_MODESET to be set by the user space,
which as such is not mandatory.

After deferring, this patch eliminates the dependency on the flag
for overlay planes.

This has to be done in stages as its a pretty complex and requires thorough
testing before we free primary planes as well from dependency on modeset
flag.

V2: Simplified the plane type check.

Signed-off-by: Shirish S <shirish.s@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4037,7 +4037,7 @@ static void amdgpu_dm_commit_planes(stru
 		}
 		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
 
-		if (!pflip_needed) {
+		if (!pflip_needed || plane->type == DRM_PLANE_TYPE_OVERLAY) {
 			WARN_ON(!dm_new_plane_state->dc_state);
 
 			plane_states_constructed[planes_count] = dm_new_plane_state->dc_state;
@@ -4783,7 +4783,8 @@ static int dm_update_planes_state(struct
 
 		/* Remove any changed/removed planes */
 		if (!enable) {
-			if (pflip_needed)
+			if (pflip_needed &&
+			    plane->type != DRM_PLANE_TYPE_OVERLAY)
 				continue;
 
 			if (!old_plane_crtc)
@@ -4830,7 +4831,8 @@ static int dm_update_planes_state(struct
 			if (!dm_new_crtc_state->stream)
 				continue;
 
-			if (pflip_needed)
+			if (pflip_needed &&
+			    plane->type != DRM_PLANE_TYPE_OVERLAY)
 				continue;
 
 			WARN_ON(dm_new_plane_state->dc_state);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 180/336] drm/radeon: fix mode_valids return type
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 179/336] drm/amd/display: remove need of modeset flag for overlay planes (V2) Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 182/336] drm/amd/display: Fix dim display on DCE11 Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Alex Deucher,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>

[ Upstream commit 7a47f20eb1fb8fa8d7a8fe3a4fd8c721f04c2174 ]

The method struct drm_connector_helper_funcs::mode_valid is defined
as returning an 'enum drm_mode_status' but the driver implementation
for this method uses an 'int' for it.

Fix this by using 'enum drm_mode_status' in the driver too.

Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/radeon/radeon_connectors.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -852,7 +852,7 @@ static int radeon_lvds_get_modes(struct
 	return ret;
 }
 
-static int radeon_lvds_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector,
 				  struct drm_display_mode *mode)
 {
 	struct drm_encoder *encoder = radeon_best_single_encoder(connector);
@@ -1012,7 +1012,7 @@ static int radeon_vga_get_modes(struct d
 	return ret;
 }
 
-static int radeon_vga_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector,
 				  struct drm_display_mode *mode)
 {
 	struct drm_device *dev = connector->dev;
@@ -1156,7 +1156,7 @@ static int radeon_tv_get_modes(struct dr
 	return 1;
 }
 
-static int radeon_tv_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector,
 				struct drm_display_mode *mode)
 {
 	if ((mode->hdisplay > 1024) || (mode->vdisplay > 768))
@@ -1498,7 +1498,7 @@ static void radeon_dvi_force(struct drm_
 		radeon_connector->use_digital = true;
 }
 
-static int radeon_dvi_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector,
 				  struct drm_display_mode *mode)
 {
 	struct drm_device *dev = connector->dev;
@@ -1800,7 +1800,7 @@ out:
 	return ret;
 }
 
-static int radeon_dp_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector,
 				  struct drm_display_mode *mode)
 {
 	struct drm_device *dev = connector->dev;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 182/336] drm/amd/display: Fix dim display on DCE11
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 180/336] drm/radeon: fix mode_valids return type Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 183/336] IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leo (Sunpeng) Li, Anthony Koo,
	Harry Wentland, Alex Deucher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Leo (Sunpeng) Li" <sunpeng.li@amd.com>

[ Upstream commit 84ffa80123f56f80145dc638f21dfcbedda5610d ]

Before programming the input gamma, check that we're not using the
identity correction.

Signed-off-by: Leo (Sunpeng) Li <sunpeng.li@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -279,7 +279,9 @@ dce110_set_input_transfer_func(struct pi
 	build_prescale_params(&prescale_params, plane_state);
 	ipp->funcs->ipp_program_prescale(ipp, &prescale_params);
 
-	if (plane_state->gamma_correction && dce_use_lut(plane_state->format))
+	if (plane_state->gamma_correction &&
+			!plane_state->gamma_correction->is_identity &&
+			dce_use_lut(plane_state->format))
 		ipp->funcs->ipp_program_input_lut(ipp, plane_state->gamma_correction);
 
 	if (tf == NULL) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 183/336] IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 182/336] drm/amd/display: Fix dim display on DCE11 Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 185/336] HID: i2c-hid: check if device is there before really probing Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Doug Ledford, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

[ Upstream commit e02637e97d68a54b1527bc654bf8377eda310226 ]

DMA_VIRT_OPS requires that dma_addr_t is at least as wide as a
pointer, which is expressed as a dependency on !64BIT ||
ARCH_DMA_ADDR_T_64BIT.

For parisc64 this is not true, and if these IB modules are enabled,
kconfig warns:

WARNING: unmet direct dependencies detected for DMA_VIRT_OPS
  Depends on [n]: HAS_DMA [=y] && (!64BIT [=y] || ARCH_DMA_ADDR_T_64BIT)
  Selected by [m]:
  - INFINIBAND_RDMAVT [=m] && INFINIBAND [=m] && 64BIT [=y] && PCI [=y]
  - RDMA_RXE [=m] && INET [=y] && PCI [=y] && INFINIBAND [=m]

Add dependencies to fix this.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/sw/rdmavt/Kconfig |    2 +-
 drivers/infiniband/sw/rxe/Kconfig    |    1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/sw/rdmavt/Kconfig
+++ b/drivers/infiniband/sw/rdmavt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_RDMAVT
 	tristate "RDMA verbs transport library"
-	depends on 64BIT
+	depends on 64BIT && ARCH_DMA_ADDR_T_64BIT
 	depends on PCI
 	select DMA_VIRT_OPS
 	---help---
--- a/drivers/infiniband/sw/rxe/Kconfig
+++ b/drivers/infiniband/sw/rxe/Kconfig
@@ -1,6 +1,7 @@
 config RDMA_RXE
 	tristate "Software RDMA over Ethernet (RoCE) driver"
 	depends on INET && PCI && INFINIBAND
+	depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
 	select NET_UDP_TUNNEL
 	select CRYPTO_CRC32
 	select DMA_VIRT_OPS



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 185/336] HID: i2c-hid: check if device is there before really probing
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 183/336] IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48   ` [4.17,186/336] " Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Benjamin Tissoires,
	Jiri Kosina, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Torokhov <dtor@chromium.org>

[ Upstream commit b3a81b6c4fc6730ac49e20d789a93c0faabafc98 ]

On many Chromebooks touch devices are multi-sourced; the components are
electrically compatible and one can be freely swapped for another without
changing the OS image or firmware.

To avoid bunch of scary messages when device is not actually present in the
system let's try testing basic communication with it and if there is no
response terminate probe early with -ENXIO.

Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/i2c-hid/i2c-hid.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -1054,6 +1054,14 @@ static int i2c_hid_probe(struct i2c_clie
 	pm_runtime_enable(&client->dev);
 	device_enable_async_suspend(&client->dev);
 
+	/* Make sure there is something at this address */
+	ret = i2c_smbus_read_byte(client);
+	if (ret < 0) {
+		dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
+		ret = -ENXIO;
+		goto err_pm;
+	}
+
 	ret = i2c_hid_fetch_hid_descriptor(ihid);
 	if (ret < 0)
 		goto err_pm;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 186/336] EDAC, altera: Fix ARM64 build warning
@ 2018-08-01 16:48   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Thor Thayer,
	linux-arm-kernel, linux-edac, Borislav Petkov, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thor Thayer <thor.thayer@linux.intel.com>

[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ]

The kbuild test robot reported the following warning:

  drivers/edac/altera_edac.c: In function 'ocram_free_mem':
  drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer
	of different size [-Wpointer-to-int-cast]
    gen_pool_free((struct gen_pool *)other, (u32)p, size);
                                             ^

After adding support for ARM64 architectures, the unsigned long
parameter is 64 bits and causes a build warning on 64-bit configs. Fix
by casting to the correct size (unsigned long) instead of u32.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-edac <linux-edac@vger.kernel.org>
Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support")
Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer@linux.intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/altera_edac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size
 
 static void ocram_free_mem(void *p, size_t size, void *other)
 {
-	gen_pool_free((struct gen_pool *)other, (u32)p, size);
+	gen_pool_free((struct gen_pool *)other, (unsigned long)p, size);
 }
 
 static const struct edac_device_prv_data ocramecc_data = {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [4.17,186/336] EDAC, altera: Fix ARM64 build warning
@ 2018-08-01 16:48   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Thor Thayer,
	linux-arm-kernel, linux-edac, Borislav Petkov, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thor Thayer <thor.thayer@linux.intel.com>

[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ]

The kbuild test robot reported the following warning:

  drivers/edac/altera_edac.c: In function 'ocram_free_mem':
  drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer
	of different size [-Wpointer-to-int-cast]
    gen_pool_free((struct gen_pool *)other, (u32)p, size);
                                             ^

After adding support for ARM64 architectures, the unsigned long
parameter is 64 bits and causes a build warning on 64-bit configs. Fix
by casting to the correct size (unsigned long) instead of u32.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-edac <linux-edac@vger.kernel.org>
Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support")
Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer@linux.intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/altera_edac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



--
To unsubscribe from this list: send the line "unsubscribe linux-edac" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size
 
 static void ocram_free_mem(void *p, size_t size, void *other)
 {
-	gen_pool_free((struct gen_pool *)other, (u32)p, size);
+	gen_pool_free((struct gen_pool *)other, (unsigned long)p, size);
 }
 
 static const struct edac_device_prv_data ocramecc_data = {

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 186/336] EDAC, altera: Fix ARM64 build warning
@ 2018-08-01 16:48   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-arm-kernel

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thor Thayer <thor.thayer@linux.intel.com>

[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ]

The kbuild test robot reported the following warning:

  drivers/edac/altera_edac.c: In function 'ocram_free_mem':
  drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer
	of different size [-Wpointer-to-int-cast]
    gen_pool_free((struct gen_pool *)other, (u32)p, size);
                                             ^

After adding support for ARM64 architectures, the unsigned long
parameter is 64 bits and causes a build warning on 64-bit configs. Fix
by casting to the correct size (unsigned long) instead of u32.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
Cc: linux-arm-kernel at lists.infradead.org
Cc: linux-edac <linux-edac@vger.kernel.org>
Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support")
Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer at linux.intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/altera_edac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size
 
 static void ocram_free_mem(void *p, size_t size, void *other)
 {
-	gen_pool_free((struct gen_pool *)other, (u32)p, size);
+	gen_pool_free((struct gen_pool *)other, (unsigned long)p, size);
 }
 
 static const struct edac_device_prv_data ocramecc_data = {

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 187/336] rsi: Add null check for virtual interfaces in wowlan config
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2018-08-01 16:48   ` [4.17,186/336] " Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 188/336] ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sanjay Kumar Konduri,
	Siva Rebbagondla, Sushant Kumar Mishra, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>

[ Upstream commit 54b5172087aeae61150835c91e68f084a9644f1c ]

When the "poweroff" command is executed after wowlan enabled, we have
observed a system crash. In the system "poweroff" sequence, network-manager
is sent to inactive state by cleaning up the network interfaces, using
rsi_mac80211_remove_interface() and when driver tries to access those
network interfaces in rsi_wowlan_config() which was invoked by SDIO
shutdown, results in a crash. Added a NULL check before accessing the
network interfaces in rsi_wowlan_config().

Signed-off-by: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -1788,10 +1788,15 @@ int rsi_config_wowlan(struct rsi_hw *ada
 	struct rsi_common *common = adapter->priv;
 	u16 triggers = 0;
 	u16 rx_filter_word = 0;
-	struct ieee80211_bss_conf *bss = &adapter->vifs[0]->bss_conf;
+	struct ieee80211_bss_conf *bss = NULL;
 
 	rsi_dbg(INFO_ZONE, "Config WoWLAN to device\n");
 
+	if (!adapter->vifs[0])
+		return -EINVAL;
+
+	bss = &adapter->vifs[0]->bss_conf;
+
 	if (WARN_ON(!wowlan)) {
 		rsi_dbg(ERR_ZONE, "WoW triggers not enabled\n");
 		return -EINVAL;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 188/336] ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 187/336] rsi: Add null check for virtual interfaces in wowlan config Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 189/336] ARM: dts: stih407-pinctrl: " Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Patrice Chotard, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrice Chotard <patrice.chotard@st.com>

[ Upstream commit fd827d0ec86bce8d421423ad2c4add84aa23e1b9 ]

Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE")
kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't
be used.

Use IRQ_TYPE_LEVEL_HIGH instead.

Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/stih410.dtsi |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -43,7 +43,7 @@
 		ohci0: usb@9a03c00 {
 			compatible = "st,st-ohci-300x";
 			reg = <0x9a03c00 0x100>;
-			interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
 				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
 			resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
@@ -58,7 +58,7 @@
 		ehci0: usb@9a03e00 {
 			compatible = "st,st-ehci-300x";
 			reg = <0x9a03e00 0x100>;
-			interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 151 IRQ_TYPE_LEVEL_HIGH>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&pinctrl_usb0>;
 			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
@@ -75,7 +75,7 @@
 		ohci1: usb@9a83c00 {
 			compatible = "st,st-ohci-300x";
 			reg = <0x9a83c00 0x100>;
-			interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
 				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
 			resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
@@ -90,7 +90,7 @@
 		ehci1: usb@9a83e00 {
 			compatible = "st,st-ehci-300x";
 			reg = <0x9a83e00 0x100>;
-			interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&pinctrl_usb1>;
 			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
@@ -202,7 +202,7 @@
 				reg = <0x8d04000 0x1000>;
 				reg-names = "hdmi-reg";
 				#sound-dai-cells = <0>;
-				interrupts = <GIC_SPI 106 IRQ_TYPE_NONE>;
+				interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-names	= "irq";
 				clock-names = "pix",
 					      "tmds",
@@ -254,7 +254,7 @@
 		bdisp0:bdisp@9f10000 {
 			compatible = "st,stih407-bdisp";
 			reg = <0x9f10000 0x1000>;
-			interrupts = <GIC_SPI 38 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
 			clock-names = "bdisp";
 			clocks = <&clk_s_c0_flexgen CLK_IC_BDISP_0>;
 		};
@@ -263,8 +263,8 @@
 			compatible = "st,st-hva";
 			reg = <0x8c85000 0x400>, <0x6000000 0x40000>;
 			reg-names = "hva_registers", "hva_esram";
-			interrupts = <GIC_SPI 58 IRQ_TYPE_NONE>,
-				     <GIC_SPI 59 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 59 IRQ_TYPE_LEVEL_HIGH>;
 			clock-names = "clk_hva";
 			clocks = <&clk_s_c0_flexgen CLK_HVA>;
 		};
@@ -292,7 +292,7 @@
 			reg = <0x94a087c 0x64>;
 			clocks = <&clk_sysin>;
 			clock-names = "cec-clk";
-			interrupts = <GIC_SPI 140 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "cec-irq";
 			pinctrl-names = "default";
 			pinctrl-0 = <&pinctrl_cec0_default>;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 189/336] ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 188/336] ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 190/336] ARM: dts: emev2: Add missing interrupt-affinity to PMU node Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Patrice Chotard, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrice Chotard <patrice.chotard@st.com>

[ Upstream commit e95b8e718f9bd2386a29639dd21c633b4951dc21 ]

Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE")
kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't
be used.

Use IRQ_TYPE_LEVEL_HIGH instead.

Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/stih407-pinctrl.dtsi |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/arm/boot/dts/stih407-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stih407-pinctrl.dtsi
@@ -52,7 +52,7 @@
 			st,syscfg = <&syscfg_sbc>;
 			reg = <0x0961f080 0x4>;
 			reg-names = "irqmux";
-			interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "irqmux";
 			ranges = <0 0x09610000 0x6000>;
 
@@ -376,7 +376,7 @@
 			st,syscfg = <&syscfg_front>;
 			reg = <0x0920f080 0x4>;
 			reg-names = "irqmux";
-			interrupts = <GIC_SPI 189 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "irqmux";
 			ranges = <0 0x09200000 0x10000>;
 
@@ -936,7 +936,7 @@
 			st,syscfg = <&syscfg_front>;
 			reg = <0x0921f080 0x4>;
 			reg-names = "irqmux";
-			interrupts = <GIC_SPI 190 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "irqmux";
 			ranges = <0 0x09210000 0x10000>;
 
@@ -969,7 +969,7 @@
 			st,syscfg = <&syscfg_rear>;
 			reg = <0x0922f080 0x4>;
 			reg-names = "irqmux";
-			interrupts = <GIC_SPI 191 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "irqmux";
 			ranges = <0 0x09220000 0x6000>;
 
@@ -1164,7 +1164,7 @@
 			st,syscfg = <&syscfg_flash>;
 			reg = <0x0923f080 0x4>;
 			reg-names = "irqmux";
-			interrupts = <GIC_SPI 192 IRQ_TYPE_NONE>;
+			interrupts = <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "irqmux";
 			ranges = <0 0x09230000 0x3000>;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 190/336] ARM: dts: emev2: Add missing interrupt-affinity to PMU node
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 189/336] ARM: dts: stih407-pinctrl: " Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 191/336] ARM: dts: sh73a0: " Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 7207b94754b6f503b278b5b200faaf662ffa1da8 ]

The PMU node references two interrupts, but lacks the interrupt-affinity
property, which is required in that case:

    hw perfevents: no interrupt-affinity property for /pmu, guessing.

Add the missing property to fix this.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/emev2.dtsi |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/emev2.dtsi
+++ b/arch/arm/boot/dts/emev2.dtsi
@@ -31,13 +31,13 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		cpu@0 {
+		cpu0: cpu@0 {
 			device_type = "cpu";
 			compatible = "arm,cortex-a9";
 			reg = <0>;
 			clock-frequency = <533000000>;
 		};
-		cpu@1 {
+		cpu1: cpu@1 {
 			device_type = "cpu";
 			compatible = "arm,cortex-a9";
 			reg = <1>;
@@ -57,6 +57,7 @@
 		compatible = "arm,cortex-a9-pmu";
 		interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
 			     <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-affinity = <&cpu0>, <&cpu1>;
 	};
 
 	clocks@e0110000 {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 191/336] ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 190/336] ARM: dts: emev2: Add missing interrupt-affinity to PMU node Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 192/336] nvmem: properly handle returned value nvmem_reg_read Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 57a66497e1b7486609250a482f05935eae5035e9 ]

The PMU node references two interrupts, but lacks the interrupt-affinity
property, which is required in that case:

    hw perfevents: no interrupt-affinity property for /pmu, guessing.

Add the missing property to fix this.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/sh73a0.dtsi |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/sh73a0.dtsi
+++ b/arch/arm/boot/dts/sh73a0.dtsi
@@ -22,7 +22,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		cpu@0 {
+		cpu0: cpu@0 {
 			device_type = "cpu";
 			compatible = "arm,cortex-a9";
 			reg = <0>;
@@ -31,7 +31,7 @@
 			power-domains = <&pd_a2sl>;
 			next-level-cache = <&L2>;
 		};
-		cpu@1 {
+		cpu1: cpu@1 {
 			device_type = "cpu";
 			compatible = "arm,cortex-a9";
 			reg = <1>;
@@ -91,6 +91,7 @@
 		compatible = "arm,cortex-a9-pmu";
 		interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
 			     <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-affinity = <&cpu0>, <&cpu1>;
 	};
 
 	cmt1: timer@e6138000 {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 192/336] nvmem: properly handle returned value nvmem_reg_read
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 191/336] ARM: dts: sh73a0: " Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 193/336] ARM: dts: imx53: Fix LDB OF graph warning Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Malaterre,
	Srinivas Kandagatla, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mathieu Malaterre <malat@debian.org>

[ Upstream commit 50808bfcc14b854775a9f1d0abe3dac2babcf5c3 ]

Function nvmem_reg_read can return a non zero value indicating an error.
This returned value must be read and error propagated to
nvmem_cell_prepare_write_buffer. Silence the following gcc warning (W=1):

drivers/nvmem/core.c:1093:9: warning: variable 'rc' set but
 not used [-Wunused-but-set-variable]

Signed-off-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/core.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1107,6 +1107,8 @@ static void *nvmem_cell_prepare_write_bu
 
 		/* setup the first byte with lsb bits from nvmem */
 		rc = nvmem_reg_read(nvmem, cell->offset, &v, 1);
+		if (rc)
+			goto err;
 		*b++ |= GENMASK(bit_offset - 1, 0) & v;
 
 		/* setup rest of the byte if any */
@@ -1125,11 +1127,16 @@ static void *nvmem_cell_prepare_write_bu
 		/* setup the last byte with msb bits from nvmem */
 		rc = nvmem_reg_read(nvmem,
 				    cell->offset + cell->bytes - 1, &v, 1);
+		if (rc)
+			goto err;
 		*p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v;
 
 	}
 
 	return buf;
+err:
+	kfree(buf);
+	return ERR_PTR(rc);
 }
 
 /**



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 193/336] ARM: dts: imx53: Fix LDB OF graph warning
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 192/336] nvmem: properly handle returned value nvmem_reg_read Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 194/336] i40e: free the skb after clearing the bitlock Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sascha Hauer,
	Pengutronix Kernel Team, Fabio Estevam, Rob Herring,
	Philipp Zabel, Shawn Guo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rob Herring <robh@kernel.org>

[ Upstream commit 77dd4bd0c0db8e4856e7abc2192f126e226e14c5 ]

Single child nodes in OF graph don't need an address and now dtc will
warn about this:

Warning (graph_child_address): /soc/aips@50000000/ldb@53fa8008/lvds-channel@0: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary

Since the LDB should always have an output port, fix the warning by
adding the output port, 2, to the DT.

Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/imx53-ppd.dts |    2 --
 arch/arm/boot/dts/imx53.dtsi    |    8 ++++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/imx53-ppd.dts
+++ b/arch/arm/boot/dts/imx53-ppd.dts
@@ -559,8 +559,6 @@
 		status = "okay";
 
 		port@2 {
-			reg = <2>;
-
 			lvds0_out: endpoint {
 				remote-endpoint = <&panel_in_lvds0>;
 			};
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -488,6 +488,10 @@
 							remote-endpoint = <&ipu_di0_lvds0>;
 						};
 					};
+
+					port@2 {
+						reg = <2>;
+					};
 				};
 
 				lvds-channel@1 {
@@ -503,6 +507,10 @@
 							remote-endpoint = <&ipu_di1_lvds1>;
 						};
 					};
+
+					port@2 {
+						reg = <2>;
+					};
 				};
 			};
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 194/336] i40e: free the skb after clearing the bitlock
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 193/336] ARM: dts: imx53: Fix LDB OF graph warning Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 195/336] tty: Fix data race in tty_insert_flip_string_fixed_flag Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacob Keller, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacob Keller <jacob.e.keller@intel.com>

[ Upstream commit c79756cb5f084736b138da9319a02f7c72644548 ]

In commit bbc4e7d273b5 ("i40e: fix race condition with PTP_TX_IN_PROGRESS
bits") we modified the code which handles Tx timestamps so that we would
clear the progress bit as soon as possible.

A later commit 0bc0706b46cd ("i40e: check for Tx timestamp timeouts during
watchdog") introduced similar code for detecting and handling cleanup of
a blocked Tx timestamp. This code did not use the same pattern for cleaning
up the skb.

Update this code to wait to free the skb until after the bit lock is
free, by first setting the ptp_tx_skb to NULL and clearing the lock.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/i40e/i40e_ptp.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -338,6 +338,8 @@ void i40e_ptp_rx_hang(struct i40e_pf *pf
  **/
 void i40e_ptp_tx_hang(struct i40e_pf *pf)
 {
+	struct sk_buff *skb;
+
 	if (!(pf->flags & I40E_FLAG_PTP) || !pf->ptp_tx)
 		return;
 
@@ -350,9 +352,12 @@ void i40e_ptp_tx_hang(struct i40e_pf *pf
 	 * within a second it is reasonable to assume that we never will.
 	 */
 	if (time_is_before_jiffies(pf->ptp_tx_start + HZ)) {
-		dev_kfree_skb_any(pf->ptp_tx_skb);
+		skb = pf->ptp_tx_skb;
 		pf->ptp_tx_skb = NULL;
 		clear_bit_unlock(__I40E_PTP_TX_IN_PROGRESS, pf->state);
+
+		/* Free the skb after we clear the bitlock */
+		dev_kfree_skb_any(skb);
 		pf->tx_hwtstamp_timeouts++;
 	}
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 195/336] tty: Fix data race in tty_insert_flip_string_fixed_flag
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 194/336] i40e: free the skb after clearing the bitlock Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 197/336] net: phy: phylink: Release link GPIO Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, DaeRyong Jeong, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: DaeRyong Jeong <threeearcat@gmail.com>

[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ]

Unlike normal serials, in pty layer, there is no guarantee that multiple
threads don't insert input characters at the same time. If it is happened,
tty_insert_flip_string_fixed_flag can be executed concurrently. This can
lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag.

Call sequences are as follows.
CPU0                                    CPU1
n_tty_ioctl_helper                      n_tty_ioctl_helper
__start_tty                             tty_send_xchar
tty_wakeup                              pty_write
n_hdlc_tty_wakeup                       tty_insert_flip_string
n_hdlc_send_frames                      tty_insert_flip_string_fixed_flag
pty_write
tty_insert_flip_string
tty_insert_flip_string_fixed_flag

To fix the race, acquire port->lock in pty_write() before it inserts input
characters to tty buffer. It prevents multiple threads from inserting
input characters concurrently.

The crash log is as follows:
BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/
0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121
Write of size 1792 by task syz-executor0/30017
CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
 0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140
 ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0
 ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121
Call Trace:
 __dump_stack lib/dump_stack.c:15 [inline]
 dump_stack+0xb3/0x110 lib/dump_stack.c:51
 kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
 print_address_description mm/kasan/report.c:194 [inline]
 kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283
 kasan_report+0x36/0x40 mm/kasan/report.c:303
 check_memory_region_inline mm/kasan/kasan.c:292 [inline]
 check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299
 memcpy+0x37/0x50 mm/kasan/kasan.c:335
 tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316
 tty_insert_flip_string include/linux/tty_flip.h:35 [inline]
 pty_write+0x7f/0xc0 drivers/tty/pty.c:115
 n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419
 n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496
 tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601
 __start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018
 __start_tty+0x34/0x40 drivers/tty/tty_io.c:1013
 n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138
 n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794
 tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x1f/0xbd

Signed-off-by: DaeRyong Jeong <threeearcat@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/pty.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -110,16 +110,19 @@ static void pty_unthrottle(struct tty_st
 static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
 {
 	struct tty_struct *to = tty->link;
+	unsigned long flags;
 
 	if (tty->stopped)
 		return 0;
 
 	if (c > 0) {
+		spin_lock_irqsave(&to->port->lock, flags);
 		/* Stuff the data into the input queue of the other end */
 		c = tty_insert_flip_string(to->port, buf, c);
 		/* And shovel */
 		if (c)
 			tty_flip_buffer_push(to->port);
+		spin_unlock_irqrestore(&to->port->lock, flags);
 	}
 	return c;
 }



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 197/336] net: phy: phylink: Release link GPIO
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 195/336] tty: Fix data race in tty_insert_flip_string_fixed_flag Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 198/336] media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open() Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit daab3349ad1a69663ccad278ed71d55974d104b4 ]

We are not releasing the link GPIO descriptor with gpiod_put() which results in
subsequent probing to get -EBUSY when calling fwnode_get_named_gpiod(). Fix this
by doing the release in phylink_destroy().

Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phylink.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -612,6 +612,8 @@ void phylink_destroy(struct phylink *pl)
 {
 	if (pl->sfp_bus)
 		sfp_unregister_upstream(pl->sfp_bus);
+	if (!IS_ERR(pl->link_gpio))
+		gpiod_put(pl->link_gpio);
 
 	cancel_work_sync(&pl->resolve);
 	kfree(pl);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 198/336] media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 197/336] net: phy: phylink: Release link GPIO Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 199/336] libata: Fix command retry decision Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wei Yongjun, Mikhail Ulyanov,
	Kieran Bingham, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>

[ Upstream commit 43d0d3c52787df0221d1c52494daabd824fe84f1 ]

Add the missing clk_disable_unprepare() before return from
jpu_open() in the software reset error handling case.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Acked-by: Mikhail Ulyanov <mikhail.ulyanov@cogentembedded.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/rcar_jpu.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/media/platform/rcar_jpu.c
+++ b/drivers/media/platform/rcar_jpu.c
@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file)
 		/* ...issue software reset */
 		ret = jpu_reset(jpu);
 		if (ret)
-			goto device_prepare_rollback;
+			goto jpu_reset_rollback;
 	}
 
 	jpu->ref_count++;
@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file)
 	mutex_unlock(&jpu->mutex);
 	return 0;
 
+jpu_reset_rollback:
+	clk_disable_unprepare(jpu->clk);
 device_prepare_rollback:
 	mutex_unlock(&jpu->mutex);
 v4l_prepare_rollback:



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 199/336] libata: Fix command retry decision
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 198/336] media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open() Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 200/336] ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Hannes Reinecke,
	Tejun Heo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Damien Le Moal <damien.lemoal@wdc.com>

[ Upstream commit 804689ad2d9b66d0d3920b48cf05881049d44589 ]

For failed commands with valid sense data (e.g. NCQ commands),
scsi_check_sense() is used in ata_analyze_tf() to determine if the
command can be retried. In such case, rely on this decision and ignore
the command error mask based decision done in ata_worth_retry().

This fixes useless retries of commands such as unaligned writes on zoned
disks (TYPE_ZAC).

Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libata-eh.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2218,12 +2218,16 @@ static void ata_eh_link_autopsy(struct a
 		if (qc->err_mask & ~AC_ERR_OTHER)
 			qc->err_mask &= ~AC_ERR_OTHER;
 
-		/* SENSE_VALID trumps dev/unknown error and revalidation */
+		/*
+		 * SENSE_VALID trumps dev/unknown error and revalidation. Upper
+		 * layers will determine whether the command is worth retrying
+		 * based on the sense data and device class/type. Otherwise,
+		 * determine directly if the command is worth retrying using its
+		 * error mask and flags.
+		 */
 		if (qc->flags & ATA_QCFLAG_SENSE_VALID)
 			qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
-
-		/* determine whether the command is worth retrying */
-		if (ata_eh_worth_retry(qc))
+		else if (ata_eh_worth_retry(qc))
 			qc->flags |= ATA_QCFLAG_RETRY;
 
 		/* accumulate error info */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 200/336] ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 199/336] libata: Fix command retry decision Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 201/336] media: media-device: fix ioctl function types Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Andy Shevchenko,
	Rafael J. Wysocki, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit c975e472ec12392a0c34de1350e634310f8a1dea ]

The Point of View mobii wintab p800w Bay Trail tablet comes with a Crystal
Cove PMIC, yet uses the LPSS PWM for backlight control, rather then the
Crystal Cove's PWM, so we need to call pwm_add_table() to add a
pwm_backlight mapping for the LPSS pwm despite there being an INT33FD
ACPI device present.

On all Bay Trail devices the _HRV object of the INT33FD ACPI device
will normally return 2, to indicate the Bay Trail variant of the CRC
PMIC is present, except on this tablet where _HRV is 0xffff. I guess this
is a hack to make the windows Crystal Cove PWM driver not bind.

Out of the 44 DSTDs with an INT33FD device in there which I have (from
different model devices) only the pov mobii wintab p800w uses 0xffff for
the HRV.

The byt_pwm_setup code calls acpi_dev_present to check for the presence
of a INT33FD ACPI device which indicates that a CRC PMIC is present and
if the INT33FD ACPI device is present then byt_pwm_setup will not add
a pwm_backlight mapping for the LPSS pwm, so that the CRC PWM will get
used instead.

acpi_dev_present has a hrv parameter, this commit make us pass 2 instead
of -1, so that things still match on normal tablets, but on this special
case with its _HRV of 0xffff, the check will now fail so that the
pwm_backlight mapping for the LPSS pwm gets added fixing backlight
brightness control on this device.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/acpi_lpss.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -70,6 +70,10 @@ ACPI_MODULE_NAME("acpi_lpss");
 #define LPSS_SAVE_CTX			BIT(4)
 #define LPSS_NO_D3_DELAY		BIT(5)
 
+/* Crystal Cove PMIC shares same ACPI ID between different platforms */
+#define BYT_CRC_HRV			2
+#define CHT_CRC_HRV			3
+
 struct lpss_private_data;
 
 struct lpss_device_desc {
@@ -163,7 +167,7 @@ static void byt_pwm_setup(struct lpss_pr
 	if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
 		return;
 
-	if (!acpi_dev_present("INT33FD", NULL, -1))
+	if (!acpi_dev_present("INT33FD", NULL, BYT_CRC_HRV))
 		pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup));
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 201/336] media: media-device: fix ioctl function types
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 200/336] ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 202/336] media: saa7164: Fix driver name in debug output Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Sakari Ailus,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sami Tolvanen <samitolvanen@google.com>

[ Upstream commit daa36370b62428cca6d48d1b2530a8419f631c8c ]

This change fixes function types for media device ioctls to avoid
indirect call mismatches with Control-Flow Integrity checking.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/media-device.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -54,9 +54,10 @@ static int media_device_close(struct fil
 	return 0;
 }
 
-static int media_device_get_info(struct media_device *dev,
-				 struct media_device_info *info)
+static long media_device_get_info(struct media_device *dev, void *arg)
 {
+	struct media_device_info *info = arg;
+
 	memset(info, 0, sizeof(*info));
 
 	if (dev->driver_name[0])
@@ -93,9 +94,9 @@ static struct media_entity *find_entity(
 	return NULL;
 }
 
-static long media_device_enum_entities(struct media_device *mdev,
-				       struct media_entity_desc *entd)
+static long media_device_enum_entities(struct media_device *mdev, void *arg)
 {
+	struct media_entity_desc *entd = arg;
 	struct media_entity *ent;
 
 	ent = find_entity(mdev, entd->id);
@@ -146,9 +147,9 @@ static void media_device_kpad_to_upad(co
 	upad->flags = kpad->flags;
 }
 
-static long media_device_enum_links(struct media_device *mdev,
-				    struct media_links_enum *links)
+static long media_device_enum_links(struct media_device *mdev, void *arg)
 {
+	struct media_links_enum *links = arg;
 	struct media_entity *entity;
 
 	entity = find_entity(mdev, links->entity);
@@ -195,9 +196,9 @@ static long media_device_enum_links(stru
 	return 0;
 }
 
-static long media_device_setup_link(struct media_device *mdev,
-				    struct media_link_desc *linkd)
+static long media_device_setup_link(struct media_device *mdev, void *arg)
 {
+	struct media_link_desc *linkd = arg;
 	struct media_link *link = NULL;
 	struct media_entity *source;
 	struct media_entity *sink;
@@ -225,9 +226,9 @@ static long media_device_setup_link(stru
 	return __media_entity_setup_link(link, linkd->flags);
 }
 
-static long media_device_get_topology(struct media_device *mdev,
-				      struct media_v2_topology *topo)
+static long media_device_get_topology(struct media_device *mdev, void *arg)
 {
+	struct media_v2_topology *topo = arg;
 	struct media_entity *entity;
 	struct media_interface *intf;
 	struct media_pad *pad;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 202/336] media: saa7164: Fix driver name in debug output
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 201/336] media: media-device: fix ioctl function types Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 203/336] media: renesas-ceu: Set mbus_fmt on subdev operations Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Love, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brad Love <brad@nextdimension.cc>

[ Upstream commit 0cc4655cb57af0b7e105d075c4f83f8046efafe7 ]

This issue was reported by a user who downloaded a corrupt saa7164
firmware, then went looking for a valid xc5000 firmware to fix the
error displayed...but the device in question has no xc5000, thus after
much effort, the wild goose chase eventually led to a support call.

The xc5000 has nothing to do with saa7164 (as far as I can tell),
so replace the string with saa7164 as well as give a meaningful
hint on the firmware mismatch.

Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/saa7164/saa7164-fw.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/media/pci/saa7164/saa7164-fw.c
+++ b/drivers/media/pci/saa7164/saa7164-fw.c
@@ -426,7 +426,8 @@ int saa7164_downloadfirmware(struct saa7
 			__func__, fw->size);
 
 		if (fw->size != fwlength) {
-			printk(KERN_ERR "xc5000: firmware incorrect size\n");
+			printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n",
+				fw->size, fwlength);
 			ret = -ENOMEM;
 			goto out;
 		}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 203/336] media: renesas-ceu: Set mbus_fmt on subdev operations
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 202/336] media: saa7164: Fix driver name in debug output Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:48 ` [PATCH 4.17 204/336] media: em28xx: Fix DualHD broken second tuner Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit d3a67f27471d4792caf84132228def2b18617932 ]

The renesas-ceu driver intializes the desired mbus_format at 'complete'
time, inspecting the supported subdevice ones, and tuning some
parameters to produce the requested memory format from what the sensor
can produce. Although, the initially selected mbus_format was not
provided to the subdevice during set_fmt and try_fmt operations,
providing instead a '0' mbus format code.

As long as the sensor defaults to a compatible mbus_format when an
invalid code as '0' is provided, capture operations work correctly. If
the subdevice defaults to an unsupported format (eg. some RGB
permutations) capture does not work properly due to a mismatch on the
expected and received image format on the wire.

Fix that by re-using the initially selected mbus_format code during
set_fmt and try_fmt subdevice operation calls.

Tested by printing out the format selection procedure with ov7670
sensor.

Before this patch:
[    0.866001] ov7670_try_fmt_internal -- Looking for mbus_code 0x0000
[    0.870882] ov7670_try_fmt_internal -- Try mbus_code 0x2008
[    0.876336] ov7670_try_fmt_internal -- Try mbus_code 0x1002
[    0.881387] ov7670_try_fmt_internal -- Try mbus_code 0x1008
[    0.886537] ov7670_try_fmt_internal -- Try mbus_code 0x3001
[    0.891584] ov7670_try_fmt_internal -- mbus_code defaulted to 0x2008

With this patch applied:
[    0.867015] ov7670_try_fmt_internal -- Looking for mbus_code 0x2008
[    0.873205] ov7670_try_fmt_internal -- Try mbus_code 0x2008: match

Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/renesas-ceu.c |   20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

--- a/drivers/media/platform/renesas-ceu.c
+++ b/drivers/media/platform/renesas-ceu.c
@@ -777,8 +777,15 @@ static int ceu_try_fmt(struct ceu_device
 	const struct ceu_fmt *ceu_fmt;
 	int ret;
 
+	/*
+	 * Set format on sensor sub device: bus format used to produce memory
+	 * format is selected at initialization time.
+	 */
 	struct v4l2_subdev_format sd_format = {
-		.which = V4L2_SUBDEV_FORMAT_TRY,
+		.which	= V4L2_SUBDEV_FORMAT_TRY,
+		.format	= {
+			.code = ceu_sd->mbus_fmt.mbus_code,
+		},
 	};
 
 	switch (pix->pixelformat) {
@@ -800,10 +807,6 @@ static int ceu_try_fmt(struct ceu_device
 	v4l_bound_align_image(&pix->width, 2, CEU_MAX_WIDTH, 4,
 			      &pix->height, 4, CEU_MAX_HEIGHT, 4, 0);
 
-	/*
-	 * Set format on sensor sub device: bus format used to produce memory
-	 * format is selected at initialization time.
-	 */
 	v4l2_fill_mbus_format_mplane(&sd_format.format, pix);
 	ret = v4l2_subdev_call(v4l2_sd, pad, set_fmt, &pad_cfg, &sd_format);
 	if (ret)
@@ -827,8 +830,15 @@ static int ceu_set_fmt(struct ceu_device
 	struct v4l2_subdev *v4l2_sd = ceu_sd->v4l2_sd;
 	int ret;
 
+	/*
+	 * Set format on sensor sub device: bus format used to produce memory
+	 * format is selected at initialization time.
+	 */
 	struct v4l2_subdev_format format = {
 		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+		.format	= {
+			.code = ceu_sd->mbus_fmt.mbus_code,
+		},
 	};
 
 	ret = ceu_try_fmt(ceudev, v4l2_fmt);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 204/336] media: em28xx: Fix DualHD broken second tuner
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 203/336] media: renesas-ceu: Set mbus_fmt on subdev operations Greg Kroah-Hartman
@ 2018-08-01 16:48 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 205/336] mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Love, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brad Love <brad@nextdimension.cc>

[ Upstream commit 01affb000e00cfa0a9e9954476ef50962eb8b168 ]

The use of a hard coded i2c address breaks the creation of the
second tuner in DualHD 01595 models. The issue is compounded
by lack of any error message stating that a driver failed
initialization. Use addr, which contains the correct address
for each tuner.

Fixes: ad32495b1513 ("media: em28xx-dvb: simplify DVB module probing logic")

Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/em28xx/em28xx-dvb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -1392,7 +1392,7 @@ static int em28174_dvb_init_hauppauge_wi
 
 	dvb->i2c_client_tuner = dvb_module_probe("si2157", NULL,
 						 adapter,
-						 0x60, &si2157_config);
+						 addr, &si2157_config);
 	if (!dvb->i2c_client_tuner) {
 		dvb_module_release(dvb->i2c_client_demod);
 		return -ENODEV;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 205/336] mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2018-08-01 16:48 ` [PATCH 4.17 204/336] media: em28xx: Fix DualHD broken second tuner Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 206/336] brcmfmac: Add support for bcm43364 wireless chipset Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jane Wan, Boris Brezillon, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jane Wan <Jane.Wan@nokia.com>

[ Upstream commit a75bbe71a27875fdc61cde1af6d799037cef6bed ]

Per ONFI specification (Rev. 4.0), if the CRC of the first parameter page
read is not valid, the host should read redundant parameter page copies.
Fix FSL NAND driver to read the two redundant copies which are mandatory
in the specification.

Signed-off-by: Jane Wan <Jane.Wan@nokia.com>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/fsl_ifc_nand.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
@@ -342,9 +342,16 @@ static void fsl_ifc_cmdfunc(struct mtd_i
 
 	case NAND_CMD_READID:
 	case NAND_CMD_PARAM: {
+		/*
+		 * For READID, read 8 bytes that are currently used.
+		 * For PARAM, read all 3 copies of 256-bytes pages.
+		 */
+		int len = 8;
 		int timing = IFC_FIR_OP_RB;
-		if (command == NAND_CMD_PARAM)
+		if (command == NAND_CMD_PARAM) {
 			timing = IFC_FIR_OP_RBCD;
+			len = 256 * 3;
+		}
 
 		ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
 			  (IFC_FIR_OP_UA  << IFC_NAND_FIR0_OP1_SHIFT) |
@@ -354,12 +361,8 @@ static void fsl_ifc_cmdfunc(struct mtd_i
 			  &ifc->ifc_nand.nand_fcr0);
 		ifc_out32(column, &ifc->ifc_nand.row3);
 
-		/*
-		 * although currently it's 8 bytes for READID, we always read
-		 * the maximum 256 bytes(for PARAM)
-		 */
-		ifc_out32(256, &ifc->ifc_nand.nand_fbcr);
-		ifc_nand_ctrl->read_bytes = 256;
+		ifc_out32(len, &ifc->ifc_nand.nand_fbcr);
+		ifc_nand_ctrl->read_bytes = len;
 
 		set_addr(mtd, 0, 0, 0);
 		fsl_ifc_run_command(mtd);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 206/336] brcmfmac: Add support for bcm43364 wireless chipset
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 205/336] mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 207/336] s390/cpum_sf: Add data entry sizes to sampling trailer entry Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Lanigan, Ulf Hansson,
	Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sean Lanigan <sean@lano.id.au>

[ Upstream commit 9c4a121e82634aa000a702c98cd6f05b27d6e186 ]

Add support for the BCM43364 chipset via an SDIO interface, as used in
e.g. the Murata 1FX module.

The BCM43364 uses the same firmware as the BCM43430 (which is already
included), the only difference is the omission of Bluetooth.

However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
triggers the brcmfmac driver to load, and then correctly use the
firmware file 'brcmfmac43430-sdio.bin'.

Signed-off-by: Sean Lanigan <sean@lano.id.au>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |    1 +
 include/linux/mmc/sdio_ids.h                              |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -35,6 +35,7 @@
 #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
 #define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
 #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
+#define SDIO_DEVICE_ID_BROADCOM_43364		0xa9a4
 #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
 #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
 #define SDIO_DEVICE_ID_BROADCOM_43455		0xa9bf



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 207/336] s390/cpum_sf: Add data entry sizes to sampling trailer entry
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 206/336] brcmfmac: Add support for bcm43364 wireless chipset Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 208/336] perf: fix invalid bit in diagnostic entry Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
	Martin Schwidefsky, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Richter <tmricht@linux.ibm.com>

[ Upstream commit 77715b7ddb446bd39a06f3376e85f4bb95b29bb8 ]

The CPU Measurement sampling facility creates a trailer entry for each
Sample-Data-Block of stored samples. The trailer entry contains the sizes
(in bytes) of the stored sampling types:
 - basic-sampling data entry size
 - diagnostic-sampling data entry size
Both sizes are 2 bytes long.

This patch changes the trailer entry definition to reflect this.

Fixes: fcc77f507333 ("s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/cpu_mf.h |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -129,7 +129,9 @@ struct hws_trailer_entry {
 			unsigned int f:1;	/* 0 - Block Full Indicator   */
 			unsigned int a:1;	/* 1 - Alert request control  */
 			unsigned int t:1;	/* 2 - Timestamp format	      */
-			unsigned long long:61;	/* 3 - 63: Reserved	      */
+			unsigned int :29;	/* 3 - 31: Reserved	      */
+			unsigned int bsdes:16;	/* 32-47: size of basic SDE   */
+			unsigned int dsdes:16;	/* 48-63: size of diagnostic SDE */
 		};
 		unsigned long long flags;	/* 0 - 63: All indicators     */
 	};



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 208/336] perf: fix invalid bit in diagnostic entry
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 207/336] s390/cpum_sf: Add data entry sizes to sampling trailer entry Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 209/336] net: phy: sfp: handle cases where neither BR, min nor BR, max is given Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
	Martin Schwidefsky, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Richter <tmricht@linux.ibm.com>

[ Upstream commit 3c0a83b14ea71fef5ccc93a3bd2de5f892be3194 ]

The s390 CPU measurement facility sampling mode supports basic entries
and diagnostic entries. Each entry has a valid bit to indicate the
status of the entry as valid or invalid.

This bit is bit 31 in the diagnostic entry, but the bit mask definition
refers to bit 30.

Fix this by making the reserved field one bit larger.

Fixes: 7e75fc3ff4cf ("s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/cpu_mf.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -113,7 +113,7 @@ struct hws_basic_entry {
 
 struct hws_diag_entry {
 	unsigned int def:16;	    /* 0-15  Data Entry Format		 */
-	unsigned int R:14;	    /* 16-19 and 20-30 reserved		 */
+	unsigned int R:15;	    /* 16-19 and 20-30 reserved		 */
 	unsigned int I:1;	    /* 31 entry valid or invalid	 */
 	u8	     data[];	    /* Machine-dependent sample data	 */
 } __packed;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 209/336] net: phy: sfp: handle cases where neither BR, min nor BR, max is given
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 208/336] perf: fix invalid bit in diagnostic entry Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 210/336] bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antoine Tenart, Russell King,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Antoine Tenart <antoine.tenart@bootlin.com>

[ Upstream commit 2b999ba899059eed00a03d029894a62486e7e2bc ]

When computing the bitrate using values read from an SFP module EEPROM,
we use the nominal BR plus BR,min and BR,max to determine the
boundaries. But in some cases BR,min and BR,max aren't provided, which
led the SFP code to end up having the nominal value for both the minimum
and maximum bitrate values. When using a passive cable, the nominal
value should be used as the maximum one, and there is no minimum one
so we should use 0.

Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/sfp-bus.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -132,6 +132,13 @@ void sfp_parse_support(struct sfp_bus *b
 			br_max = br_nom + br_nom * id->ext.br_min / 100;
 			br_min = br_nom - br_nom * id->ext.br_min / 100;
 		}
+
+		/* When using passive cables, in case neither BR,min nor BR,max
+		 * are specified, set br_min to 0 as the nominal value is then
+		 * used as the maximum.
+		 */
+		if (br_min == br_max && id->base.sfp_ct_passive)
+			br_min = 0;
 	}
 
 	/* Set ethtool support from the compliance fields. */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 210/336] bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only.
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 209/336] net: phy: sfp: handle cases where neither BR, min nor BR, max is given Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 211/336] bnxt_en: Always forward VF MAC address to the PF Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Chan <michael.chan@broadcom.com>

[ Upstream commit dac0490718bd17df5e3995ffca14255e5f9ed22d ]

Only non-NPAR PFs need to actively check and manage unsupported link
speeds.  NPAR functions and VFs do not control the link speed and
should skip the unsupported speed detection logic, to avoid warning
messages from firmware rejecting the unsupported firmware calls.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6457,6 +6457,9 @@ static int bnxt_update_link(struct bnxt
 	}
 	mutex_unlock(&bp->hwrm_cmd_lock);
 
+	if (!BNXT_SINGLE_PF(bp))
+		return 0;
+
 	diff = link_info->support_auto_speeds ^ link_info->advertising;
 	if ((link_info->support_auto_speeds | diff) !=
 	    link_info->support_auto_speeds) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 211/336] bnxt_en: Always forward VF MAC address to the PF.
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 210/336] bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 212/336] mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Chan <michael.chan@broadcom.com>

[ Upstream commit 707e7e96602675beb5e09bb994195663da6eb56d ]

The current code already forwards the VF MAC address to the PF, except
in one case.  If the VF driver gets a valid MAC address from the firmware
during probe time, it will not forward the MAC address to the PF,
incorrectly assuming that the PF already knows the MAC address.  This
causes "ip link show" to show zero VF MAC addresses for this case.

This assumption is not correct.  Newer firmware remembers the VF MAC
address last used by the VF and provides it to the VF driver during
probe.  So we need to always forward the VF MAC address to the PF.

The forwarded MAC address may now be the PF assigned MAC address and so we
need to make sure we approve it for this case.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c       |    2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c |    3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -8617,8 +8617,8 @@ static int bnxt_init_mac_addr(struct bnx
 			memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
 		} else {
 			eth_hw_addr_random(bp->dev);
-			rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
 		}
+		rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
 #endif
 	}
 	return rc;
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -914,7 +914,8 @@ static int bnxt_vf_configure_mac(struct
 	if (req->enables & cpu_to_le32(FUNC_VF_CFG_REQ_ENABLES_DFLT_MAC_ADDR)) {
 		if (is_valid_ether_addr(req->dflt_mac_addr) &&
 		    ((vf->flags & BNXT_VF_TRUST) ||
-		     (!is_valid_ether_addr(vf->mac_addr)))) {
+		     !is_valid_ether_addr(vf->mac_addr) ||
+		     ether_addr_equal(req->dflt_mac_addr, vf->mac_addr))) {
 			ether_addr_copy(vf->vf_mac_addr, req->dflt_mac_addr);
 			return bnxt_hwrm_exec_fwd_resp(bp, vf, msg_size);
 		}



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 212/336] mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 211/336] bnxt_en: Always forward VF MAC address to the PF Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 213/336] staging: most: cdev: fix chrdev_region leak Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dave Hansen, Ram Pai, Ingo Molnar,
	Aneesh Kumar K.V, Michael Ellerman, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ram Pai <linuxram@us.ibm.com>

[ Upstream commit 5212213aa5a2359dd0474c9dab22b6220b591fe1 ]

VM_PKEY_BITx are defined only if CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
is enabled. Powerpc also needs these bits. Hence lets define the
VM_PKEY_BITx bits for any architecture that enables
CONFIG_ARCH_HAS_PKEYS.

Reviewed-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Ram Pai <linuxram@us.ibm.com>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/pkeys.h |    2 ++
 fs/proc/task_mmu.c               |    4 ++--
 include/linux/mm.h               |    9 +++++----
 3 files changed, 9 insertions(+), 6 deletions(-)

--- a/arch/powerpc/include/asm/pkeys.h
+++ b/arch/powerpc/include/asm/pkeys.h
@@ -26,6 +26,8 @@ extern u32 initial_allocation_mask; /* b
 # define VM_PKEY_BIT2	VM_HIGH_ARCH_2
 # define VM_PKEY_BIT3	VM_HIGH_ARCH_3
 # define VM_PKEY_BIT4	VM_HIGH_ARCH_4
+#elif !defined(VM_PKEY_BIT4)
+# define VM_PKEY_BIT4	VM_HIGH_ARCH_4
 #endif
 
 #define ARCH_VM_PKEY_FLAGS (VM_PKEY_BIT0 | VM_PKEY_BIT1 | VM_PKEY_BIT2 | \
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -673,13 +673,13 @@ static void show_smap_vma_flags(struct s
 		[ilog2(VM_MERGEABLE)]	= "mg",
 		[ilog2(VM_UFFD_MISSING)]= "um",
 		[ilog2(VM_UFFD_WP)]	= "uw",
-#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+#ifdef CONFIG_ARCH_HAS_PKEYS
 		/* These come out via ProtectionKey: */
 		[ilog2(VM_PKEY_BIT0)]	= "",
 		[ilog2(VM_PKEY_BIT1)]	= "",
 		[ilog2(VM_PKEY_BIT2)]	= "",
 		[ilog2(VM_PKEY_BIT3)]	= "",
-#endif
+#endif /* CONFIG_ARCH_HAS_PKEYS */
 	};
 	size_t i;
 
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -228,15 +228,16 @@ extern unsigned int kobjsize(const void
 #define VM_HIGH_ARCH_4	BIT(VM_HIGH_ARCH_BIT_4)
 #endif /* CONFIG_ARCH_USES_HIGH_VMA_FLAGS */
 
-#if defined(CONFIG_X86)
-# define VM_PAT		VM_ARCH_1	/* PAT reserves whole VMA at once (x86) */
-#if defined (CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS)
+#ifdef CONFIG_ARCH_HAS_PKEYS
 # define VM_PKEY_SHIFT	VM_HIGH_ARCH_BIT_0
 # define VM_PKEY_BIT0	VM_HIGH_ARCH_0	/* A protection key is a 4-bit value */
 # define VM_PKEY_BIT1	VM_HIGH_ARCH_1
 # define VM_PKEY_BIT2	VM_HIGH_ARCH_2
 # define VM_PKEY_BIT3	VM_HIGH_ARCH_3
-#endif
+#endif /* CONFIG_ARCH_HAS_PKEYS */
+
+#if defined(CONFIG_X86)
+# define VM_PAT		VM_ARCH_1	/* PAT reserves whole VMA at once (x86) */
 #elif defined(CONFIG_PPC)
 # define VM_SAO		VM_ARCH_1	/* Strong Access Ordering (powerpc) */
 #elif defined(CONFIG_PARISC)



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 213/336] staging: most: cdev: fix chrdev_region leak
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 212/336] mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 214/336] scsi: 3w-9xxx: fix a missing-check bug Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christian Gromm, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christian Gromm <christian.gromm@microchip.com>

[ Upstream commit aba258b73101670c06b1dd700e500ed0a3fa0e8e ]

The function unregister_chrdev_region is called with a different counter
as the alloc_chrdev_region. To fix this, this patch introduces the
constant CHRDEV_REGION_SIZE that is used in both functions.

Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/most/cdev/cdev.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/staging/most/cdev/cdev.c
+++ b/drivers/staging/most/cdev/cdev.c
@@ -18,6 +18,8 @@
 #include <linux/idr.h>
 #include "most/core.h"
 
+#define CHRDEV_REGION_SIZE 50
+
 static struct cdev_component {
 	dev_t devno;
 	struct ida minor_id;
@@ -513,7 +515,7 @@ static int __init mod_init(void)
 	spin_lock_init(&ch_list_lock);
 	ida_init(&comp.minor_id);
 
-	err = alloc_chrdev_region(&comp.devno, 0, 50, "cdev");
+	err = alloc_chrdev_region(&comp.devno, 0, CHRDEV_REGION_SIZE, "cdev");
 	if (err < 0)
 		goto dest_ida;
 	comp.major = MAJOR(comp.devno);
@@ -523,7 +525,7 @@ static int __init mod_init(void)
 	return 0;
 
 free_cdev:
-	unregister_chrdev_region(comp.devno, 1);
+	unregister_chrdev_region(comp.devno, CHRDEV_REGION_SIZE);
 dest_ida:
 	ida_destroy(&comp.minor_id);
 	class_destroy(comp.class);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 214/336] scsi: 3w-9xxx: fix a missing-check bug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 213/336] staging: most: cdev: fix chrdev_region leak Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 215/336] scsi: 3w-xxxx: " Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Adam Radford,
	Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wenwen Wang <wang6495@umn.edu>

[ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ]

In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from
the userspace pointer 'argp' and saved to the kernel object
'driver_command'.  Then a security check is performed on the data buffer
size indicated by 'driver_command', which is
'driver_command.buffer_length'. If the security check is passed, the
entire ioctl command is copied again from the 'argp' pointer and saved
to the kernel object 'tw_ioctl'. Then, various operations are performed
on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer
resides in userspace, a malicious userspace process can race to change
the buffer size between the two copies. This way, the user can bypass
the security check and inject invalid data buffer size. This can cause
potential security issues in the following execution.

This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o
avoid the above issues.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/3w-9xxx.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -882,6 +882,11 @@ static int twa_chrdev_open(struct inode
 	unsigned int minor_number;
 	int retval = TW_IOCTL_ERROR_OS_ENODEV;
 
+	if (!capable(CAP_SYS_ADMIN)) {
+		retval = -EACCES;
+		goto out;
+	}
+
 	minor_number = iminor(inode);
 	if (minor_number >= twa_device_extension_count)
 		goto out;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 215/336] scsi: 3w-xxxx: fix a missing-check bug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 214/336] scsi: 3w-9xxx: fix a missing-check bug Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 216/336] scsi: megaraid: silence a static checker bug Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Adam Radford,
	Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wenwen Wang <wang6495@umn.edu>

[ Upstream commit 9899e4d3523faaef17c67141aa80ff2088f17871 ]

In tw_chrdev_ioctl(), the length of the data buffer is firstly copied
from the userspace pointer 'argp' and saved to the kernel object
'data_buffer_length'. Then a security check is performed on it to make
sure that the length is not more than 'TW_MAX_IOCTL_SECTORS *
512'. Otherwise, an error code -EINVAL is returned. If the security
check is passed, the entire ioctl command is copied again from the
'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various
operations are performed on 'tw_ioctl' according to the 'cmd'. Given
that the 'argp' pointer resides in userspace, a malicious userspace
process can race to change the buffer length between the two
copies. This way, the user can bypass the security check and inject
invalid data buffer length. This can cause potential security issues in
the following execution.

This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to
avoid the above issues.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/3w-xxxx.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *
 
 	dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
 	minor_number = iminor(inode);
 	if (minor_number >= tw_device_extension_count)
 		return -ENODEV;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 216/336] scsi: megaraid: silence a static checker bug
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 215/336] scsi: 3w-xxxx: " Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 217/336] scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Martin K. Petersen,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 27e833dabab74ee665e487e291c9afc6d71effba ]

If we had more than 32 megaraid cards then it would cause memory
corruption.  That's not likely, of course, but it's handy to enforce it
and make the static checker happy.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/megaraid.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4199,6 +4199,9 @@ megaraid_probe_one(struct pci_dev *pdev,
 	int irq, i, j;
 	int error = -ENODEV;
 
+	if (hba_count >= MAX_CONTROLLERS)
+		goto out;
+
 	if (pci_enable_device(pdev))
 		goto out;
 	pci_set_master(pdev);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 217/336] scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 216/336] scsi: megaraid: silence a static checker bug Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 218/336] soc/tegra: pmc: Dont allocate struct tegra_powergate on stack Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiang Chen, John Garry,
	Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xiang Chen <chenxiang66@hisilicon.com>

[ Upstream commit 9413532788df7470297dd0475995c5dc5b07f362 ]

As a unconstrained command, a command can be sent to SATA disk even if
SATA disk status is BUSY, ERR or DRQ.

If an ATA reset assert is successful but ATA reset de-assert fails, then
it will retry the reset de-assert. If reset de- assert retry is
successful, we think it is okay to probe the device but actually it
still has Err status.

Apparently we need to retry the ATA reset assertion and de- assertion
instead for this mentioned scenario.

As such, we config ATA reset assert as a constrained command, if ATA
reset de-assert fails, then ATA reset de-assert retry will also
fail. Then we will retry the proper process of ATA reset assert and
de-assert again.

Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -348,10 +348,11 @@ struct hisi_sas_err_record_v3 {
 #define DIR_TO_DEVICE 2
 #define DIR_RESERVED 3
 
-#define CMD_IS_UNCONSTRAINT(cmd) \
-	((cmd == ATA_CMD_READ_LOG_EXT) || \
-	(cmd == ATA_CMD_READ_LOG_DMA_EXT) || \
-	(cmd == ATA_CMD_DEV_RESET))
+#define FIS_CMD_IS_UNCONSTRAINED(fis) \
+	((fis.command == ATA_CMD_READ_LOG_EXT) || \
+	(fis.command == ATA_CMD_READ_LOG_DMA_EXT) || \
+	((fis.command == ATA_CMD_DEV_RESET) && \
+	((fis.control & ATA_SRST) != 0)))
 
 static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off)
 {
@@ -1046,7 +1047,7 @@ static int prep_ata_v3_hw(struct hisi_hb
 		<< CMD_HDR_FRAME_TYPE_OFF;
 	dw1 |= sas_dev->device_id << CMD_HDR_DEV_ID_OFF;
 
-	if (CMD_IS_UNCONSTRAINT(task->ata_task.fis.command))
+	if (FIS_CMD_IS_UNCONSTRAINED(task->ata_task.fis))
 		dw1 |= 1 << CMD_HDR_UNCON_CMD_OFF;
 
 	hdr->dw1 = cpu_to_le32(dw1);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 218/336] soc/tegra: pmc: Dont allocate struct tegra_powergate on stack
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 217/336] scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 219/336] scsi: qedf: Set the UNLOADING flag when removing a vport Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Viresh Kumar, Thierry Reding, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <viresh.kumar@linaro.org>

[ Upstream commit 495ac33a3b82f85ed4fbdd9b826c1d2fbc8e9b68 ]

With a later commit an instance of the struct device will be added to
struct genpd and with that the size of the struct tegra_powergate will
be over 1024 bytes. That generates following warning:

drivers/soc/tegra/pmc.c:579:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Avoid such warnings by allocating the structure dynamically.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/tegra/pmc.c |   20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -559,22 +559,28 @@ EXPORT_SYMBOL(tegra_powergate_remove_cla
 int tegra_powergate_sequence_power_up(unsigned int id, struct clk *clk,
 				      struct reset_control *rst)
 {
-	struct tegra_powergate pg;
+	struct tegra_powergate *pg;
 	int err;
 
 	if (!tegra_powergate_is_available(id))
 		return -EINVAL;
 
-	pg.id = id;
-	pg.clks = &clk;
-	pg.num_clks = 1;
-	pg.reset = rst;
-	pg.pmc = pmc;
+	pg = kzalloc(sizeof(*pg), GFP_KERNEL);
+	if (!pg)
+		return -ENOMEM;
 
-	err = tegra_powergate_power_up(&pg, false);
+	pg->id = id;
+	pg->clks = &clk;
+	pg->num_clks = 1;
+	pg->reset = rst;
+	pg->pmc = pmc;
+
+	err = tegra_powergate_power_up(pg, false);
 	if (err)
 		pr_err("failed to turn on partition %d: %d\n", id, err);
 
+	kfree(pg);
+
 	return err;
 }
 EXPORT_SYMBOL(tegra_powergate_sequence_power_up);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 219/336] scsi: qedf: Set the UNLOADING flag when removing a vport
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 218/336] soc/tegra: pmc: Dont allocate struct tegra_powergate on stack Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 220/336] dma-direct: try reallocation with GFP_DMA32 if possible Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chad Dupuis, Martin K. Petersen, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chad Dupuis <chad.dupuis@cavium.com>

[ Upstream commit 4f4616ceebaf045c59e8a6aa01f08826d18d5c63 ]

Similar to what we do when we remove a PCI function, set the
QEDF_UNLOADING flag to prevent any requests from being queued while a
vport is being deleted.  This prevents any requests from getting stuck
in limbo when the vport is unloaded or deleted.

Fixes the crash:

PID: 106676  TASK: ffff9a436aa90000  CPU: 12  COMMAND: "multipathd"
 #0 [ffff9a43567d3550] machine_kexec+522 at ffffffffaca60b2a
 #1 [ffff9a43567d35b0] __crash_kexec+114 at ffffffffacb13512
 #2 [ffff9a43567d3680] crash_kexec+48 at ffffffffacb13600
 #3 [ffff9a43567d3698] oops_end+168 at ffffffffad117768
 #4 [ffff9a43567d36c0] no_context+645 at ffffffffad106f52
 #5 [ffff9a43567d3710] __bad_area_nosemaphore+116 at ffffffffad106fe9
 #6 [ffff9a43567d3760] bad_area+70 at ffffffffad107379
 #7 [ffff9a43567d3788] __do_page_fault+1247 at ffffffffad11a8cf
 #8 [ffff9a43567d37f0] do_page_fault+53 at ffffffffad11a915
 #9 [ffff9a43567d3820] page_fault+40 at ffffffffad116768
    [exception RIP: qedf_init_task+61]
    RIP: ffffffffc0e13c2d  RSP: ffff9a43567d38d0  RFLAGS: 00010046
    RAX: 0000000000000000  RBX: ffffbe920472c738  RCX: ffff9a434fa0e3e8
    RDX: ffff9a434f695280  RSI: ffffbe920472c738  RDI: ffff9a43aa359c80
    RBP: ffff9a43567d3950   R8: 0000000000000c15   R9: ffff9a3fb09b9880
    R10: ffff9a434fa0e3e8  R11: ffff9a43567d35ce  R12: 0000000000000000
    R13: ffff9a434f695280  R14: ffff9a43aa359c80  R15: ffff9a3fb9e005c0
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018

Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qedf/qedf_main.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -1647,6 +1647,15 @@ static int qedf_vport_destroy(struct fc_
 	struct Scsi_Host *shost = vport_to_shost(vport);
 	struct fc_lport *n_port = shost_priv(shost);
 	struct fc_lport *vn_port = vport->dd_data;
+	struct qedf_ctx *qedf = lport_priv(vn_port);
+
+	if (!qedf) {
+		QEDF_ERR(NULL, "qedf is NULL.\n");
+		goto out;
+	}
+
+	/* Set unloading bit on vport qedf_ctx to prevent more I/O */
+	set_bit(QEDF_UNLOADING, &qedf->flags);
 
 	mutex_lock(&n_port->lp_mutex);
 	list_del(&vn_port->list);
@@ -1673,6 +1682,7 @@ static int qedf_vport_destroy(struct fc_
 	if (vn_port->host)
 		scsi_host_put(vn_port->host);
 
+out:
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 220/336] dma-direct: try reallocation with GFP_DMA32 if possible
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 219/336] scsi: qedf: Set the UNLOADING flag when removing a vport Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 221/336] staging: lustre: o2iblnd: fix race at kiblnd_connect_peer Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Christoph Hellwig, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit de7eab301de78869322104ea13e124c936ad3e1f ]

As the recent swiotlb bug revealed, we seem to have given up the direct
DMA allocation too early and felt back to swiotlb allocation.  The reason
is that swiotlb allocator expected that dma_direct_alloc() would try
harder to get pages even below 64bit DMA mask with GFP_DMA32, but the
function doesn't do that but only deals with GFP_DMA case.

This patch adds a similar fallback reallocation with GFP_DMA32 as we've
done with GFP_DMA.  The condition is that the coherent mask is smaller
than 64bit (i.e. some address limitation), and neither GFP_DMA nor
GFP_DMA32 is set beforehand.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/dma-direct.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,13 @@ again:
 		__free_pages(page, page_order);
 		page = NULL;
 
+		if (IS_ENABLED(CONFIG_ZONE_DMA32) &&
+		    dev->coherent_dma_mask < DMA_BIT_MASK(64) &&
+		    !(gfp & (GFP_DMA32 | GFP_DMA))) {
+			gfp |= GFP_DMA32;
+			goto again;
+		}
+
 		if (IS_ENABLED(CONFIG_ZONE_DMA) &&
 		    dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
 		    !(gfp & GFP_DMA)) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 221/336] staging: lustre: o2iblnd: fix race at kiblnd_connect_peer
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 220/336] dma-direct: try reallocation with GFP_DMA32 if possible Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 222/336] staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5 Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Boyko, Alexey Lyashkov,
	Doug Oucharek, John L. Hammond, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Doug Oucahrek <dougso@me.com>

[ Upstream commit cf04968efe341b9b1c30a527e5dd61b2af9c43d2 ]

cmid will be destroyed at OFED if kiblnd_cm_callback return error.
if error happen before the end of kiblnd_connect_peer, it will touch
destroyed cmid and fail as
(o2iblnd_cb.c:1315:kiblnd_connect_peer())
            ASSERTION( cmid->device != ((void *)0) ) failed:

Signed-off-by: Alexander Boyko <alexander.boyko@seagate.com>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10015
Reviewed-by: Alexey Lyashkov <c17817@cray.com>
Reviewed-by: Doug Oucharek <dougso@me.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Signed-off-by: Doug Oucharek <dougso@me.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c |   18 +++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -1290,11 +1290,6 @@ kiblnd_connect_peer(struct kib_peer *pee
 		goto failed2;
 	}
 
-	LASSERT(cmid->device);
-	CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n",
-	       libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname,
-	       &dev->ibd_ifip, cmid->device->name);
-
 	return;
 
  failed2:
@@ -2996,8 +2991,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cm
 		} else {
 			rc = rdma_resolve_route(
 				cmid, *kiblnd_tunables.kib_timeout * 1000);
-			if (!rc)
+			if (!rc) {
+				struct kib_net *net = peer->ibp_ni->ni_data;
+				struct kib_dev *dev = net->ibn_dev;
+
+				CDEBUG(D_NET, "%s: connection bound to "\
+				       "%s:%pI4h:%s\n",
+				       libcfs_nid2str(peer->ibp_nid),
+				       dev->ibd_ifname,
+				       &dev->ibd_ifip, cmid->device->name);
+
 				return 0;
+			}
+
 			/* Can't initiate route resolution */
 			CERROR("Can't resolve route for %s: %d\n",
 			       libcfs_nid2str(peer->ibp_nid), rc);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 222/336] staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 221/336] staging: lustre: o2iblnd: fix race at kiblnd_connect_peer Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 223/336] thermal: exynos: fix setting rising_threshold for Exynos5433 Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Oucharek, Andrew Perepechko,
	Dmitry Eremin, James Simmons, Oleg Drokin, Doug Oucharek,
	Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Doug Oucharek <dougso@me.com>

[ Upstream commit 24d4b7c8de007cff9c7d83c06ae76099fdcce008 ]

The FastReg support in ko2iblnd was not unmapping pool items
causing the items to leak.  In addition, the mapping code
is not growing the pool like we do with FMR.

This patch makes sure we are unmapping FastReg pool elements
when we are done with them.  It also makes sure the pool
will grow when we depleat the pool.

Signed-off-by: Doug Oucharek <doug.s.oucharek@intel.com>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9472
Reviewed-on: https://review.whamcloud.com/27015
Reviewed-by: Andrew Perepechko <andrew.perepechko@seagate.com>
Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
Reviewed-by: James Simmons <uja.ornl@yahoo.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Doug Oucharek <dougso@me.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c    |    2 +-
 drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c |   12 ++++--------
 2 files changed, 5 insertions(+), 9 deletions(-)

--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c
@@ -1702,7 +1702,7 @@ int kiblnd_fmr_pool_map(struct kib_fmr_p
 				return 0;
 			}
 			spin_unlock(&fps->fps_lock);
-			rc = -EBUSY;
+			rc = -EAGAIN;
 		}
 
 		spin_lock(&fps->fps_lock);
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -48,7 +48,7 @@ static int kiblnd_init_rdma(struct kib_c
 			    __u64 dstcookie);
 static void kiblnd_queue_tx_locked(struct kib_tx *tx, struct kib_conn *conn);
 static void kiblnd_queue_tx(struct kib_tx *tx, struct kib_conn *conn);
-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx);
+static void kiblnd_unmap_tx(struct kib_tx *tx);
 static void kiblnd_check_sends_locked(struct kib_conn *conn);
 
 static void
@@ -66,7 +66,7 @@ kiblnd_tx_done(struct lnet_ni *ni, struc
 	LASSERT(!tx->tx_waiting);	      /* mustn't be awaiting peer response */
 	LASSERT(tx->tx_pool);
 
-	kiblnd_unmap_tx(ni, tx);
+	kiblnd_unmap_tx(tx);
 
 	/* tx may have up to 2 lnet msgs to finalise */
 	lntmsg[0] = tx->tx_lntmsg[0]; tx->tx_lntmsg[0] = NULL;
@@ -591,13 +591,9 @@ kiblnd_fmr_map_tx(struct kib_net *net, s
 	return 0;
 }
 
-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx)
+static void kiblnd_unmap_tx(struct kib_tx *tx)
 {
-	struct kib_net *net = ni->ni_data;
-
-	LASSERT(net);
-
-	if (net->ibn_fmr_ps)
+	if (tx->fmr.fmr_pfmr || tx->fmr.fmr_frd)
 		kiblnd_fmr_pool_unmap(&tx->fmr, tx->tx_status);
 
 	if (tx->tx_nfrags) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 223/336] thermal: exynos: fix setting rising_threshold for Exynos5433
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 222/336] staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5 Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 224/336] regulator: add dummy function of_find_regulator_by_node Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bartlomiej Zolnierkiewicz,
	Eduardo Valentin, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

[ Upstream commit 8bfc218d0ebbabcba8ed2b8ec1831e0cf1f71629 ]

Add missing clearing of the previous value when setting rising
temperature threshold.

Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thermal/samsung/exynos_tmu.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(str
 		threshold_code = temp_to_code(data, temp);
 
 		rising_threshold = readl(data->base + rising_reg_offset);
+		rising_threshold &= ~(0xff << j * 8);
 		rising_threshold |= (threshold_code << j * 8);
 		writel(rising_threshold, data->base + rising_reg_offset);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 224/336] regulator: add dummy function of_find_regulator_by_node
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 223/336] thermal: exynos: fix setting rising_threshold for Exynos5433 Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 225/336] bpf: fix references to free_bpf_prog_info() in comments Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Changbin Du, Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Changbin Du <changbin.du@intel.com>

[ Upstream commit 08813e0ec1cb48e53c86a24d88d26b26878e7b6e ]

If device tree is not enabled, of_find_regulator_by_node() should have
a dummy function since the function call is still there.

This is to fix build error after CONFIG_NO_AUTO_INLINE is introduced.
If this option is enabled, GCC will not auto-inline functions that are
not explicitly marked as inline.

In this case (no CONFIG_OF), the copmiler will report error in function
regulator_dev_lookup().

W/O NO_AUTO_INLINE, function of_get_regulator() is auto-inlined and then
the call to of_find_regulator_by_node() is optimized out since
of_get_regulator() always return NULL.

W/ NO_AUTO_INLINE, the return value of of_get_regulator() is a variable
so the call to of_find_regulator_by_node() cannot be optimized out. So
we need a stub of_find_regulator_by_node().

static struct regulator_dev *regulator_dev_lookup(struct device *dev,
						  const char *supply)
{
	struct regulator_dev *r = NULL;
	struct device_node *node;
	struct regulator_map *map;
	const char *devname = NULL;

	regulator_supply_alias(&dev, &supply);

	/* first do a dt based lookup */
	if (dev && dev->of_node) {
		node = of_get_regulator(dev, supply);
		if (node) {
			r = of_find_regulator_by_node(node);
			if (r)
				return r;
	...

Signed-off-by: Changbin Du <changbin.du@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/regulator/internal.h |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/regulator/internal.h
+++ b/drivers/regulator/internal.h
@@ -56,14 +56,19 @@ static inline struct regulator_dev *dev_
 	return container_of(dev, struct regulator_dev, dev);
 }
 
-struct regulator_dev *of_find_regulator_by_node(struct device_node *np);
-
 #ifdef CONFIG_OF
+struct regulator_dev *of_find_regulator_by_node(struct device_node *np);
 struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
 			         const struct regulator_desc *desc,
 				 struct regulator_config *config,
 				 struct device_node **node);
 #else
+static inline struct regulator_dev *
+of_find_regulator_by_node(struct device_node *np)
+{
+	return NULL;
+}
+
 static inline struct regulator_init_data *
 regulator_of_get_init_data(struct device *dev,
 			   const struct regulator_desc *desc,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 225/336] bpf: fix references to free_bpf_prog_info() in comments
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 224/336] regulator: add dummy function of_find_regulator_by_node Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 226/336] f2fs: avoid fsync() failure caused by EAGAIN in writepage() Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Quentin Monnet,
	Daniel Borkmann, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit ab7f5bf0928be2f148d000a6eaa6c0a36e74750e ]

Comments in the verifier refer to free_bpf_prog_info() which
seems to have never existed in tree.  Replace it with
free_used_maps().

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/verifier.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5065,7 +5065,7 @@ static int replace_map_fd_with_map_ptr(s
 			/* hold the map. If the program is rejected by verifier,
 			 * the map will be released by release_maps() or it
 			 * will be used by the valid program until it's unloaded
-			 * and all maps are released in free_bpf_prog_info()
+			 * and all maps are released in free_used_maps()
 			 */
 			map = bpf_map_inc(map, false);
 			if (IS_ERR(map)) {
@@ -5856,7 +5856,7 @@ skip_full_check:
 err_release_maps:
 	if (!env->prog->aux->used_maps)
 		/* if we didn't copy map pointers into bpf_prog_info, release
-		 * them now. Otherwise free_bpf_prog_info() will release them.
+		 * them now. Otherwise free_used_maps() will release them.
 		 */
 		release_maps(env);
 	*prog = env->prog;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 226/336] f2fs: avoid fsync() failure caused by EAGAIN in writepage()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 225/336] bpf: fix references to free_bpf_prog_info() in comments Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 227/336] media: em28xx: fix a regression with HVR-950 Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit 5b19d284f5195a925dd015a6397bfce184097378 ]

pageout() in MM traslates EAGAIN, so calls handle_write_error()
 -> mapping_set_error() -> set_bit(AS_EIO, ...).
 file_write_and_wait_range() will see EIO error, which is critical
 to return value of fsync() followed by atomic_write failure to user.

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/data.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1848,7 +1848,13 @@ out:
 
 redirty_out:
 	redirty_page_for_writepage(wbc, page);
-	if (!err)
+	/*
+	 * pageout() in MM traslates EAGAIN, so calls handle_write_error()
+	 * -> mapping_set_error() -> set_bit(AS_EIO, ...).
+	 * file_write_and_wait_range() will see EIO error, which is critical
+	 * to return value of fsync() followed by atomic_write failure to user.
+	 */
+	if (!err || wbc->for_reclaim)
 		return AOP_WRITEPAGE_ACTIVATE;
 	unlock_page(page);
 	return err;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 227/336] media: em28xx: fix a regression with HVR-950
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 226/336] f2fs: avoid fsync() failure caused by EAGAIN in writepage() Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 228/336] media: siano: get rid of __le32/__le16 cast warnings Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Love, Mauro Carvalho Chehab,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[ Upstream commit 509f89652f83e834b3ef7a083e2eeac812b055f0 ]

Commit be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner
functionality") removed the logic with sets the alternate for the DVB
device. Without setting the right alternate, the device won't be
able to submit URBs, and userspace fails with -EMSGSIZE:

	ERROR     DMX_SET_PES_FILTER failed (PID = 0x2000): 90 Message too long

Tested with Hauppauge HVR-950 model A1C0.

Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality")

Cc: Brad Love <brad@nextdimension.cc>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/em28xx/em28xx-dvb.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -199,6 +199,7 @@ static int em28xx_start_streaming(struct
 	int rc;
 	struct em28xx_i2c_bus *i2c_bus = dvb->adapter.priv;
 	struct em28xx *dev = i2c_bus->dev;
+	struct usb_device *udev = interface_to_usbdev(dev->intf);
 	int dvb_max_packet_size, packet_multiplier, dvb_alt;
 
 	if (dev->dvb_xfer_bulk) {
@@ -217,6 +218,7 @@ static int em28xx_start_streaming(struct
 		dvb_alt = dev->dvb_alt_isoc;
 	}
 
+	usb_set_interface(udev, dev->ifnum, dvb_alt);
 	rc = em28xx_set_mode(dev, EM28XX_DIGITAL_MODE);
 	if (rc < 0)
 		return rc;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 228/336] media: siano: get rid of __le32/__le16 cast warnings
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 227/336] media: em28xx: fix a regression with HVR-950 Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 229/336] mt76x2: fix avg_rssi estimation Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab,
	Mauro Carvalho Chehab, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[ Upstream commit e1b7f11b37def5f3021c06e8c2b4953e099357aa ]

Those are all false-positives that appear with smatch when building for
arm:

  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
  drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
  drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16

Get rid of them by adding explicit forced casts.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/common/siano/smsendian.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/media/common/siano/smsendian.c
+++ b/drivers/media/common/siano/smsendian.c
@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *b
 	switch (msg->x_msg_header.msg_type) {
 	case MSG_SMS_DATA_DOWNLOAD_REQ:
 	{
-		msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]);
+		msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0]));
 		break;
 	}
 
@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *b
 				sizeof(struct sms_msg_hdr))/4;
 
 		for (i = 0; i < msg_words; i++)
-			msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
+			msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
 
 		break;
 	}
@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *b
 	{
 		struct sms_version_res *ver =
 			(struct sms_version_res *) msg;
-		ver->chip_model = le16_to_cpu(ver->chip_model);
+		ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model);
 		break;
 	}
 
@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *b
 				sizeof(struct sms_msg_hdr))/4;
 
 		for (i = 0; i < msg_words; i++)
-			msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
+			msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
 
 		break;
 	}
@@ -95,9 +95,9 @@ void smsendian_handle_message_header(voi
 #ifdef __BIG_ENDIAN
 	struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg;
 
-	phdr->msg_type = le16_to_cpu(phdr->msg_type);
-	phdr->msg_length = le16_to_cpu(phdr->msg_length);
-	phdr->msg_flags = le16_to_cpu(phdr->msg_flags);
+	phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type);
+	phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length);
+	phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags);
 #endif /* __BIG_ENDIAN */
 }
 EXPORT_SYMBOL_GPL(smsendian_handle_message_header);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 229/336] mt76x2: fix avg_rssi estimation
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 228/336] media: siano: get rid of __le32/__le16 cast warnings Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 230/336] drm/atomic: Handling the case when setting old crtc for plane Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau,
	Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

[ Upstream commit c990affd5abce1f338ac52539e092dad04647fb6 ]

Add leftover filter coefficients in IIR rssi estimation

Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x2_phy.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c
@@ -492,8 +492,10 @@ mt76x2_phy_update_channel_gain(struct mt
 	u8 gain_delta;
 	int low_gain;
 
-	dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 + (rssi0 << 8);
-	dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 + (rssi1 << 8);
+	dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 +
+			       (rssi0 << 8) / 16;
+	dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 +
+			       (rssi1 << 8) / 16;
 	dev->cal.avg_rssi_all = (dev->cal.avg_rssi[0] +
 				 dev->cal.avg_rssi[1]) / 512;
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 230/336] drm/atomic: Handling the case when setting old crtc for plane
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 229/336] mt76x2: fix avg_rssi estimation Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 231/336] mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Satendra Singh Thakur, Madhur Verma,
	Hemanshu Srivastava, Daniel Vetter, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Satendra Singh Thakur <satendra.t@samsung.com>

[ Upstream commit fc2a69f3903dfd97cd47f593e642b47918c949df ]

In the func drm_atomic_set_crtc_for_plane, with the current code,
if crtc of the plane_state and crtc passed as argument to the func
are same, entire func will executed in vein.
It will get state of crtc and clear and set the bits in plane_mask.
All these steps are not required for same old crtc.
Ideally, we should do nothing in this case, this patch handles the same,
and causes the program to return without doing anything in such scenario.

Signed-off-by: Satendra Singh Thakur <satendra.t@samsung.com>
Cc: Madhur Verma <madhur.verma@samsung.com>
Cc: Hemanshu Srivastava <hemanshu.s@samsung.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1525326572-25854-1-git-send-email-satendra.t@samsung.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_atomic.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1429,7 +1429,9 @@ drm_atomic_set_crtc_for_plane(struct drm
 {
 	struct drm_plane *plane = plane_state->plane;
 	struct drm_crtc_state *crtc_state;
-
+	/* Nothing to do for same crtc*/
+	if (plane_state->crtc == crtc)
+		return 0;
 	if (plane_state->crtc) {
 		crtc_state = drm_atomic_get_crtc_state(plane_state->state,
 						       plane_state->crtc);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 231/336] mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 230/336] drm/atomic: Handling the case when setting old crtc for plane Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 232/336] f2fs: check cap_resource only for data blocks Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Tony Lindgren, Adrian Hunter, Ulf Hansson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kishon Vijay Abraham I <kishon@ti.com>

[ Upstream commit 0ec4ee3c9b9755b28fd2e89b2ceaae6f15403368 ]

sdhci_omap_config_iodelay_pinctrl_state() requires caps and caps2 to be
initialized (speed mode capabilities like UHS/HS200) before it is
invoked. While mmc_of_parse() initializes caps/caps2 if capabilities is
populated in device tree, it will remain uninitialized for capabilities
obtained from SDHCI_CAPABILITIES register.
Fix sdhci_omap_config_iodelay_pinctrl_state() to be used even while
getting the capabilities from SDHCI_CAPABILITIES register by invoking
sdhci_setup_host() before sdhci_omap_config_iodelay_pinctrl_state().

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-omap.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -916,10 +916,6 @@ static int sdhci_omap_probe(struct platf
 		goto err_put_sync;
 	}
 
-	ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host);
-	if (ret)
-		goto err_put_sync;
-
 	host->mmc_host_ops.get_ro = mmc_gpio_get_ro;
 	host->mmc_host_ops.start_signal_voltage_switch =
 					sdhci_omap_start_signal_voltage_switch;
@@ -930,12 +926,23 @@ static int sdhci_omap_probe(struct platf
 	sdhci_read_caps(host);
 	host->caps |= SDHCI_CAN_DO_ADMA2;
 
-	ret = sdhci_add_host(host);
+	ret = sdhci_setup_host(host);
 	if (ret)
 		goto err_put_sync;
 
+	ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host);
+	if (ret)
+		goto err_cleanup_host;
+
+	ret = __sdhci_add_host(host);
+	if (ret)
+		goto err_cleanup_host;
+
 	return 0;
 
+err_cleanup_host:
+	sdhci_cleanup_host(host);
+
 err_put_sync:
 	pm_runtime_put_sync(dev);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 232/336] f2fs: check cap_resource only for data blocks
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 231/336] mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 233/336] mlxsw: spectrum_router: Return an error for non-default FIB rules Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit a90a0884ac75f825157470a1c17e707d487bceb6 ]

This patch changes the rule to check cap_resource for data blocks, not inode
or node blocks in order to avoid selinux denial.

Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/f2fs.h |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1602,7 +1602,7 @@ static inline bool f2fs_has_xattr_block(
 }
 
 static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
-					struct inode *inode)
+					struct inode *inode, bool cap)
 {
 	if (!inode)
 		return true;
@@ -1615,7 +1615,7 @@ static inline bool __allow_reserved_bloc
 	if (!gid_eq(F2FS_OPTION(sbi).s_resgid, GLOBAL_ROOT_GID) &&
 					in_group_p(F2FS_OPTION(sbi).s_resgid))
 		return true;
-	if (capable(CAP_SYS_RESOURCE))
+	if (cap && capable(CAP_SYS_RESOURCE))
 		return true;
 	return false;
 }
@@ -1650,7 +1650,7 @@ static inline int inc_valid_block_count(
 	avail_user_block_count = sbi->user_block_count -
 					sbi->current_reserved_blocks;
 
-	if (!__allow_reserved_blocks(sbi, inode))
+	if (!__allow_reserved_blocks(sbi, inode, true))
 		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
 
 	if (unlikely(sbi->total_valid_block_count > avail_user_block_count)) {
@@ -1857,7 +1857,7 @@ static inline int inc_valid_node_count(s
 	valid_block_count = sbi->total_valid_block_count +
 					sbi->current_reserved_blocks + 1;
 
-	if (!__allow_reserved_blocks(sbi, inode))
+	if (!__allow_reserved_blocks(sbi, inode, false))
 		valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks;
 
 	if (unlikely(valid_block_count > sbi->user_block_count)) {



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 233/336] mlxsw: spectrum_router: Return an error for non-default FIB rules
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 232/336] f2fs: check cap_resource only for data blocks Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 234/336] ALSA: hda/ca0132: fix build failure when a local macro is defined Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, David Ahern,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ido Schimmel <idosch@mellanox.com>

[ Upstream commit 6290182b2b3bda119ecb243fb3d6bcc98a74344f ]

Since commit 9776d32537d2 ("net: Move call_fib_rule_notifiers up in
fib_nl_newrule") it is possible to forbid the installation of
unsupported FIB rules.

Have mlxsw return an error for non-default FIB rules in addition to the
existing extack message.

Example:
# ip rule add from 198.51.100.1 table 10
Error: mlxsw_spectrum: FIB rules not supported.

Note that offload is only aborted when non-default FIB rules are already
installed and merely replayed during module initialization.

Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -5882,24 +5882,24 @@ static int mlxsw_sp_router_fib_rule_even
 	switch (info->family) {
 	case AF_INET:
 		if (!fib4_rule_default(rule) && !rule->l3mdev)
-			err = -1;
+			err = -EOPNOTSUPP;
 		break;
 	case AF_INET6:
 		if (!fib6_rule_default(rule) && !rule->l3mdev)
-			err = -1;
+			err = -EOPNOTSUPP;
 		break;
 	case RTNL_FAMILY_IPMR:
 		if (!ipmr_rule_default(rule) && !rule->l3mdev)
-			err = -1;
+			err = -EOPNOTSUPP;
 		break;
 	case RTNL_FAMILY_IP6MR:
 		if (!ip6mr_rule_default(rule) && !rule->l3mdev)
-			err = -1;
+			err = -EOPNOTSUPP;
 		break;
 	}
 
 	if (err < 0)
-		NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported. Aborting offload");
+		NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported");
 
 	return err;
 }
@@ -5926,8 +5926,8 @@ static int mlxsw_sp_router_fib_event(str
 	case FIB_EVENT_RULE_DEL:
 		err = mlxsw_sp_router_fib_rule_event(event, info,
 						     router->mlxsw_sp);
-		if (!err)
-			return NOTIFY_DONE;
+		if (!err || info->extack)
+			return notifier_from_errno(err);
 	}
 
 	fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 234/336] ALSA: hda/ca0132: fix build failure when a local macro is defined
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 233/336] mlxsw: spectrum_router: Return an error for non-default FIB rules Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 235/336] mmc: dw_mmc: update actual clock for mmc debugfs Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Connor McAdams, Takashi Sakamoto,
	Takashi Iwai, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Sakamoto <o-takashi@sakamocchi.jp>

[ Upstream commit 8e142e9e628975b0dddd05cf1b095331dff6e2de ]

DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but
tlv.h is not included. This causes build failure when local macro is
defined by comment-out.

This commit fixes the bug. At the same time, the alias macro is replaced
with a destination macro added at a commit 46e860f76804 ("ALSA: rename
TLV-related macros so that they're friendly to user applications")

Reported-by: Connor McAdams <conmanx360@gmail.com>
Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls')
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_ca0132.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -39,6 +39,10 @@
 /* Enable this to see controls for tuning purpose. */
 /*#define ENABLE_TUNING_CONTROLS*/
 
+#ifdef ENABLE_TUNING_CONTROLS
+#include <sound/tlv.h>
+#endif
+
 #define FLOAT_ZERO	0x00000000
 #define FLOAT_ONE	0x3f800000
 #define FLOAT_TWO	0x40000000
@@ -3068,8 +3072,8 @@ static int equalizer_ctl_put(struct snd_
 	return 1;
 }
 
-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0);
 
 static int add_tuning_control(struct hda_codec *codec,
 				hda_nid_t pnid, hda_nid_t nid,



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 235/336] mmc: dw_mmc: update actual clock for mmc debugfs
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 234/336] ALSA: hda/ca0132: fix build failure when a local macro is defined Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49   ` Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiao Yao, Ziyuan, Shawn Lin,
	Ulf Hansson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shawn Lin <shawn.lin@rock-chips.com>

[ Upstream commit ff178981bd5fd1667f373098740cb1c6d6efa1ba ]

Respect the actual clock for mmc debugfs to help better debug
the hardware.

mmc_host mmc0: Bus speed (slot 0) = 135475200Hz (slot req 150000000Hz,
actual 135475200HZ div = 0)

cat /sys/kernel/debug/mmc0/ios
clock:          150000000 Hz
actual clock:   135475200 Hz
vdd:            21 (3.3 ~ 3.4 V)
bus mode:       2 (push-pull)
chip select:    0 (don't care)
power mode:     2 (on)
bus width:      3 (8 bits)
timing spec:    9 (mmc HS200)
signal voltage: 0 (1.80 V)
driver type:    0 (driver type B)

Cc: Xiao Yao <xiaoyao@rock-chips.com>
Cc: Ziyuan <xzy.xu@rock-chips.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/dw_mmc.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1231,6 +1231,8 @@ static void dw_mci_setup_bus(struct dw_m
 	if (host->state == STATE_WAITING_CMD11_DONE)
 		sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH;
 
+	slot->mmc->actual_clock = 0;
+
 	if (!clock) {
 		mci_writel(host, CLKENA, 0);
 		mci_send_cmd(slot, sdmmc_cmd_bits, 0);
@@ -1289,6 +1291,8 @@ static void dw_mci_setup_bus(struct dw_m
 
 		/* keep the last clock value that was requested from core */
 		slot->__clk_old = clock;
+		slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) :
+					  host->bus_hz;
 	}
 
 	host->current_speed = clock;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 236/336] mmc: pwrseq: Use kmalloc_array instead of stack VLA
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
@ 2018-08-01 16:49   ` Greg Kroah-Hartman
  2018-08-01 16:45 ` [PATCH 4.17 002/336] Input: elan_i2c - add ACPI ID for lenovo ideapad 330 Greg Kroah-Hartman
                     ` (310 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tobin C. Harding, Ulf Hansson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Tobin C. Harding" <me@tobin.cc>

[ Upstream commit 486e6661367b40f927aadbed73237693396cbf94 ]

The use of stack Variable Length Arrays needs to be avoided, as they
can be a vector for stack exhaustion, which can be both a runtime bug
(kernel Oops) or a security flaw (overwriting memory beyond the
stack). Also, in general, as code evolves it is easy to lose track of
how big a VLA can get. Thus, we can end up having runtime failures
that are hard to debug. As part of the directive[1] to remove all VLAs
from the kernel, and build with -Wvla.

Currently driver is using a VLA declared using the number of descriptors.  This
array is used to store integer values and is later used as an argument to
`gpiod_set_array_value_cansleep()` This can be avoided by using
`kmalloc_array()` to allocate memory for the array of integer values.  Memory is
free'd before return from function.

>From the code it appears that it is safe to sleep so we can use GFP_KERNEL
(based _cansleep() suffix of function `gpiod_set_array_value_cansleep()`.

It can be expected that this patch will result in a small increase in overhead
due to the use of `kmalloc_array()`

[1] https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Tobin C. Harding <me@tobin.cc>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/pwrseq_simple.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_
 	struct gpio_descs *reset_gpios = pwrseq->reset_gpios;
 
 	if (!IS_ERR(reset_gpios)) {
-		int i;
-		int values[reset_gpios->ndescs];
+		int i, *values;
+		int nvalues = reset_gpios->ndescs;
 
-		for (i = 0; i < reset_gpios->ndescs; i++)
+		values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL);
+		if (!values)
+			return;
+
+		for (i = 0; i < nvalues; i++)
 			values[i] = value;
 
-		gpiod_set_array_value_cansleep(
-			reset_gpios->ndescs, reset_gpios->desc, values);
+		gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values);
+		kfree(values);
 	}
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 236/336] mmc: pwrseq: Use kmalloc_array instead of stack VLA
@ 2018-08-01 16:49   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tobin C. Harding, Ulf Hansson, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Tobin C. Harding" <me@tobin.cc>

[ Upstream commit 486e6661367b40f927aadbed73237693396cbf94 ]

The use of stack Variable Length Arrays needs to be avoided, as they
can be a vector for stack exhaustion, which can be both a runtime bug
(kernel Oops) or a security flaw (overwriting memory beyond the
stack). Also, in general, as code evolves it is easy to lose track of
how big a VLA can get. Thus, we can end up having runtime failures
that are hard to debug. As part of the directive[1] to remove all VLAs
from the kernel, and build with -Wvla.

Currently driver is using a VLA declared using the number of descriptors.  This
array is used to store integer values and is later used as an argument to
`gpiod_set_array_value_cansleep()` This can be avoided by using
`kmalloc_array()` to allocate memory for the array of integer values.  Memory is
free'd before return from function.

>>From the code it appears that it is safe to sleep so we can use GFP_KERNEL
(based _cansleep() suffix of function `gpiod_set_array_value_cansleep()`.

It can be expected that this patch will result in a small increase in overhead
due to the use of `kmalloc_array()`

[1] https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Tobin C. Harding <me@tobin.cc>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/pwrseq_simple.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_
 	struct gpio_descs *reset_gpios = pwrseq->reset_gpios;
 
 	if (!IS_ERR(reset_gpios)) {
-		int i;
-		int values[reset_gpios->ndescs];
+		int i, *values;
+		int nvalues = reset_gpios->ndescs;
 
-		for (i = 0; i < reset_gpios->ndescs; i++)
+		values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL);
+		if (!values)
+			return;
+
+		for (i = 0; i < nvalues; i++)
 			values[i] = value;
 
-		gpiod_set_array_value_cansleep(
-			reset_gpios->ndescs, reset_gpios->desc, values);
+		gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values);
+		kfree(values);
 	}
 }
 

^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 237/336] dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2018-08-01 16:49   ` Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 238/336] spi: meson-spicc: Fix error handling in meson_spicc_probe() Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Rob Herring,
	Kevin Hilman, Linus Walleij, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 03d9fbc39730b3e6b2e7047dc85f0f70de8fb97d ]

The Meson8m2 SoC is a variant of Meson8 with some updates from Meson8b
(such as the Gigabit capable DesignWare MAC).
It is mostly pin compatible with Meson8, only 10 (existing) CBUS pins
get an additional function (four of these are Ethernet RXD2, RXD3, TXD2
and TXD3 which are required when the board uses an RGMII PHY).
The AOBUS pins seem to be identical on Meson8 and Meson8m2.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt |    2 ++
 1 file changed, 2 insertions(+)

--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
@@ -3,8 +3,10 @@
 Required properties for the root node:
  - compatible: one of "amlogic,meson8-cbus-pinctrl"
 		      "amlogic,meson8b-cbus-pinctrl"
+		      "amlogic,meson8m2-cbus-pinctrl"
 		      "amlogic,meson8-aobus-pinctrl"
 		      "amlogic,meson8b-aobus-pinctrl"
+		      "amlogic,meson8m2-aobus-pinctrl"
 		      "amlogic,meson-gxbb-periphs-pinctrl"
 		      "amlogic,meson-gxbb-aobus-pinctrl"
 		      "amlogic,meson-gxl-periphs-pinctrl"



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 238/336] spi: meson-spicc: Fix error handling in meson_spicc_probe()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 237/336] dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 239/336] net: hns3: Fixes the out of bounds access in hclge_map_tqp Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Neil Armstrong,
	Mark Brown, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

[ Upstream commit ded5fa4e8bac25612caab8f0822691308a28a552 ]

If devm_spi_register_master() fails in meson_spicc_probe(),
spicc->core is left undisabled. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-meson-spicc.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-meson-spicc.c
+++ b/drivers/spi/spi-meson-spicc.c
@@ -574,10 +574,15 @@ static int meson_spicc_probe(struct plat
 		master->max_speed_hz = rate >> 2;
 
 	ret = devm_spi_register_master(&pdev->dev, master);
-	if (!ret)
-		return 0;
+	if (ret) {
+		dev_err(&pdev->dev, "spi master registration failed\n");
+		goto out_clk;
+	}
 
-	dev_err(&pdev->dev, "spi master registration failed\n");
+	return 0;
+
+out_clk:
+	clk_disable_unprepare(spicc->core);
 
 out_master:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 239/336] net: hns3: Fixes the out of bounds access in hclge_map_tqp
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 238/336] spi: meson-spicc: Fix error handling in meson_spicc_probe() Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 240/336] dt-bindings: net: meson-dwmac: new compatible name for AXG SoC Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li, Salil Mehta,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit 38e62046d4c95272e2fb001d2d72baf48fa090e9 ]

This patch fixes the handling of the check when number of vports
are detected to be more than available TPQs. Current handling causes
an out of bounds access in hclge_map_tqp().

Fixes: 7df7dad633e2 ("net: hns3: Refactor the mapping of tqp to vport")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -1459,8 +1459,11 @@ static int hclge_alloc_vport(struct hclg
 	/* We need to alloc a vport for main NIC of PF */
 	num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1;
 
-	if (hdev->num_tqps < num_vport)
-		num_vport = hdev->num_tqps;
+	if (hdev->num_tqps < num_vport) {
+		dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)",
+			hdev->num_tqps, num_vport);
+		return -EINVAL;
+	}
 
 	/* Alloc the same number of TQPs for every vport */
 	tqp_per_vport = hdev->num_tqps / num_vport;



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 240/336] dt-bindings: net: meson-dwmac: new compatible name for AXG SoC
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 239/336] net: hns3: Fixes the out of bounds access in hclge_map_tqp Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 241/336] fasync: Fix deadlock between task-context and interrupt-context kill_fasync() Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yixun Lan, Rob Herring,
	David S. Miller, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yixun Lan <yixun.lan@amlogic.com>

[ Upstream commit 7e5d05e18ba1ed491c6f836edee7f0b90f3167bc ]

We need to introduce a new compatible name for the Meson-AXG SoC
in order to support the RMII 100M ethernet PHY, since the PRG_ETH0
register of the dwmac glue layer is changed from previous old SoC.

Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/net/meson-dwmac.txt |    1 +
 1 file changed, 1 insertion(+)

--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt
@@ -11,6 +11,7 @@ Required properties on all platforms:
 			- "amlogic,meson8b-dwmac"
 			- "amlogic,meson8m2-dwmac"
 			- "amlogic,meson-gxbb-dwmac"
+			- "amlogic,meson-axg-dwmac"
 		Additionally "snps,dwmac" and any applicable more
 		detailed version number described in net/stmmac.txt
 		should be used.



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 241/336] fasync: Fix deadlock between task-context and interrupt-context kill_fasync()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 240/336] dt-bindings: net: meson-dwmac: new compatible name for AXG SoC Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 242/336] i40e: Add advertising 10G LR mode Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kirill Tkhai, Jeff Layton, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kirill Tkhai <ktkhai@virtuozzo.com>

[ Upstream commit 7a107c0f55a3b4c6f84a4323df5610360bde1684 ]

I observed the following deadlock between them:

[task 1]                          [task 2]                         [task 3]
kill_fasync()                     mm_update_next_owner()           copy_process()
 spin_lock_irqsave(&fa->fa_lock)   read_lock(&tasklist_lock)        write_lock_irq(&tasklist_lock)
  send_sigio()                    <IRQ>                             ...
   read_lock(&fown->lock)         kill_fasync()                     ...
    read_lock(&tasklist_lock)      spin_lock_irqsave(&fa->fa_lock)  ...

Task 1 can't acquire read locked tasklist_lock, since there is
already task 3 expressed its wish to take the lock exclusive.
Task 2 holds the read locked lock, but it can't take the spin lock.

Also, there is possible another deadlock (which I haven't observed):

[task 1]                            [task 2]
f_getown()                          kill_fasync()
 read_lock(&f_own->lock)             spin_lock_irqsave(&fa->fa_lock,)
 <IRQ>                               send_sigio()                     write_lock_irq(&f_own->lock)
  kill_fasync()                       read_lock(&fown->lock)
   spin_lock_irqsave(&fa->fa_lock,)

Actually, we do not need exclusive fa->fa_lock in kill_fasync_rcu(),
as it guarantees fa->fa_file->f_owner integrity only. It may seem,
that it used to give a task a small possibility to receive two sequential
signals, if there are two parallel kill_fasync() callers, and task
handles the first signal fastly, but the behaviour won't become
different, since there is exclusive sighand lock in do_send_sig_info().

The patch converts fa_lock into rwlock_t, and this fixes two above
deadlocks, as rwlock is allowed to be taken from interrupt handler
by qrwlock design.

Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fcntl.c         |   15 +++++++--------
 include/linux/fs.h |    2 +-
 2 files changed, 8 insertions(+), 9 deletions(-)

--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -871,9 +871,9 @@ int fasync_remove_entry(struct file *fil
 		if (fa->fa_file != filp)
 			continue;
 
-		spin_lock_irq(&fa->fa_lock);
+		write_lock_irq(&fa->fa_lock);
 		fa->fa_file = NULL;
-		spin_unlock_irq(&fa->fa_lock);
+		write_unlock_irq(&fa->fa_lock);
 
 		*fp = fa->fa_next;
 		call_rcu(&fa->fa_rcu, fasync_free_rcu);
@@ -918,13 +918,13 @@ struct fasync_struct *fasync_insert_entr
 		if (fa->fa_file != filp)
 			continue;
 
-		spin_lock_irq(&fa->fa_lock);
+		write_lock_irq(&fa->fa_lock);
 		fa->fa_fd = fd;
-		spin_unlock_irq(&fa->fa_lock);
+		write_unlock_irq(&fa->fa_lock);
 		goto out;
 	}
 
-	spin_lock_init(&new->fa_lock);
+	rwlock_init(&new->fa_lock);
 	new->magic = FASYNC_MAGIC;
 	new->fa_file = filp;
 	new->fa_fd = fd;
@@ -987,14 +987,13 @@ static void kill_fasync_rcu(struct fasyn
 {
 	while (fa) {
 		struct fown_struct *fown;
-		unsigned long flags;
 
 		if (fa->magic != FASYNC_MAGIC) {
 			printk(KERN_ERR "kill_fasync: bad magic number in "
 			       "fasync_struct!\n");
 			return;
 		}
-		spin_lock_irqsave(&fa->fa_lock, flags);
+		read_lock(&fa->fa_lock);
 		if (fa->fa_file) {
 			fown = &fa->fa_file->f_owner;
 			/* Don't send SIGURG to processes which have not set a
@@ -1003,7 +1002,7 @@ static void kill_fasync_rcu(struct fasyn
 			if (!(sig == SIGURG && fown->signum == 0))
 				send_sigio(fown, fa->fa_fd, band);
 		}
-		spin_unlock_irqrestore(&fa->fa_lock, flags);
+		read_unlock(&fa->fa_lock);
 		fa = rcu_dereference(fa->fa_next);
 	}
 }
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1250,7 +1250,7 @@ static inline int locks_lock_file_wait(s
 }
 
 struct fasync_struct {
-	spinlock_t		fa_lock;
+	rwlock_t		fa_lock;
 	int			magic;
 	int			fa_fd;
 	struct fasync_struct	*fa_next; /* singly linked list */



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 242/336] i40e: Add advertising 10G LR mode
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 241/336] fasync: Fix deadlock between task-context and interrupt-context kill_fasync() Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 243/336] i40e: avoid overflow in i40e_ptp_adjfreq() Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Pawlak, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakub Pawlak <jakub.pawlak@intel.com>

[ Upstream commit 6ee4d32255865fc4b383355a8354603d60ab9f8a ]

The advertising 10G LR mode should be possible to set
but in the function i40e_set_link_ksettings() check for this
is missed. This patch adds check for 10000baseLR_Full
flag for 10G modes.

Signed-off-by: Jakub Pawlak <jakub.pawlak@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -977,7 +977,9 @@ static int i40e_set_link_ksettings(struc
 	    ethtool_link_ksettings_test_link_mode(ks, advertising,
 						  10000baseCR_Full) ||
 	    ethtool_link_ksettings_test_link_mode(ks, advertising,
-						  10000baseSR_Full))
+						  10000baseSR_Full) ||
+	    ethtool_link_ksettings_test_link_mode(ks, advertising,
+						  10000baseLR_Full))
 		config.link_speed |= I40E_LINK_SPEED_10GB;
 	if (ethtool_link_ksettings_test_link_mode(ks, advertising,
 						  20000baseKR2_Full))



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 243/336] i40e: avoid overflow in i40e_ptp_adjfreq()
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 242/336] i40e: Add advertising 10G LR mode Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 244/336] mt76: add rcu locking around tx scheduling Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacob Keller, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacob Keller <jacob.e.keller@intel.com>

[ Upstream commit 830e0dd9996c4644e42412aa6c46ed8f8eab0cca ]

When operating at 1GbE, the base incval for the PTP clock is so large
that multiplying it by numbers close to the max_adj can overflow the
u64.

Rather than attempting to limit the max_adj to a value small enough to
avoid overflow, instead calculate the incvalue adjustment based on the
40GbE incvalue, and then multiply that by the scaling factor for the
link speed.

This sacrifices a small amount of precision in the adjustment but we
avoid erratic behavior of the clock due to the overflow caused if ppb is
very near the maximum adjustment.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/i40e/i40e.h     |    2 -
 drivers/net/ethernet/intel/i40e/i40e_ptp.c |   41 +++++++++++++++++++----------
 2 files changed, 28 insertions(+), 15 deletions(-)

--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -608,7 +608,7 @@ struct i40e_pf {
 	unsigned long ptp_tx_start;
 	struct hwtstamp_config tstamp_config;
 	struct mutex tmreg_lock; /* Used to protect the SYSTIME registers. */
-	u64 ptp_base_adj;
+	u32 ptp_adj_mult;
 	u32 tx_hwtstamp_timeouts;
 	u32 tx_hwtstamp_skipped;
 	u32 rx_hwtstamp_cleared;
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -40,9 +40,9 @@
  * At 1Gb link, the period is multiplied by 20. (32ns)
  * 1588 functionality is not supported at 100Mbps.
  */
-#define I40E_PTP_40GB_INCVAL 0x0199999999ULL
-#define I40E_PTP_10GB_INCVAL 0x0333333333ULL
-#define I40E_PTP_1GB_INCVAL  0x2000000000ULL
+#define I40E_PTP_40GB_INCVAL		0x0199999999ULL
+#define I40E_PTP_10GB_INCVAL_MULT	2
+#define I40E_PTP_1GB_INCVAL_MULT	20
 
 #define I40E_PRTTSYN_CTL1_TSYNTYPE_V1  BIT(I40E_PRTTSYN_CTL1_TSYNTYPE_SHIFT)
 #define I40E_PRTTSYN_CTL1_TSYNTYPE_V2  (2 << \
@@ -130,17 +130,24 @@ static int i40e_ptp_adjfreq(struct ptp_c
 		ppb = -ppb;
 	}
 
-	smp_mb(); /* Force any pending update before accessing. */
-	adj = READ_ONCE(pf->ptp_base_adj);
-
-	freq = adj;
+	freq = I40E_PTP_40GB_INCVAL;
 	freq *= ppb;
 	diff = div_u64(freq, 1000000000ULL);
 
 	if (neg_adj)
-		adj -= diff;
+		adj = I40E_PTP_40GB_INCVAL - diff;
 	else
-		adj += diff;
+		adj = I40E_PTP_40GB_INCVAL + diff;
+
+	/* At some link speeds, the base incval is so large that directly
+	 * multiplying by ppb would result in arithmetic overflow even when
+	 * using a u64. Avoid this by instead calculating the new incval
+	 * always in terms of the 40GbE clock rate and then multiplying by the
+	 * link speed factor afterwards. This does result in slightly lower
+	 * precision at lower link speeds, but it is fairly minor.
+	 */
+	smp_mb(); /* Force any pending update before accessing. */
+	adj *= READ_ONCE(pf->ptp_adj_mult);
 
 	wr32(hw, I40E_PRTTSYN_INC_L, adj & 0xFFFFFFFF);
 	wr32(hw, I40E_PRTTSYN_INC_H, adj >> 32);
@@ -467,6 +474,7 @@ void i40e_ptp_set_increment(struct i40e_
 	struct i40e_link_status *hw_link_info;
 	struct i40e_hw *hw = &pf->hw;
 	u64 incval;
+	u32 mult;
 
 	hw_link_info = &hw->phy.link_info;
 
@@ -474,10 +482,10 @@ void i40e_ptp_set_increment(struct i40e_
 
 	switch (hw_link_info->link_speed) {
 	case I40E_LINK_SPEED_10GB:
-		incval = I40E_PTP_10GB_INCVAL;
+		mult = I40E_PTP_10GB_INCVAL_MULT;
 		break;
 	case I40E_LINK_SPEED_1GB:
-		incval = I40E_PTP_1GB_INCVAL;
+		mult = I40E_PTP_1GB_INCVAL_MULT;
 		break;
 	case I40E_LINK_SPEED_100MB:
 	{
@@ -488,15 +496,20 @@ void i40e_ptp_set_increment(struct i40e_
 				 "1588 functionality is not supported at 100 Mbps. Stopping the PHC.\n");
 			warn_once++;
 		}
-		incval = 0;
+		mult = 0;
 		break;
 	}
 	case I40E_LINK_SPEED_40GB:
 	default:
-		incval = I40E_PTP_40GB_INCVAL;
+		mult = 1;
 		break;
 	}
 
+	/* The increment value is calculated by taking the base 40GbE incvalue
+	 * and multiplying it by a factor based on the link speed.
+	 */
+	incval = I40E_PTP_40GB_INCVAL * mult;
+
 	/* Write the new increment value into the increment register. The
 	 * hardware will not update the clock until both registers have been
 	 * written.
@@ -505,7 +518,7 @@ void i40e_ptp_set_increment(struct i40e_
 	wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32);
 
 	/* Update the base adjustement value. */
-	WRITE_ONCE(pf->ptp_base_adj, incval);
+	WRITE_ONCE(pf->ptp_adj_mult, mult);
 	smp_mb(); /* Force the above update. */
 }
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 244/336] mt76: add rcu locking around tx scheduling
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 243/336] i40e: avoid overflow in i40e_ptp_adjfreq() Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 245/336] backlight: pwm_bl: Dont use GPIOF_* with gpiod_get_direction Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Kalle Valo, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felix Fietkau <nbd@nbd.name>

[ Upstream commit 1d868b70e06a2319fdda46cc46ec7c6762557543 ]

Fixes a reported lockdep error in mac80211:

[  179.867321] =============================
[  179.871510] WARNING: suspicious RCU usage
[  179.875528] 4.14.32 #0 Not tainted
[  179.878924] -----------------------------
[  179.882981] backports-2017-11-01/net/mac80211/tx.c:594 suspicious rcu_dereference_check() usage!
[  179.891785]
[  179.891785] other info that might help us debug this:
[  179.891785]
[  179.899824]
[  179.899824] rcu_scheduler_active = 2, debug_locks = 1
[  179.906343] 2 locks held by ksoftirqd/0/7:
[  179.910479]  #0:  (&(&q->lock)->rlock){+.-.}, at: [<86b207a4>] mt76_dma_tx_cleanup+0x64/0x354 [mt76]
[  179.919734]  #1:  (&(&fq->lock)->rlock){+.-.}, at: [<87238410>] ieee80211_tx_dequeue+0x54/0xc3c [mac80211]
[  179.929890]
[  179.929890] stack backtrace:
[  179.934257] CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 4.14.32 #0
[  179.940421] Stack : 00000000 00000000 00000000 00000000 80e0fce2 00000036 00000000 00000000
[  179.948864]         87c3d24c 80696377 8061039c 00000000 00000007 00000001 87c5db78 6534689d
[  179.957306]         00000000 00000000 80e10000 87c5da74 00000001 0000015a 00000007 00000000
[  179.965748]         00000000 806a0000 000e4171 00000000 00000000 00000000 ffffffff 00000001
[  179.974189]         806c0000 8692b240 86b000d0 87316fe4 00000001 802c9a68 00000000 80700000
[  179.982632]         ...
[  179.985104] Call Trace:
[  179.987582] [<80010a48>] show_stack+0x58/0x100
[  179.992040] [<804c2c58>] dump_stack+0xe8/0x170
[  179.996868] [<87234a04>] ieee80211_tx_h_select_key+0xa8/0x5b8 [mac80211]
[  180.004299] [<87238d44>] ieee80211_tx_dequeue+0x988/0xc3c [mac80211]
[  180.011048] [<86b230dc>] mt76_txq_schedule+0x110/0x3a4 [mt76]
[  180.016821] [<86b209d0>] mt76_dma_tx_cleanup+0x290/0x354 [mt76]
[  180.022777] [<86be2e60>] mt7603_tx_tasklet+0x40/0x6c [mt7603e]
[  180.028637] [<80037058>] tasklet_action+0x110/0x1ec
[  180.033532] [<804e1dac>] __do_softirq+0x164/0x35c
[  180.038235] [<80037174>] run_ksoftirqd+0x40/0x84
[  180.042870] [<800580c8>] smpboot_thread_fn+0x1a8/0x1d8
[  180.048023] [<800542e8>] kthread+0x130/0x144
[  180.052297] [<8000b1f8>] ret_from_kernel_thread+0x14/0x1c

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/tx.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -422,12 +422,14 @@ void mt76_txq_schedule(struct mt76_dev *
 {
 	int len;
 
+	rcu_read_lock();
 	do {
 		if (hwq->swq_queued >= 4 || list_empty(&hwq->swq))
 			break;
 
 		len = mt76_txq_schedule_list(dev, hwq);
 	} while (len > 0);
+	rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(mt76_txq_schedule);
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 245/336] backlight: pwm_bl: Dont use GPIOF_* with gpiod_get_direction
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 244/336] mt76: add rcu locking around tx scheduling Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 246/336] stop_machine: Use raw spinlocks Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Daniel Thompson,
	Simon Horman, Lee Jones, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wolfram Sang <wsa+renesas@sang-engineering.com>

[ Upstream commit bb084c0f61d659f0e6d371b096e0e57998f191d6 ]

The documentation was wrong, gpiod_get_direction() returns 0/1 instead
of the GPIOF_* flags. The docs were fixed with commit 94fc73094abe47
("gpio: correct docs about return value of gpiod_get_direction"). Now,
fix this user (until a better, system-wide solution is in place).

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/pwm_bl.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -301,14 +301,14 @@ static int pwm_backlight_probe(struct pl
 
 	/*
 	 * If the GPIO is not known to be already configured as output, that
-	 * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL,
-	 * change the direction to output and set the GPIO as active.
+	 * is, if gpiod_get_direction returns either 1 or -EINVAL, change the
+	 * direction to output and set the GPIO as active.
 	 * Do not force the GPIO to active when it was already output as it
 	 * could cause backlight flickering or we would enable the backlight too
 	 * early. Leave the decision of the initial backlight state for later.
 	 */
 	if (pb->enable_gpio &&
-	    gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT)
+	    gpiod_get_direction(pb->enable_gpio) != 0)
 		gpiod_direction_output(pb->enable_gpio, 1);
 
 	pb->power_supply = devm_regulator_get(&pdev->dev, "power");



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 246/336] stop_machine: Use raw spinlocks
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 245/336] backlight: pwm_bl: Dont use GPIOF_* with gpiod_get_direction Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 247/336] delayacct: Use raw_spinlocks Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Sebastian Andrzej Siewior, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit de5b55c1d4e30740009864eb35ce4ed856aac01d ]

Use raw-locks in stop_machine() to allow locking in irq-off and
preempt-disabled regions on -RT. This also documents the possible locking
context in general.

[bigeasy: update patch description.]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lkml.kernel.org/r/20180423191635.6014-1-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/stop_machine.c |   24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -37,7 +37,7 @@ struct cpu_stop_done {
 struct cpu_stopper {
 	struct task_struct	*thread;
 
-	spinlock_t		lock;
+	raw_spinlock_t		lock;
 	bool			enabled;	/* is this stopper enabled? */
 	struct list_head	works;		/* list of pending works */
 
@@ -81,13 +81,13 @@ static bool cpu_stop_queue_work(unsigned
 	unsigned long flags;
 	bool enabled;
 
-	spin_lock_irqsave(&stopper->lock, flags);
+	raw_spin_lock_irqsave(&stopper->lock, flags);
 	enabled = stopper->enabled;
 	if (enabled)
 		__cpu_stop_queue_work(stopper, work, &wakeq);
 	else if (work->done)
 		cpu_stop_signal_done(work->done);
-	spin_unlock_irqrestore(&stopper->lock, flags);
+	raw_spin_unlock_irqrestore(&stopper->lock, flags);
 
 	wake_up_q(&wakeq);
 
@@ -237,8 +237,8 @@ static int cpu_stop_queue_two_works(int
 	DEFINE_WAKE_Q(wakeq);
 	int err;
 retry:
-	spin_lock_irq(&stopper1->lock);
-	spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
+	raw_spin_lock_irq(&stopper1->lock);
+	raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
 
 	err = -ENOENT;
 	if (!stopper1->enabled || !stopper2->enabled)
@@ -261,8 +261,8 @@ retry:
 	__cpu_stop_queue_work(stopper1, work1, &wakeq);
 	__cpu_stop_queue_work(stopper2, work2, &wakeq);
 unlock:
-	spin_unlock(&stopper2->lock);
-	spin_unlock_irq(&stopper1->lock);
+	raw_spin_unlock(&stopper2->lock);
+	raw_spin_unlock_irq(&stopper1->lock);
 
 	if (unlikely(err == -EDEADLK)) {
 		while (stop_cpus_in_progress)
@@ -461,9 +461,9 @@ static int cpu_stop_should_run(unsigned
 	unsigned long flags;
 	int run;
 
-	spin_lock_irqsave(&stopper->lock, flags);
+	raw_spin_lock_irqsave(&stopper->lock, flags);
 	run = !list_empty(&stopper->works);
-	spin_unlock_irqrestore(&stopper->lock, flags);
+	raw_spin_unlock_irqrestore(&stopper->lock, flags);
 	return run;
 }
 
@@ -474,13 +474,13 @@ static void cpu_stopper_thread(unsigned
 
 repeat:
 	work = NULL;
-	spin_lock_irq(&stopper->lock);
+	raw_spin_lock_irq(&stopper->lock);
 	if (!list_empty(&stopper->works)) {
 		work = list_first_entry(&stopper->works,
 					struct cpu_stop_work, list);
 		list_del_init(&work->list);
 	}
-	spin_unlock_irq(&stopper->lock);
+	raw_spin_unlock_irq(&stopper->lock);
 
 	if (work) {
 		cpu_stop_fn_t fn = work->fn;
@@ -554,7 +554,7 @@ static int __init cpu_stop_init(void)
 	for_each_possible_cpu(cpu) {
 		struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
 
-		spin_lock_init(&stopper->lock);
+		raw_spin_lock_init(&stopper->lock);
 		INIT_LIST_HEAD(&stopper->works);
 	}
 



^ permalink raw reply	[flat|nested] 328+ messages in thread

* [PATCH 4.17 247/336] delayacct: Use raw_spinlocks
  2018-08-01 16:45 [PATCH 4.17 000/336] 4.17.12-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2018-08-01 16:49 ` [PATCH 4.17 246/336] stop_machine: Use raw spinlocks Greg Kroah-Hartman
@ 2018-08-01 16:49 ` Greg Kroah-Hartman
  2018-08-01 16:49 ` [PATCH 4.17 248/336] ath10k: fix kernel panic while reading tpc_stats Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  311 siblings, 0 replies; 328+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-01 16:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Thomas Gleixner, Balbir Singh, Sasha Levin

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit 02acc80d19edb0d5684c997b2004ad19f9f5236e ]

try_to_wake_up() might invoke delayacct_blkio_end() while holding the
pi_lock (which is a raw_spinlock_t). delayacct_blkio_end() acquires
task_delay_info.lock which is a spinlock_t. This causes a might sleep splat
on -RT where non raw spinlocks are converted to 'sleeping' spinlocks.

task_delay_info.lock is only held for a short amount of time so it's not a
problem latency wise to make convert it to a raw spinlock.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Balbir Singh <bsingharora@gmail.com>
Link: https://lkml.kernel.org/r/20180423161024.6710-1-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/delayacct.h |    2 +-
 kernel/delayacct.c        |   17 +++++++++--------
 2 files changed, 10 insertions(+), 9 deletions(-)

--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -29,7 +29,7 @@
 
 #ifdef CONFIG_TASK_DELAY_ACCT
 struct task_delay_info {
-	spinlock_t	lock;
+	raw_spinlock_t	lock;
 	unsigned int	flags;	/* Private per-task flags */
 
 	/* For each stat XXX, add following, aligned appropriately
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -44,23 +44,24 @@ void __delayacct_tsk_init(struct task_st
 {
 	tsk->delays = kmem_cache_zalloc(delayacct_cache, GFP_KERNEL);
 	if (tsk->delays)
-		spin_lock_init(&tsk->delays->lock);
+		raw_spin_lock_init(&tsk->delays->lock);
 }
 
 /*
  * Finish delay accounting for a statistic using its timestamps (@start),
  * accumalator (@total) and @count
  */
-static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count)
+static void delayacct_end(raw_spinlock_t *lock, u64 *start, u64 *total,
+			  u32 *count)
 {
 	s64 ns = ktime_get_ns() - *start;
 	unsigned long flags;
 
 	if (ns > 0) {
-		spin_lock_irqsave(lock, flags);
+		raw_spin_lock_irqsave(lock, flags);
 		*total += ns;
 		(*count)++;
-		spin_unlock_irqrestore(lock, flags);
+		raw_spin_unlock_irqrestore(lock, flags);
 	}
 }
 
@@ -127,7 +128,7 @@ int __delayacct_add_tsk(struct taskstats
 
 	/* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */
 
-	spin_lock_irqsave(&tsk->delays->lock, flags);
+	raw_spin_lock_irqsave(&tsk->delays->lock, flags);
 	tmp = d->blkio_delay_total + tsk->delays->blkio_delay;
 	d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp;
 	tmp = d->swapin_delay_total + tsk->delays->swapin_delay;
@@ -137,7 +138,7 @@ int __delayacct_add_tsk(struct taskstats
 	d->blkio_count += tsk->delays->blkio_count;
 	d->swapin_count += tsk->delays->swapin_count;
 	d->freepages_count += tsk->delays->freepages_count;
-	spin_unlock_irqrestore(&tsk->delays->lock, flags);
+	raw_spin_unlock_irqrestore(&tsk->delays->lock, flags);
 
 	return 0;
 }
@@ -147,10 +148,10 @@ __u64 __delayacct_blkio_ticks(struct tas
 	__u64 ret;
 	unsigned long flags;
 
-	spin_lock_irqsave(&tsk->delays->lock, flags);
+	raw_spin_lock_irqsave(&tsk->delays->lock, flags);
 	ret = nsec_to_clock_t(tsk->delays->blkio_delay +
 				tsk->delays->swapin_delay);
-	spin_unlock_irqrestore(&tsk->delays->lock, flags);
+	raw_spin_unlock_irqrestore(&tsk->delays->lock, flags);
 	return ret;
 }