* [PATCH 4.14 001/217] ext4: fix spectre gadget in ext4_mb_regular_allocator()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 002/217] drm/i915/kvmgt: Fix potential Spectre v1 Greg Kroah-Hartman
` (202 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Jeremy Cline, Theodore Tso
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Cline <jcline@redhat.com>
commit 1a5d5e5d51e75a5bca67dadbcea8c841934b7b85 upstream.
'ac->ac_g_ex.fe_len' is a user-controlled value which is used in the
derivation of 'ac->ac_2order'. 'ac->ac_2order', in turn, is used to
index arrays which makes it a potential spectre gadget. Fix this by
sanitizing the value assigned to 'ac->ac2_order'. This covers the
following accesses found with the help of smatch:
* fs/ext4/mballoc.c:1896 ext4_mb_simple_scan_group() warn: potential
spectre issue 'grp->bb_counters' [w] (local cap)
* fs/ext4/mballoc.c:445 mb_find_buddy() warn: potential spectre issue
'EXT4_SB(e4b->bd_sb)->s_mb_offsets' [r] (local cap)
* fs/ext4/mballoc.c:446 mb_find_buddy() warn: potential spectre issue
'EXT4_SB(e4b->bd_sb)->s_mb_maxs' [r] (local cap)
Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -26,6 +26,7 @@
#include <linux/log2.h>
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/nospec.h>
#include <linux/backing-dev.h>
#include <trace/events/ext4.h>
@@ -2152,7 +2153,8 @@ ext4_mb_regular_allocator(struct ext4_al
* This should tell if fe_len is exactly power of 2
*/
if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0)
- ac->ac_2order = i - 1;
+ ac->ac_2order = array_index_nospec(i - 1,
+ sb->s_blocksize_bits + 2);
}
/* if stream allocation is enabled, use global goal */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 002/217] drm/i915/kvmgt: Fix potential Spectre v1
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 001/217] ext4: fix spectre gadget in ext4_mb_regular_allocator() Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 003/217] EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] Greg Kroah-Hartman
` (201 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Zhenyu Wang
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavo@embeddedor.com>
commit de5372da605d3bca46e3102bab51b7e1c0e0a6f6 upstream.
info.index can be indirectly controlled by user-space, hence leading
to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/gpu/drm/i915/gvt/kvmgt.c:1232 intel_vgpu_ioctl() warn:
potential spectre issue 'vgpu->vdev.region' [r]
Fix this by sanitizing info.index before indirectly using it to index
vgpu->vdev.region
Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].
[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gvt/kvmgt.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -42,6 +42,8 @@
#include <linux/vfio.h>
#include <linux/mdev.h>
+#include <linux/nospec.h>
+
#include "i915_drv.h"
#include "gvt.h"
@@ -953,7 +955,8 @@ static long intel_vgpu_ioctl(struct mdev
} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
struct vfio_region_info info;
struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
- int i, ret;
+ unsigned int i;
+ int ret;
struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
size_t size;
int nr_areas = 1;
@@ -1030,6 +1033,10 @@ static long intel_vgpu_ioctl(struct mdev
if (info.index >= VFIO_PCI_NUM_REGIONS +
vgpu->vdev.num_regions)
return -EINVAL;
+ info.index =
+ array_index_nospec(info.index,
+ VFIO_PCI_NUM_REGIONS +
+ vgpu->vdev.num_regions);
i = info.index - VFIO_PCI_NUM_REGIONS;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 003/217] EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 001/217] ext4: fix spectre gadget in ext4_mb_regular_allocator() Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 002/217] drm/i915/kvmgt: Fix potential Spectre v1 Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 004/217] pty: fix O_CLOEXEC for TIOCGPTPEER Greg Kroah-Hartman
` (200 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Mauro Carvalho Chehab,
Yazen Ghannam, linux-edac, Borislav Petkov
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit b748f2de4b2f578599f46c6000683a8da755bf68 upstream.
The edac_mem_types[] array misses a MEM_LRDDR4 entry, which leads to
NULL pointer dereference when accessed via sysfs or such.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Yazen Ghannam <Yazen.Ghannam@amd.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20180810141426.8918-1-tiwai@suse.de
Fixes: 1e8096bb2031 ("EDAC: Add LRDDR4 DRAM type")
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/edac_mc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -215,6 +215,7 @@ const char * const edac_mem_types[] = {
[MEM_LRDDR3] = "Load-Reduced DDR3 RAM",
[MEM_DDR4] = "Unbuffered DDR4 RAM",
[MEM_RDDR4] = "Registered DDR4 RAM",
+ [MEM_LRDDR4] = "Load-Reduced-DDR4-RAM",
};
EXPORT_SYMBOL_GPL(edac_mem_types);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 004/217] pty: fix O_CLOEXEC for TIOCGPTPEER
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-08-23 7:51 ` [PATCH 4.14 003/217] EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 005/217] arm: dts: armada: Fix "#cooling-cells" propertys name Greg Kroah-Hartman
` (199 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matthijs van Duin, Aleksa Sarai
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthijs van Duin <matthijsvanduin@gmail.com>
commit 36ecc1481dc8d8c52d43ba18c6b642c1d2fde789 upstream.
It was being ignored because the flags were not passed to fd allocation.
Fixes: 54ebbfb16034 ("tty: add TIOCGPTPEER ioctl")
Signed-off-by: Matthijs van Duin <matthijsvanduin@gmail.com>
Acked-by: Aleksa Sarai <asarai@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/pty.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -625,7 +625,7 @@ int ptm_open_peer(struct file *master, s
if (tty->driver != ptm_driver)
return -EIO;
- fd = get_unused_fd_flags(0);
+ fd = get_unused_fd_flags(flags);
if (fd < 0) {
retval = fd;
goto err;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 005/217] arm: dts: armada: Fix "#cooling-cells" propertys name
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-08-23 7:51 ` [PATCH 4.14 004/217] pty: fix O_CLOEXEC for TIOCGPTPEER Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.14 006/217] vfio: ccw: fix error return in vfio_ccw_sch_event Greg Kroah-Hartman
` (198 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Viresh Kumar, Gregory CLEMENT, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
[ Upstream commit ac62cc9d9cd6fa4c79e171c13dc8d58c3862b678 ]
It should be "#cooling-cells" instead of "cooling-cells". Fix it.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/armada-385-synology-ds116.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts
+++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts
@@ -170,7 +170,7 @@
3700 5
3900 6
4000 7>;
- cooling-cells = <2>;
+ #cooling-cells = <2>;
};
gpio-leds {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 006/217] vfio: ccw: fix error return in vfio_ccw_sch_event
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-08-23 7:51 ` [PATCH 4.14 005/217] arm: dts: armada: Fix "#cooling-cells" propertys name Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 007/217] perf tools: Fix error index for pmu event parser Greg Kroah-Hartman
` (197 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dong Jia Shi, Cornelia Huck, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
[ Upstream commit 2c861d89ccda2fbcea9358eff9cc5f8fae548be5 ]
If the device has not been registered, or there is work pending,
we should reschedule a sch_event call again.
Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
Message-Id: <20180502072559.50691-1-bjsdjshi@linux.vnet.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/cio/vfio_ccw_drv.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -176,6 +176,7 @@ static int vfio_ccw_sch_event(struct sub
{
struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev);
unsigned long flags;
+ int rc = -EAGAIN;
spin_lock_irqsave(sch->lock, flags);
if (!device_is_registered(&sch->dev))
@@ -186,6 +187,7 @@ static int vfio_ccw_sch_event(struct sub
if (cio_update_schib(sch)) {
vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
+ rc = 0;
goto out_unlock;
}
@@ -194,11 +196,12 @@ static int vfio_ccw_sch_event(struct sub
private->state = private->mdev ? VFIO_CCW_STATE_IDLE :
VFIO_CCW_STATE_STANDBY;
}
+ rc = 0;
out_unlock:
spin_unlock_irqrestore(sch->lock, flags);
- return 0;
+ return rc;
}
static struct css_device_id vfio_ccw_sch_ids[] = {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 007/217] perf tools: Fix error index for pmu event parser
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-08-23 7:51 ` [PATCH 4.14 006/217] vfio: ccw: fix error return in vfio_ccw_sch_event Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 008/217] Input: synaptics-rmi4 - fix axis-swap behavior Greg Kroah-Hartman
` (196 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Arnaldo Carvalho de Melo,
Alexander Shishkin, Andi Kleen, David Ahern, Frederic Weisbecker,
Milian Wolff, Namhyung Kim, Peter Zijlstra, Stephane Eranian,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit f7fa827f5f432a0b1f34e10fc49da93aeef9f817 ]
For events we provide specific error message we need to set error column
index, PMU parser is missing that, adding it.
Before:
$ perf stat -e cycles,krava/cycles/ kill
event syntax error: 'cycles,krava/cycles/'
\___ Cannot find PMU `krava'. Missing kernel support?
After:
$ perf stat -e cycles,krava/cycles/ kill
event syntax error: 'cycles,krava/cycles/'
\___ Cannot find PMU `krava'. Missing kernel support?
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Milian Wolff <milian.wolff@kdab.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/r/20180606221513.11302-3-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/parse-events.y | 5 +++++
1 file changed, 5 insertions(+)
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -226,11 +226,16 @@ event_def: event_pmu |
event_pmu:
PE_NAME opt_pmu_config
{
+ struct parse_events_state *parse_state = _parse_state;
+ struct parse_events_error *error = parse_state->error;
struct list_head *list, *orig_terms, *terms;
if (parse_events_copy_term_list($2, &orig_terms))
YYABORT;
+ if (error)
+ error->idx = @1.first_column;
+
ALLOC_LIST(list);
if (parse_events_add_pmu(_parse_state, list, $1, $2)) {
struct perf_pmu *pmu = NULL;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 008/217] Input: synaptics-rmi4 - fix axis-swap behavior
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 007/217] perf tools: Fix error index for pmu event parser Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 009/217] IB/mlx4: Fix an error handling path in mlx4_ib_rereg_user_mr() Greg Kroah-Hartman
` (195 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lucas Stach, Nick Dyer,
Dmitry Torokhov, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <l.stach@pengutronix.de>
[ Upstream commit 645a397d325db6e1bb36588095ae637738b37693 ]
The documentation for the touchscreen-swapped-x-y property states that
swapping is done after inverting if both are used. RMI4 did it the other
way around, leading to inconsistent behavior with regard to other
touchscreens.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Nick Dyer <nick@shmanahar.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_2d_sensor.c | 34 ++++++++++++++++------------------
1 file changed, 16 insertions(+), 18 deletions(-)
--- a/drivers/input/rmi4/rmi_2d_sensor.c
+++ b/drivers/input/rmi4/rmi_2d_sensor.c
@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rm
if (obj->type == RMI_2D_OBJECT_NONE)
return;
- if (axis_align->swap_axes)
- swap(obj->x, obj->y);
-
if (axis_align->flip_x)
obj->x = sensor->max_x - obj->x;
if (axis_align->flip_y)
obj->y = sensor->max_y - obj->y;
+ if (axis_align->swap_axes)
+ swap(obj->x, obj->y);
+
/*
* Here checking if X offset or y offset are specified is
* redundant. We just add the offsets or clip the values.
@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi
x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x));
y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y));
- if (axis_align->swap_axes)
- swap(x, y);
-
if (axis_align->flip_x)
x = min(RMI_2D_REL_POS_MAX, -x);
if (axis_align->flip_y)
y = min(RMI_2D_REL_POS_MAX, -y);
+ if (axis_align->swap_axes)
+ swap(x, y);
+
if (x || y) {
input_report_rel(sensor->input, REL_X, x);
input_report_rel(sensor->input, REL_Y, y);
@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_para
struct input_dev *input = sensor->input;
int res_x;
int res_y;
+ int max_x, max_y;
int input_flags = 0;
if (sensor->report_abs) {
- if (sensor->axis_align.swap_axes) {
- swap(sensor->max_x, sensor->max_y);
- swap(sensor->axis_align.clip_x_low,
- sensor->axis_align.clip_y_low);
- swap(sensor->axis_align.clip_x_high,
- sensor->axis_align.clip_y_high);
- }
-
sensor->min_x = sensor->axis_align.clip_x_low;
if (sensor->axis_align.clip_x_high)
sensor->max_x = min(sensor->max_x,
@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_para
sensor->axis_align.clip_y_high);
set_bit(EV_ABS, input->evbit);
- input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x,
- 0, 0);
- input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y,
- 0, 0);
+
+ max_x = sensor->max_x;
+ max_y = sensor->max_y;
+ if (sensor->axis_align.swap_axes)
+ swap(max_x, max_y);
+ input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
+ input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
if (sensor->x_mm && sensor->y_mm) {
res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm;
res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm;
+ if (sensor->axis_align.swap_axes)
+ swap(res_x, res_y);
input_abs_set_res(input, ABS_X, res_x);
input_abs_set_res(input, ABS_Y, res_y);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 009/217] IB/mlx4: Fix an error handling path in mlx4_ib_rereg_user_mr()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 008/217] Input: synaptics-rmi4 - fix axis-swap behavior Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 010/217] drm/bridge/sii8620: fix loops in EDID fetch logic Greg Kroah-Hartman
` (194 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Jason Gunthorpe,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
[ Upstream commit 3dc7c7badb7502ec3e3aa817a8bdd9e53aa54c52 ]
Before returning -EPERM we should release some resources, as already done
in the other error handling path of the function.
Fixes: d8f9cc328c88 ("IB/mlx4: Mark user MR as writable if actual virtual memory is writable")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/mr.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -247,8 +247,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *
}
if (flags & IB_MR_REREG_ACCESS) {
- if (ib_access_writable(mr_access_flags) && !mmr->umem->writable)
- return -EPERM;
+ if (ib_access_writable(mr_access_flags) &&
+ !mmr->umem->writable) {
+ err = -EPERM;
+ goto release_mpt_entry;
+ }
err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
convert_access(mr_access_flags));
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 010/217] drm/bridge/sii8620: fix loops in EDID fetch logic
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 009/217] IB/mlx4: Fix an error handling path in mlx4_ib_rereg_user_mr() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 011/217] drm/bridge/sii8620: fix potential buffer overflow Greg Kroah-Hartman
` (193 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrzej Hajda, Marek Szyprowski,
Maciej Purski, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <a.hajda@samsung.com>
[ Upstream commit 8e627a1b1ce8feb3e1da4428b71b9b4905f04888 ]
Function should constantly check if cable is connected and finish
in finite time.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Maciej Purski <m.purski@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180115173357.31067-4-a.hajda@samsung.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/sil-sii8620.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -788,6 +788,7 @@ static void sii8620_burst_rx_all(struct
static void sii8620_fetch_edid(struct sii8620 *ctx)
{
u8 lm_ddc, ddc_cmd, int3, cbus;
+ unsigned long timeout;
int fetched, i;
int edid_len = EDID_LENGTH;
u8 *edid;
@@ -837,23 +838,31 @@ static void sii8620_fetch_edid(struct si
REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK
);
- do {
- int3 = sii8620_readb(ctx, REG_INTR3);
+ int3 = 0;
+ timeout = jiffies + msecs_to_jiffies(200);
+ for (;;) {
cbus = sii8620_readb(ctx, REG_CBUS_STATUS);
-
- if (int3 & BIT_DDC_CMD_DONE)
- break;
-
- if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) {
+ if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) {
+ kfree(edid);
+ edid = NULL;
+ goto end;
+ }
+ if (int3 & BIT_DDC_CMD_DONE) {
+ if (sii8620_readb(ctx, REG_DDC_DOUT_CNT)
+ >= FETCH_SIZE)
+ break;
+ } else {
+ int3 = sii8620_readb(ctx, REG_INTR3);
+ }
+ if (time_is_before_jiffies(timeout)) {
+ ctx->error = -ETIMEDOUT;
+ dev_err(ctx->dev, "timeout during EDID read\n");
kfree(edid);
edid = NULL;
goto end;
}
- } while (1);
-
- sii8620_readb(ctx, REG_DDC_STATUS);
- while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE)
usleep_range(10, 20);
+ }
sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE);
if (fetched + FETCH_SIZE == EDID_LENGTH) {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 011/217] drm/bridge/sii8620: fix potential buffer overflow
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 010/217] drm/bridge/sii8620: fix loops in EDID fetch logic Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 012/217] ARC: Explicitly add -mmedium-calls to CFLAGS Greg Kroah-Hartman
` (192 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Maciej Purski,
Andrzej Hajda, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Purski <m.purski@samsung.com>
[ Upstream commit 9378cecb1ce5d618b8aff4d65113ddcf72fc1011 ]
Buffer overflow error should not occur, as mode_fixup() callback
filters pixel clock value and it should never exceed 600000. However,
current implementation is not obviously safe and relies on
implementation of mode_fixup().
Make 'i' variable never reach unsafe value in order to avoid buffer
overflow error.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: bf1722ca ("drm/bridge/sii8620: rewrite hdmi start sequence")
Signed-off-by: Maciej Purski <m.purski@samsung.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1511341718-6974-1-git-send-email-m.purski@samsung.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/sil-sii8620.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -1196,7 +1196,7 @@ static void sii8620_start_hdmi(struct si
int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3);
int i;
- for (i = 0; i < ARRAY_SIZE(clk_spec); ++i)
+ for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i)
if (clk < clk_spec[i].max_clk)
break;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 012/217] ARC: Explicitly add -mmedium-calls to CFLAGS
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 011/217] drm/bridge/sii8620: fix potential buffer overflow Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 013/217] hwmon: (nct6775) Fix loop limit Greg Kroah-Hartman
` (191 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <abrodkin@synopsys.com>
[ Upstream commit 74c11e300c103af47db5b658fdcf28002421e250 ]
GCC built for arc*-*-linux has "-mmedium-calls" implicitly enabled by default
thus we don't see any problems during Linux kernel compilation.
----------------------------->8------------------------
arc-linux-gcc -mcpu=arc700 -Q --help=target | grep calls
-mlong-calls [disabled]
-mmedium-calls [enabled]
----------------------------->8------------------------
But if we try to use so-called Elf32 toolchain with GCC configured for
arc*-*-elf* then we'd see the following failure:
----------------------------->8------------------------
init/do_mounts.o: In function 'init_rootfs':
do_mounts.c:(.init.text+0x108): relocation truncated to fit: R_ARC_S21W_PCREL
against symbol 'unregister_filesystem' defined in .text section in fs/filesystems.o
arc-elf32-ld: final link failed: Symbol needs debug section which does not exist
make: *** [vmlinux] Error 1
----------------------------->8------------------------
That happens because neither "-mmedium-calls" nor "-mlong-calls" are enabled in
Elf32 GCC:
----------------------------->8------------------------
arc-elf32-gcc -mcpu=arc700 -Q --help=target | grep calls
-mlong-calls [disabled]
-mmedium-calls [disabled]
----------------------------->8------------------------
Now to make it possible to use Elf32 toolchain for building Linux kernel
we're explicitly add "-mmedium-calls" to CFLAGS.
And since we add "-mmedium-calls" to the global CFLAGS there's no point in
having per-file copies thus removing them.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/Makefile | 15 +--------------
1 file changed, 1 insertion(+), 14 deletions(-)
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -16,7 +16,7 @@ endif
KBUILD_DEFCONFIG := nsim_700_defconfig
-cflags-y += -fno-common -pipe -fno-builtin -D__linux__
+cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7
cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs
@@ -140,16 +140,3 @@ dtbs: scripts
archclean:
$(Q)$(MAKE) $(clean)=$(boot)
-
-# Hacks to enable final link due to absence of link-time branch relexation
-# and gcc choosing optimal(shorter) branches at -O3
-#
-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
-# However lib/decompress_inflate.o (.init.text) calls
-# zlib_inflate_workspacesize (.text) causing relocation errors.
-# Thus forcing all exten calls in this file to be long calls
-export CFLAGS_decompress_inflate.o = -mmedium-calls
-export CFLAGS_initramfs.o = -mmedium-calls
-ifdef CONFIG_SMP
-export CFLAGS_core.o = -mmedium-calls
-endif
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 013/217] hwmon: (nct6775) Fix loop limit
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 012/217] ARC: Explicitly add -mmedium-calls to CFLAGS Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 014/217] soc: imx: gpcv2: correct PGC offset Greg Kroah-Hartman
` (190 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Menzel, Guenter Roeck, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 91bb8f45f73f19a0150c233c0f11cdeb6d71d1e9 ]
Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label
handling") changed a loop limit from "data->temp_label_num - 1" to "32",
as part of moving from a string array to a bit mask. This results in the
following error, reported by UBSAN.
UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27
shift exponent 32 is too large for 32-bit type 'long unsigned int'
Similar to the original loop, the limit has to be one less than the
number of bits.
Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling")
Reported-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
Cc: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
Tested-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/nct6775.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -4107,7 +4107,7 @@ static int nct6775_probe(struct platform
* The temperature is already monitored if the respective bit in <mask>
* is set.
*/
- for (i = 0; i < 32; i++) {
+ for (i = 0; i < 31; i++) {
if (!(data->temp_mask & BIT(i + 1)))
continue;
if (!reg_temp_alternate[i])
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 014/217] soc: imx: gpcv2: correct PGC offset
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 013/217] hwmon: (nct6775) Fix loop limit Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 015/217] usb: dwc3: pci: add support for Intel IceLake Greg Kroah-Hartman
` (189 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anson Huang, Andrey Smirnov,
Fabio Estevam, Shawn Guo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anson Huang <Anson.Huang@nxp.com>
[ Upstream commit 3637f12faf507b0a4b8ac1e7115fc99583ab1db3 ]
Correct MIPI/PCIe/USB_HSIC's PGC offset based on
design RTL, the values in the Reference Manual
(Rev. 1, 01/2018 and the older ones) are incorrect.
The correct offset values should be as below:
0x800 ~ 0x83F: PGC for core0 of A7 platform;
0x840 ~ 0x87F: PGC for core1 of A7 platform;
0x880 ~ 0x8BF: PGC for SCU of A7 platform;
0xA00 ~ 0xA3F: PGC for fastmix/megamix;
0xC00 ~ 0xC3F: PGC for MIPI PHY;
0xC40 ~ 0xC7F: PGC for PCIe_PHY;
0xC80 ~ 0xCBF: PGC for USB OTG1 PHY;
0xCC0 ~ 0xCFF: PGC for USB OTG2 PHY;
0xD00 ~ 0xD3F: PGC for USB HSIC PHY;
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Fixes: 03aa12629fc4 ("soc: imx: Add GPCv2 power gating driver")
Acked-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/imx/gpcv2.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -39,10 +39,15 @@
#define GPC_M4_PU_PDN_FLG 0x1bc
-
-#define PGC_MIPI 4
-#define PGC_PCIE 5
-#define PGC_USB_HSIC 8
+/*
+ * The PGC offset values in Reference Manual
+ * (Rev. 1, 01/2018 and the older ones) GPC chapter's
+ * GPC_PGC memory map are incorrect, below offset
+ * values are from design RTL.
+ */
+#define PGC_MIPI 16
+#define PGC_PCIE 17
+#define PGC_USB_HSIC 20
#define GPC_PGC_CTRL(n) (0x800 + (n) * 0x40)
#define GPC_PGC_SR(n) (GPC_PGC_CTRL(n) + 0xc)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 015/217] usb: dwc3: pci: add support for Intel IceLake
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 014/217] soc: imx: gpcv2: correct PGC offset Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 016/217] usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers Greg Kroah-Hartman
` (188 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heikki Krogerus, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
[ Upstream commit 00908693c481f7298adf8cf4d2ff3dfbea8c375f ]
PCI IDs for Intel IceLake.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-pci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -41,6 +41,7 @@
#define PCI_DEVICE_ID_INTEL_GLK 0x31aa
#define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
+#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee
#define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
#define PCI_INTEL_BXT_FUNC_PMU_PWR 4
@@ -273,6 +274,7 @@ static const struct pci_device_id dwc3_p
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
{ } /* Terminating Entry */
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 016/217] usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 015/217] usb: dwc3: pci: add support for Intel IceLake Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 017/217] usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc() Greg Kroah-Hartman
` (187 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Protsenko, Vincent Pelletier,
Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Pelletier <plr.vincent@gmail.com>
[ Upstream commit d52e4d0c0c428bf2ba35074a7495cdb28e2efbae ]
This bug happens only when the UDC needs to sleep during usb_ep_dequeue,
as is the case for (at least) dwc3.
[ 382.200896] BUG: scheduling while atomic: screen/1808/0x00000100
[ 382.207124] 4 locks held by screen/1808:
[ 382.211266] #0: (rcu_callback){....}, at: [<c10b4ff0>] rcu_process_callbacks+0x260/0x440
[ 382.219949] #1: (rcu_read_lock_sched){....}, at: [<c1358ba0>] percpu_ref_switch_to_atomic_rcu+0xb0/0x130
[ 382.230034] #2: (&(&ctx->ctx_lock)->rlock){....}, at: [<c11f0c73>] free_ioctx_users+0x23/0xd0
[ 382.230096] #3: (&(&ffs->eps_lock)->rlock){....}, at: [<f81e7710>] ffs_aio_cancel+0x20/0x60 [usb_f_fs]
[ 382.230160] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil intel_powerclamp coretemp dwc3 kvm_intel ulpi udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd gpio_keys usbcore basincove_gpadc industrialio usb_common
[ 382.230407] CPU: 1 PID: 1808 Comm: screen Not tainted 4.14.0-edison+ #117
[ 382.230416] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
[ 382.230425] Call Trace:
[ 382.230438] <SOFTIRQ>
[ 382.230466] dump_stack+0x47/0x62
[ 382.230498] __schedule_bug+0x61/0x80
[ 382.230522] __schedule+0x43/0x7a0
[ 382.230587] schedule+0x5f/0x70
[ 382.230625] dwc3_gadget_ep_dequeue+0x14c/0x270 [dwc3]
[ 382.230669] ? do_wait_intr_irq+0x70/0x70
[ 382.230724] usb_ep_dequeue+0x19/0x90 [udc_core]
[ 382.230770] ffs_aio_cancel+0x37/0x60 [usb_f_fs]
[ 382.230798] kiocb_cancel+0x31/0x40
[ 382.230822] free_ioctx_users+0x4d/0xd0
[ 382.230858] percpu_ref_switch_to_atomic_rcu+0x10a/0x130
[ 382.230881] ? percpu_ref_exit+0x40/0x40
[ 382.230904] rcu_process_callbacks+0x2b3/0x440
[ 382.230965] __do_softirq+0xf8/0x26b
[ 382.231011] ? __softirqentry_text_start+0x8/0x8
[ 382.231033] do_softirq_own_stack+0x22/0x30
[ 382.231042] </SOFTIRQ>
[ 382.231071] irq_exit+0x45/0xc0
[ 382.231089] smp_apic_timer_interrupt+0x13c/0x150
[ 382.231118] apic_timer_interrupt+0x35/0x3c
[ 382.231132] EIP: __copy_user_ll+0xe2/0xf0
[ 382.231142] EFLAGS: 00210293 CPU: 1
[ 382.231154] EAX: bfd4508c EBX: 00000004 ECX: 00000003 EDX: f3d8fe50
[ 382.231165] ESI: f3d8fe51 EDI: bfd4508d EBP: f3d8fe14 ESP: f3d8fe08
[ 382.231176] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 382.231265] core_sys_select+0x25f/0x320
[ 382.231346] ? __wake_up_common_lock+0x62/0x80
[ 382.231399] ? tty_ldisc_deref+0x13/0x20
[ 382.231438] ? ldsem_up_read+0x1b/0x40
[ 382.231459] ? tty_ldisc_deref+0x13/0x20
[ 382.231479] ? tty_write+0x29f/0x2e0
[ 382.231514] ? n_tty_ioctl+0xe0/0xe0
[ 382.231541] ? tty_write_unlock+0x30/0x30
[ 382.231566] ? __vfs_write+0x22/0x110
[ 382.231604] ? security_file_permission+0x2f/0xd0
[ 382.231635] ? rw_verify_area+0xac/0x120
[ 382.231677] ? vfs_write+0x103/0x180
[ 382.231711] SyS_select+0x87/0xc0
[ 382.231739] ? SyS_write+0x42/0x90
[ 382.231781] do_fast_syscall_32+0xd6/0x1a0
[ 382.231836] entry_SYSENTER_32+0x47/0x71
[ 382.231848] EIP: 0xb7f75b05
[ 382.231857] EFLAGS: 00000246 CPU: 1
[ 382.231868] EAX: ffffffda EBX: 00000400 ECX: bfd4508c EDX: bfd4510c
[ 382.231878] ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: bfd45020
[ 382.231889] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
[ 382.232281] softirq: huh, entered softirq 9 RCU c10b4d90 with preempt_count 00000100, exited with 00000000?
Tested-by: Sam Protsenko <semen.protsenko@linaro.org>
Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -219,6 +219,7 @@ struct ffs_io_data {
struct mm_struct *mm;
struct work_struct work;
+ struct work_struct cancellation_work;
struct usb_ep *ep;
struct usb_request *req;
@@ -1073,22 +1074,31 @@ ffs_epfile_open(struct inode *inode, str
return 0;
}
+static void ffs_aio_cancel_worker(struct work_struct *work)
+{
+ struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
+ cancellation_work);
+
+ ENTER();
+
+ usb_ep_dequeue(io_data->ep, io_data->req);
+}
+
static int ffs_aio_cancel(struct kiocb *kiocb)
{
struct ffs_io_data *io_data = kiocb->private;
- struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
+ struct ffs_data *ffs = io_data->ffs;
int value;
ENTER();
- spin_lock_irq(&epfile->ffs->eps_lock);
-
- if (likely(io_data && io_data->ep && io_data->req))
- value = usb_ep_dequeue(io_data->ep, io_data->req);
- else
+ if (likely(io_data && io_data->ep && io_data->req)) {
+ INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
+ queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
+ value = -EINPROGRESS;
+ } else {
value = -EINVAL;
-
- spin_unlock_irq(&epfile->ffs->eps_lock);
+ }
return value;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 017/217] usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 016/217] usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 018/217] usb: dwc3: of-simple: fix use-after-free on remove Greg Kroah-Hartman
` (186 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zeng Tao, Minas Harutyunyan,
Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
[ Upstream commit 1ffba9058737af2ddeebc813faa8ea9b16bc892a ]
In case of requests queue is empty reset EP target_frame to
initial value.
This allow restarting ISOC traffic in case when function
driver queued requests with interruptions.
Tested-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -932,6 +932,7 @@ static void dwc2_gadget_start_isoc_ddma(
u32 ctrl;
if (list_empty(&hs_ep->queue)) {
+ hs_ep->target_frame = TARGET_FRAME_INITIAL;
dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__);
return;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 018/217] usb: dwc3: of-simple: fix use-after-free on remove
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 017/217] usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 019/217] ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th Greg Kroah-Hartman
` (185 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 896e518883f18e601335908192e33426c1f599a4 ]
The clocks have already been explicitly disabled and put as part of
remove() so the runtime suspend callback must not be run when balancing
the runtime PM usage count before returning.
Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-of-simple.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -132,8 +132,9 @@ static int dwc3_of_simple_remove(struct
of_platform_depopulate(dev);
- pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_set_suspended(dev);
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 019/217] ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 018/217] usb: dwc3: of-simple: fix use-after-free on remove Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 020/217] netfilter: ipv6: nf_defrag: reduce struct net memory waste Greg Kroah-Hartman
` (184 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Rafael J. Wysocki,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 8195a655e5ce09550aff81b2573d9b015d520cb9 ]
On this system EC interrupt triggers constantly kicking devices out of
low power states and thus blocking power management. The system also has
a PCIe root port hosting Alpine Ridge Thunderbolt controller and it
never gets a chance to go to D3cold because of this.
Since the power button works the same regardless if EC interrupt is
enabled or not during s2idle, add a quirk for this machine that sets
ec_no_wakeup=true preventing spurious wakeups.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/ec.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -2029,6 +2029,17 @@ static inline void acpi_ec_query_exit(vo
}
}
+static const struct dmi_system_id acpi_ec_no_wakeup[] = {
+ {
+ .ident = "Thinkpad X1 Carbon 6th",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
+ },
+ },
+ { },
+};
+
int __init acpi_ec_init(void)
{
int result;
@@ -2039,6 +2050,15 @@ int __init acpi_ec_init(void)
if (result)
return result;
+ /*
+ * Disable EC wakeup on following systems to prevent periodic
+ * wakeup from EC GPE.
+ */
+ if (dmi_check_system(acpi_ec_no_wakeup)) {
+ ec_no_wakeup = true;
+ pr_debug("Disabling EC wakeup on suspend-to-idle\n");
+ }
+
/* Drivers must be started after acpi_ec_query_init() */
dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
/*
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 020/217] netfilter: ipv6: nf_defrag: reduce struct net memory waste
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 019/217] ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 021/217] netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister Greg Kroah-Hartman
` (183 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Pablo Neira Ayuso, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ]
It is a waste of memory to use a full "struct netns_sysctl_ipv6"
while only one pointer is really used, considering netns_sysctl_ipv6
keeps growing.
Also, since "struct netns_frags" has cache line alignment,
it is better to move the frags_hdr pointer outside, otherwise
we spend a full cache line for this pointer.
This saves 192 bytes of memory per netns.
Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/net_namespace.h | 1 +
include/net/netns/ipv6.h | 1 -
net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++---
3 files changed, 4 insertions(+), 4 deletions(-)
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -120,6 +120,7 @@ struct net {
#endif
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
struct netns_nf_frag nf_frag;
+ struct ctl_table_header *nf_frag_frags_hdr;
#endif
struct sock *nfnl;
struct sock *nfnl_stash;
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -94,7 +94,6 @@ struct netns_ipv6 {
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
struct netns_nf_frag {
- struct netns_sysctl_ipv6 sysctl;
struct netns_frags frags;
};
#endif
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -117,7 +117,7 @@ static int nf_ct_frag6_sysctl_register(s
if (hdr == NULL)
goto err_reg;
- net->nf_frag.sysctl.frags_hdr = hdr;
+ net->nf_frag_frags_hdr = hdr;
return 0;
err_reg:
@@ -131,8 +131,8 @@ static void __net_exit nf_ct_frags6_sysc
{
struct ctl_table *table;
- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
+ table = net->nf_frag_frags_hdr->ctl_table_arg;
+ unregister_net_sysctl_table(net->nf_frag_frags_hdr);
if (!net_eq(net, &init_net))
kfree(table);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 021/217] netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 020/217] netfilter: ipv6: nf_defrag: reduce struct net memory waste Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 022/217] selftests: pstore: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
` (182 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gao Feng, Pablo Neira Ayuso, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Feng <gfree.wind@vip.163.com>
[ Upstream commit ad9852af97587b8abe8102f9ddcb05c9769656f6 ]
The helper module would be unloaded after nf_conntrack_helper_unregister,
so it may cause a possible panic caused by race.
nf_ct_iterate_destroy(unhelp, me) reset the helper of conntrack as NULL,
but maybe someone has gotten the helper pointer during this period. Then
it would panic, when it accesses the helper and the module was unloaded.
Take an example as following:
CPU0 CPU1
ctnetlink_dump_helpinfo
helper = rcu_dereference(help->helper);
unhelp
set helper as NULL
unload helper module
helper->to_nlattr(skb, ct);
As above, the cpu0 tries to access the helper and its module is unloaded,
then the panic happens.
Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_helper.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(stru
nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
nf_ct_iterate_destroy(unhelp, me);
+
+ /* Maybe someone has gotten the helper already when unhelp above.
+ * So need to wait it.
+ */
+ synchronize_rcu();
}
EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 022/217] selftests: pstore: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 021/217] netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 023/217] selftests: static_keys: " Greg Kroah-Hartman
` (181 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
Kees Cook, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 856e7c4b619af622d56b3b454f7bec32a170ac99 ]
When pstore_post_reboot test gets skipped because of unmet dependencies
and/or unsupported configuration, it returns 0 which is treated as a pass
by the Kselftest framework. This leads to false positive result even when
the test could not be run.
Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/pstore/pstore_post_reboot_tests | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
+++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
@@ -7,13 +7,16 @@
#
# Released under the terms of the GPL v2.
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
. ./common_tests
if [ -e $REBOOT_FLAG ]; then
rm $REBOOT_FLAG
else
prlog "pstore_crash_test has not been executed yet. we skip further tests."
- exit 0
+ exit $ksft_skip
fi
prlog -n "Mounting pstore filesystem ... "
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 023/217] selftests: static_keys: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 022/217] selftests: pstore: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 024/217] selftests: sysctl: " Greg Kroah-Hartman
` (180 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 8781578087b8fb8829558bac96c3c24e5ba26f82 ]
When static_keys test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as a fail
by the Kselftest framework. This leads to false negative result even when
the test could not be run.
Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.
Added an explicit searches for test_static_key_base and test_static_keys
modules and return skip code if they aren't found to differentiate between
the failure to load the module condition and module not found condition.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/static_keys/test_static_keys.sh | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/tools/testing/selftests/static_keys/test_static_keys.sh
+++ b/tools/testing/selftests/static_keys/test_static_keys.sh
@@ -2,6 +2,19 @@
# SPDX-License-Identifier: GPL-2.0
# Runs static keys kernel module tests
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+if ! /sbin/modprobe -q -n test_static_key_base; then
+ echo "static_key: module test_static_key_base is not found [SKIP]"
+ exit $ksft_skip
+fi
+
+if ! /sbin/modprobe -q -n test_static_keys; then
+ echo "static_key: module test_static_keys is not found [SKIP]"
+ exit $ksft_skip
+fi
+
if /sbin/modprobe -q test_static_key_base; then
if /sbin/modprobe -q test_static_keys; then
echo "static_key: ok"
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 024/217] selftests: sysctl: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 023/217] selftests: static_keys: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 025/217] selftests: user: " Greg Kroah-Hartman
` (179 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
Kees Cook, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit c7db6ffb831fd36a03485a0d88b1e505378975ad ]
When sysctl test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative result
even when the test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.
Changed return code to kselftest skip code in skip error legs that check
requirements and module probe test error leg.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/sysctl/sysctl.sh | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
@@ -14,6 +14,9 @@
# This performs a series tests against the proc sysctl interface.
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
TEST_NAME="sysctl"
TEST_DRIVER="test_${TEST_NAME}"
TEST_DIR=$(dirname $0)
@@ -41,7 +44,7 @@ test_modprobe()
echo "$0: $DIR not present" >&2
echo "You must have the following enabled in your kernel:" >&2
cat $TEST_DIR/config >&2
- exit 1
+ exit $ksft_skip
fi
}
@@ -98,28 +101,30 @@ test_reqs()
uid=$(id -u)
if [ $uid -ne 0 ]; then
echo $msg must be run as root >&2
- exit 0
+ exit $ksft_skip
fi
if ! which perl 2> /dev/null > /dev/null; then
echo "$0: You need perl installed"
- exit 1
+ exit $ksft_skip
fi
if ! which getconf 2> /dev/null > /dev/null; then
echo "$0: You need getconf installed"
- exit 1
+ exit $ksft_skip
fi
if ! which diff 2> /dev/null > /dev/null; then
echo "$0: You need diff installed"
- exit 1
+ exit $ksft_skip
fi
}
function load_req_mod()
{
- trap "test_modprobe" EXIT
-
if [ ! -d $DIR ]; then
+ if ! modprobe -q -n $TEST_DRIVER; then
+ echo "$0: module $TEST_DRIVER not found [SKIP]"
+ exit $ksft_skip
+ fi
modprobe $TEST_DRIVER
if [ $? -ne 0 ]; then
exit
@@ -765,6 +770,7 @@ function parse_args()
test_reqs
allow_user_defaults
check_production_sysctl_writes_strict
+test_modprobe
load_req_mod
trap "test_finish" EXIT
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 025/217] selftests: user: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 024/217] selftests: sysctl: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 026/217] selftests: zram: " Greg Kroah-Hartman
` (178 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit d7d5311d4aa9611fe1a5a851e6f75733237a668a ]
When user test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative result
even when the test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run. Add an explicit check
for module presence and return skip code if module isn't present.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/user/test_user_copy.sh | 7 +++++++
1 file changed, 7 insertions(+)
--- a/tools/testing/selftests/user/test_user_copy.sh
+++ b/tools/testing/selftests/user/test_user_copy.sh
@@ -2,6 +2,13 @@
# SPDX-License-Identifier: GPL-2.0
# Runs copy_to/from_user infrastructure using test_user_copy kernel module
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+if ! /sbin/modprobe -q -n test_user_copy; then
+ echo "user: module test_user_copy is not found [SKIP]"
+ exit $ksft_skip
+fi
if /sbin/modprobe -q test_user_copy; then
/sbin/modprobe -q -r test_user_copy
echo "user_copy: ok"
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 026/217] selftests: zram: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 025/217] selftests: user: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 027/217] selftests: vm: " Greg Kroah-Hartman
` (177 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 685814466bf8398192cf855415a0bb2cefc1930e ]
When zram test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative result
even when the test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/zram/zram.sh | 5 ++++-
tools/testing/selftests/zram/zram_lib.sh | 5 ++++-
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/tools/testing/selftests/zram/zram.sh
+++ b/tools/testing/selftests/zram/zram.sh
@@ -2,6 +2,9 @@
# SPDX-License-Identifier: GPL-2.0
TCID="zram.sh"
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
. ./zram_lib.sh
run_zram () {
@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then
else
echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
echo "$TCID : CONFIG_ZRAM is not set"
- exit 1
+ exit $ksft_skip
fi
--- a/tools/testing/selftests/zram/zram_lib.sh
+++ b/tools/testing/selftests/zram/zram_lib.sh
@@ -18,6 +18,9 @@ MODULE=0
dev_makeswap=-1
dev_mounted=-1
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
trap INT
check_prereqs()
@@ -27,7 +30,7 @@ check_prereqs()
if [ $uid -ne 0 ]; then
echo $msg must be run as root >&2
- exit 0
+ exit $ksft_skip
fi
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 027/217] selftests: vm: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 026/217] selftests: zram: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 028/217] selftests: sync: add config fragment for testing sync framework Greg Kroah-Hartman
` (176 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
Mike Rapoport, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit a4d7537789724985cafbc9260a31ca4f2b7cf123 ]
When vm test is skipped because of unmet dependencies and/or unsupported
configuration, it exits with error which is treated as a fail by the
Kselftest framework. This leads to false negative result even when the
test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Acked-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/vm/compaction_test.c | 4 +++-
tools/testing/selftests/vm/mlock2-tests.c | 12 +++++++-----
tools/testing/selftests/vm/run_vmtests | 5 ++++-
tools/testing/selftests/vm/userfaultfd.c | 4 +++-
4 files changed, 17 insertions(+), 8 deletions(-)
--- a/tools/testing/selftests/vm/compaction_test.c
+++ b/tools/testing/selftests/vm/compaction_test.c
@@ -16,6 +16,8 @@
#include <unistd.h>
#include <string.h>
+#include "../kselftest.h"
+
#define MAP_SIZE 1048576
struct map_list {
@@ -169,7 +171,7 @@ int main(int argc, char **argv)
printf("Either the sysctl compact_unevictable_allowed is not\n"
"set to 1 or couldn't read the proc file.\n"
"Skipping the test\n");
- return 0;
+ return KSFT_SKIP;
}
lim.rlim_cur = RLIM_INFINITY;
--- a/tools/testing/selftests/vm/mlock2-tests.c
+++ b/tools/testing/selftests/vm/mlock2-tests.c
@@ -9,6 +9,8 @@
#include <stdbool.h>
#include "mlock2.h"
+#include "../kselftest.h"
+
struct vm_boundaries {
unsigned long start;
unsigned long end;
@@ -303,7 +305,7 @@ static int test_mlock_lock()
if (mlock2_(map, 2 * page_size, 0)) {
if (errno == ENOSYS) {
printf("Cannot call new mlock family, skipping test\n");
- _exit(0);
+ _exit(KSFT_SKIP);
}
perror("mlock2(0)");
goto unmap;
@@ -412,7 +414,7 @@ static int test_mlock_onfault()
if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
if (errno == ENOSYS) {
printf("Cannot call new mlock family, skipping test\n");
- _exit(0);
+ _exit(KSFT_SKIP);
}
perror("mlock2(MLOCK_ONFAULT)");
goto unmap;
@@ -425,7 +427,7 @@ static int test_mlock_onfault()
if (munlock(map, 2 * page_size)) {
if (errno == ENOSYS) {
printf("Cannot call new mlock family, skipping test\n");
- _exit(0);
+ _exit(KSFT_SKIP);
}
perror("munlock()");
goto unmap;
@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present(
if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
if (errno == ENOSYS) {
printf("Cannot call new mlock family, skipping test\n");
- _exit(0);
+ _exit(KSFT_SKIP);
}
perror("mlock2(MLOCK_ONFAULT)");
goto unmap;
@@ -583,7 +585,7 @@ static int test_vma_management(bool call
if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) {
if (errno == ENOSYS) {
printf("Cannot call new mlock family, skipping test\n");
- _exit(0);
+ _exit(KSFT_SKIP);
}
perror("mlock(ONFAULT)\n");
goto out;
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -2,6 +2,9 @@
# SPDX-License-Identifier: GPL-2.0
#please run as root
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
mnt=./huge
exitcode=0
@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_K
echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
if [ $? -ne 0 ]; then
echo "Please run this test as root"
- exit 1
+ exit $ksft_skip
fi
while read name size unit; do
if [ "$name" = "HugePages_Free:" ]; then
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -69,6 +69,8 @@
#include <setjmp.h>
#include <stdbool.h>
+#include "../kselftest.h"
+
#ifdef __NR_userfaultfd
static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size;
@@ -1322,7 +1324,7 @@ int main(int argc, char **argv)
int main(void)
{
printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n");
- return 0;
+ return KSFT_SKIP;
}
#endif /* __NR_userfaultfd */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 028/217] selftests: sync: add config fragment for testing sync framework
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 027/217] selftests: vm: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 029/217] ARM: dts: NSP: Fix i2c controller interrupt type Greg Kroah-Hartman
` (175 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fathi Boudra, Anders Roxell,
Shuah Khan (Samsung OSG),
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fathi Boudra <fathi.boudra@linaro.org>
[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ]
Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled,
the sync test will be skipped:
TAP version 13
1..0 # Skipped: Sync framework not supported by kernel
Add a config fragment file to be able to run "make kselftest-merge" to
enable relevant configuration required in order to run the sync test.
Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
Link: https://lkml.org/lkml/2017/5/5/14
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/sync/config | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 tools/testing/selftests/sync/config
--- /dev/null
+++ b/tools/testing/selftests/sync/config
@@ -0,0 +1,4 @@
+CONFIG_STAGING=y
+CONFIG_ANDROID=y
+CONFIG_SYNC=y
+CONFIG_SW_SYNC=y
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 029/217] ARM: dts: NSP: Fix i2c controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 028/217] selftests: sync: add config fragment for testing sync framework Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 030/217] ARM: dts: NSP: Fix PCIe controllers interrupt types Greg Kroah-Hartman
` (174 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit a3e32e78a40017756c71ef6dad429ffe3301126a ]
The i2c controller should use IRQ_TYPE_LEVEL_HIGH instead of
IRQ_TYPE_NONE.
Fixes: 0f9f27a36d09 ("ARM: dts: NSP: Add I2C support to the DT")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -391,7 +391,7 @@
reg = <0x38000 0x50>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
dma-coherent;
status = "disabled";
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 030/217] ARM: dts: NSP: Fix PCIe controllers interrupt types
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 029/217] ARM: dts: NSP: Fix i2c controller interrupt type Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 031/217] ARM: dts: BCM5301x: Fix i2c controller interrupt type Greg Kroah-Hartman
` (173 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 403fde644855bc71318c8db65646383e22653b13 ]
The interrupts for the PCIe controllers should all be of type
IRQ_TYPE_LEVEL_HIGH instead of IRQ_TYPE_NONE.
Fixes: d71eb9412088 ("ARM: dts: NSP: Add MSI support on PCI")
Fixes: 522199029fdc ("ARM: dts: NSP: Fix PCIE DT issue")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-nsp.dtsi | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -496,7 +496,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <0>;
@@ -519,10 +519,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
- <GIC_SPI 128 IRQ_TYPE_NONE>,
- <GIC_SPI 129 IRQ_TYPE_NONE>,
- <GIC_SPI 130 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
@@ -533,7 +533,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <1>;
@@ -556,10 +556,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
- <GIC_SPI 134 IRQ_TYPE_NONE>,
- <GIC_SPI 135 IRQ_TYPE_NONE>,
- <GIC_SPI 136 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
@@ -570,7 +570,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <2>;
@@ -593,10 +593,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
- <GIC_SPI 140 IRQ_TYPE_NONE>,
- <GIC_SPI 141 IRQ_TYPE_NONE>,
- <GIC_SPI 142 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 031/217] ARM: dts: BCM5301x: Fix i2c controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 030/217] ARM: dts: NSP: Fix PCIe controllers interrupt types Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 032/217] ARM: dts: Cygnus: Fix I2C " Greg Kroah-Hartman
` (172 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit a0a8338e905734518ab9b10b06e7fd0201228f8b ]
The i2c controller should be using IRQ_TYPE_LEVEL_HIGH, fix that.
Fixes: bb097e3e0045 ("ARM: dts: BCM5301X: Add I2C support to the DT")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -365,7 +365,7 @@
i2c0: i2c@18009000 {
compatible = "brcm,iproc-i2c";
reg = <0x18009000 0x50>;
- interrupts = <GIC_SPI 121 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
#address-cells = <1>;
#size-cells = <0>;
clock-frequency = <100000>;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 032/217] ARM: dts: Cygnus: Fix I2C controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 031/217] ARM: dts: BCM5301x: Fix i2c controller interrupt type Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 033/217] ARM: dts: Cygnus: Fix PCIe " Greg Kroah-Hartman
` (171 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit 71ca3409703b62b6a092d0d9d13f366c121bc5d3 ]
Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
Cygnus SoC.
Fixes: b51c05a331ff ("ARM: dts: add I2C device nodes for Broadcom Cygnus")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-cygnus.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
@@ -216,7 +216,7 @@
reg = <0x18008000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
@@ -245,7 +245,7 @@
reg = <0x1800b000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 033/217] ARM: dts: Cygnus: Fix PCIe controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 032/217] ARM: dts: Cygnus: Fix I2C " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 034/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742k Greg Kroah-Hartman
` (170 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit 6cb1628ad3506b315cdddd7676db0ff2af378d28 ]
Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
Cygnus SoC
Fixes: cd590b50a936 ("ARM: dts: enable PCIe support for Cygnus")
Fixes: f6b889358a82 ("ARM: dts: Enable MSI support for Broadcom Cygnus")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-cygnus.dtsi | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
@@ -256,7 +256,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <0>;
@@ -278,10 +278,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
- <GIC_SPI 97 IRQ_TYPE_NONE>,
- <GIC_SPI 98 IRQ_TYPE_NONE>,
- <GIC_SPI 99 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
};
};
@@ -291,7 +291,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <1>;
@@ -313,10 +313,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
- <GIC_SPI 103 IRQ_TYPE_NONE>,
- <GIC_SPI 104 IRQ_TYPE_NONE>,
- <GIC_SPI 105 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
};
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 034/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742k
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 033/217] ARM: dts: Cygnus: Fix PCIe " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 035/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742t Greg Kroah-Hartman
` (169 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Scott Branden, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Branden <scott.branden@broadcom.com>
[ Upstream commit eba92503e980c08ac353d0d669d0bb143979abcd ]
Specify 1.8V EMMC capabilities for bcm958742k board to indicate support
for UHS mode.
Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC")
Signed-off-by: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
+++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
@@ -43,6 +43,10 @@
enet-phy-lane-swap;
};
+&sdio0 {
+ mmc-ddr-1_8v;
+};
+
&uart2 {
status = "okay";
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 035/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742t
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 034/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742k Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 036/217] arm64: dts: ns2: Fix I2C controller interrupt type Greg Kroah-Hartman
` (168 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Scott Branden, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Branden <scott.branden@broadcom.com>
[ Upstream commit 37c2bd81a86ebb1cc934bf52a29c33d6f9abff7f ]
Specify 1.8V EMMC capabilities for bcm958742t board to indicate support
for UHS mode.
Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC")
Signed-off-by: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
+++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
@@ -42,3 +42,7 @@
&gphy0 {
enet-phy-lane-swap;
};
+
+&sdio0 {
+ mmc-ddr-1_8v;
+};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 036/217] arm64: dts: ns2: Fix I2C controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 035/217] arm64: dts: specify 1.8V EMMC capabilities for bcm958742t Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 037/217] arm64: dts: ns2: Fix PCIe " Greg Kroah-Hartman
` (167 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit e605c287deed45624e8d35a15e3f0b4faab1a62d ]
Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom NS2
SoC.
Fixes: 7ac674e8df7a ("arm64: dts: Add I2C nodes for NS2")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
@@ -566,7 +566,7 @@
reg = <0x66080000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
@@ -594,7 +594,7 @@
reg = <0x660b0000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 037/217] arm64: dts: ns2: Fix PCIe controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 036/217] arm64: dts: ns2: Fix I2C controller interrupt type Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 038/217] arm64: dts: Stingray: Fix I2C " Greg Kroah-Hartman
` (166 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit d0b8aed9e80ab526dbb04020bfc94ecea7bddb44 ]
Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
NS2 SoC.
Fixes: fd5e5dd56a2f ("arm64: dts: Add PCIe0 and PCIe4 DT nodes for NS2")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
@@ -118,7 +118,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <0>;
@@ -149,7 +149,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <4>;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 038/217] arm64: dts: Stingray: Fix I2C controller interrupt type
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 037/217] arm64: dts: ns2: Fix PCIe " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 039/217] drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error Greg Kroah-Hartman
` (165 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit 75af23c4736c5633894ea0baf9bca1cf6b248ca4 ]
Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
Stingray SoC.
Fixes: 1256ea18875d ("arm64: dts: Add I2C DT nodes for Stingray SoC")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
@@ -409,7 +409,7 @@
reg = <0x000b0000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 177 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 177 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
@@ -453,7 +453,7 @@
reg = <0x000e0000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 178 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 178 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 039/217] drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 038/217] arm64: dts: Stingray: Fix I2C " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 041/217] drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format Greg Kroah-Hartman
` (164 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hoan Tran, Will Deacon, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hoan Tran <hoan.tran@amperecomputing.com>
[ Upstream commit a45fc268db20ecd859bb61e25045912b3194b5e6 ]
This patch fixes the below parser error of the IOB SLOW PMU.
# perf stat -a -e iob-slow0/cycle-count/ sleep 1
evenf syntax error: 'iob-slow0/cycle-count/'
\___ parser error
It replaces the "-" character by "_" character inside the PMU name.
Signed-off-by: Hoan Tran <hoan.tran@amperecomputing.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/perf/xgene_pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct d
case PMU_TYPE_IOB:
return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id);
case PMU_TYPE_IOB_SLOW:
- return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id);
+ return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id);
case PMU_TYPE_MCB:
return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id);
case PMU_TYPE_MC:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 041/217] drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 039/217] drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 042/217] IB/rxe: Fix missing completion for mem_reg work requests Greg Kroah-Hartman
` (163 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Starkey, Liviu Dudau,
Ayan Kumar halder, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayan Kumar Halder <ayan.halder@arm.com>
[ Upstream commit ad7fda2e378f4356df621a39655f7c200b495d81 ]
On some Mali-DP processors, the LAYER_FORMAT register contains fields
other than the format. These bits were unconditionally cleared when
setting the pixel format, whereas they should be preserved at their
reset values.
Reported-by: Brian Starkey <brian.starkey@arm.com>
Reported-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Ayan Kumar halder <ayan.halder@arm.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/arm/malidp_planes.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -23,6 +23,7 @@
/* Layer specific register offsets */
#define MALIDP_LAYER_FORMAT 0x000
+#define LAYER_FORMAT_MASK 0x3f
#define MALIDP_LAYER_CONTROL 0x004
#define LAYER_ENABLE (1 << 0)
#define LAYER_FLOWCFG_MASK 7
@@ -278,7 +279,9 @@ static void malidp_de_plane_update(struc
dest_w = plane->state->crtc_w;
dest_h = plane->state->crtc_h;
- malidp_hw_write(mp->hwdev, ms->format, mp->layer->base);
+ val = malidp_hw_read(mp->hwdev, mp->layer->base);
+ val = (val & ~LAYER_FORMAT_MASK) | ms->format;
+ malidp_hw_write(mp->hwdev, val, mp->layer->base);
for (i = 0; i < ms->n_planes; i++) {
/* calculate the offset for the layer's plane registers */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 042/217] IB/rxe: Fix missing completion for mem_reg work requests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 041/217] drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 043/217] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store() Greg Kroah-Hartman
` (162 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vijay Immanuel, Yonatan Cohen,
Jason Gunthorpe, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijay Immanuel <vijayi@attalasystems.com>
[ Upstream commit 375dc53d032fc11e98036b5f228ad13f7c5933f5 ]
Run the completer task to post a work completion after processing
a memory registration or invalidate work request. This covers the
case where the memory registration or invalidate was the last work
request posted to the qp.
Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
Reviewed-by: Yonatan Cohen <yonatanc@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/rxe/rxe_req.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -645,6 +645,9 @@ next_wqe:
} else {
goto exit;
}
+ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
+ qp->sq_sig_type == IB_SIGNAL_ALL_WR)
+ rxe_run_task(&qp->comp.task, 1);
qp->req.wqe_index = next_index(qp->sq.queue,
qp->req.wqe_index);
goto next_wqe;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 043/217] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 042/217] IB/rxe: Fix missing completion for mem_reg work requests Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 044/217] usb: dwc2: alloc dma aligned buffer for isoc split in Greg Kroah-Hartman
` (161 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Garry, Tejun Heo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.garry@huawei.com>
[ Upstream commit fae2a63737e5973f1426bc139935a0f42e232844 ]
Currently smatch warns of possible Spectre-V1 issue in ahci_led_store():
drivers/ata/libahci.c:1150 ahci_led_store() warn: potential spectre issue 'pp->em_priv' (local cap)
Userspace controls @pmp from following callchain:
em_message->store()
->ata_scsi_em_message_store()
-->ap->ops->em_store()
--->ahci_led_store()
After the mask+shift @pmp is effectively an 8b value, which is used to
index into an array of length 8, so sanitize the array index.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libahci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -35,6 +35,7 @@
#include <linux/kernel.h>
#include <linux/gfp.h>
#include <linux/module.h>
+#include <linux/nospec.h>
#include <linux/blkdev.h>
#include <linux/delay.h>
#include <linux/interrupt.h>
@@ -1135,10 +1136,12 @@ static ssize_t ahci_led_store(struct ata
/* get the slot number from the message */
pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
- if (pmp < EM_MAX_SLOTS)
+ if (pmp < EM_MAX_SLOTS) {
+ pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
emp = &pp->em_priv[pmp];
- else
+ } else {
return -EINVAL;
+ }
/* mask off the activity bits if we are in sw_activity
* mode, user should turn off sw_activity before setting
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 044/217] usb: dwc2: alloc dma aligned buffer for isoc split in
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 043/217] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 045/217] usb: dwc2: fix isoc split in transfer with no data Greg Kroah-Hartman
` (160 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gevorg Sahakyan, Heiko Stuebner,
William Wu, Douglas Anderson, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit af424a410749ed7e0c2bffd3cedbc7c274d0ff6f ]
The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in
a more supported way") rips out a lot of code to simply the
allocation of aligned DMA. However, it also introduces a new
issue when use isoc split in transfer.
In my test case, I connect the dwc2 controller with an usb hs
Hub (GL852G-12), and plug an usb fs audio device (Plantronics
headset) into the downstream port of Hub. Then use the usb mic
to record, we can find noise when playback.
It's because that the usb Hub uses an MDATA for the first
transaction and a DATA0 for the second transaction for the isoc
split in transaction. An typical isoc split in transaction sequence
like this:
- SSPLIT IN transaction
- CSPLIT IN transaction
- MDATA packet
- CSPLIT IN transaction
- DATA0 packet
The DMA address of MDATA (urb->dma) is always DWORD-aligned, but
the DMA address of DATA0 (urb->dma + qtd->isoc_split_offset) may
not be DWORD-aligned, it depends on the qtd->isoc_split_offset (the
length of MDATA). In my test case, the length of MDATA is usually
unaligned, this cause DATA0 packet transmission error.
This patch use kmem_cache to allocate aligned DMA buf for isoc
split in transaction. Note that according to usb 2.0 spec, the
maximum data payload size is 1023 bytes for each fs isoc ep,
and the maximum allowable interrupt data payload size is 64 bytes
or less for fs interrupt ep. So we set the size of object to be
1024 bytes in the kmem cache.
Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/core.h | 3 +
drivers/usb/dwc2/hcd.c | 89 ++++++++++++++++++++++++++++++++++++++++---
drivers/usb/dwc2/hcd.h | 8 +++
drivers/usb/dwc2/hcd_intr.c | 8 +++
drivers/usb/dwc2/hcd_queue.c | 3 +
5 files changed, 106 insertions(+), 5 deletions(-)
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -872,6 +872,7 @@ struct dwc2_hregs_backup {
* @frame_list_sz: Frame list size
* @desc_gen_cache: Kmem cache for generic descriptors
* @desc_hsisoc_cache: Kmem cache for hs isochronous descriptors
+ * @unaligned_cache: Kmem cache for DMA mode to handle non-aligned buf
*
* These are for peripheral mode:
*
@@ -1004,6 +1005,8 @@ struct dwc2_hsotg {
u32 frame_list_sz;
struct kmem_cache *desc_gen_cache;
struct kmem_cache *desc_hsisoc_cache;
+ struct kmem_cache *unaligned_cache;
+#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024
#ifdef DEBUG
u32 frrem_samples;
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -1544,11 +1544,20 @@ static void dwc2_hc_start_transfer(struc
}
if (hsotg->params.host_dma) {
- dwc2_writel((u32)chan->xfer_dma,
- hsotg->regs + HCDMA(chan->hc_num));
+ dma_addr_t dma_addr;
+
+ if (chan->align_buf) {
+ if (dbg_hc(chan))
+ dev_vdbg(hsotg->dev, "align_buf\n");
+ dma_addr = chan->align_buf;
+ } else {
+ dma_addr = chan->xfer_dma;
+ }
+ dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num));
+
if (dbg_hc(chan))
dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n",
- (unsigned long)chan->xfer_dma, chan->hc_num);
+ (unsigned long)dma_addr, chan->hc_num);
}
/* Start the split */
@@ -2604,6 +2613,35 @@ static void dwc2_hc_init_xfer(struct dwc
}
}
+static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
+ struct dwc2_qh *qh,
+ struct dwc2_host_chan *chan)
+{
+ if (!hsotg->unaligned_cache ||
+ chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE)
+ return -ENOMEM;
+
+ if (!qh->dw_align_buf) {
+ qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache,
+ GFP_ATOMIC | GFP_DMA);
+ if (!qh->dw_align_buf)
+ return -ENOMEM;
+ }
+
+ qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf,
+ DWC2_KMEM_UNALIGNED_BUF_SIZE,
+ DMA_FROM_DEVICE);
+
+ if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) {
+ dev_err(hsotg->dev, "can't map align_buf\n");
+ chan->align_buf = 0;
+ return -EINVAL;
+ }
+
+ chan->align_buf = qh->dw_align_buf_dma;
+ return 0;
+}
+
#define DWC2_USB_DMA_ALIGN 4
static void dwc2_free_dma_aligned_buffer(struct urb *urb)
@@ -2783,6 +2821,32 @@ static int dwc2_assign_and_init_hc(struc
/* Set the transfer attributes */
dwc2_hc_init_xfer(hsotg, chan, qtd);
+ /* For non-dword aligned buffers */
+ if (hsotg->params.host_dma && qh->do_split &&
+ chan->ep_is_in && (chan->xfer_dma & 0x3)) {
+ dev_vdbg(hsotg->dev, "Non-aligned buffer\n");
+ if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) {
+ dev_err(hsotg->dev,
+ "Failed to allocate memory to handle non-aligned buffer\n");
+ /* Add channel back to free list */
+ chan->align_buf = 0;
+ chan->multi_count = 0;
+ list_add_tail(&chan->hc_list_entry,
+ &hsotg->free_hc_list);
+ qtd->in_process = 0;
+ qh->channel = NULL;
+ return -ENOMEM;
+ }
+ } else {
+ /*
+ * We assume that DMA is always aligned in non-split
+ * case or split out case. Warn if not.
+ */
+ WARN_ON_ONCE(hsotg->params.host_dma &&
+ (chan->xfer_dma & 0x3));
+ chan->align_buf = 0;
+ }
+
if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
chan->ep_type == USB_ENDPOINT_XFER_ISOC)
/*
@@ -5277,6 +5341,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso
}
}
+ if (hsotg->params.host_dma) {
+ /*
+ * Create kmem caches to handle non-aligned buffer
+ * in Buffer DMA mode.
+ */
+ hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma",
+ DWC2_KMEM_UNALIGNED_BUF_SIZE, 4,
+ SLAB_CACHE_DMA, NULL);
+ if (!hsotg->unaligned_cache)
+ dev_err(hsotg->dev,
+ "unable to create dwc2 unaligned cache\n");
+ }
+
hsotg->otg_port = 1;
hsotg->frame_list = NULL;
hsotg->frame_list_dma = 0;
@@ -5311,8 +5388,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso
return 0;
error4:
- kmem_cache_destroy(hsotg->desc_gen_cache);
+ kmem_cache_destroy(hsotg->unaligned_cache);
kmem_cache_destroy(hsotg->desc_hsisoc_cache);
+ kmem_cache_destroy(hsotg->desc_gen_cache);
error3:
dwc2_hcd_release(hsotg);
error2:
@@ -5353,8 +5431,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg *
usb_remove_hcd(hcd);
hsotg->priv = NULL;
- kmem_cache_destroy(hsotg->desc_gen_cache);
+ kmem_cache_destroy(hsotg->unaligned_cache);
kmem_cache_destroy(hsotg->desc_hsisoc_cache);
+ kmem_cache_destroy(hsotg->desc_gen_cache);
dwc2_hcd_release(hsotg);
usb_put_hcd(hcd);
--- a/drivers/usb/dwc2/hcd.h
+++ b/drivers/usb/dwc2/hcd.h
@@ -75,6 +75,8 @@ struct dwc2_qh;
* (micro)frame
* @xfer_buf: Pointer to current transfer buffer position
* @xfer_dma: DMA address of xfer_buf
+ * @align_buf: In Buffer DMA mode this will be used if xfer_buf is not
+ * DWORD aligned
* @xfer_len: Total number of bytes to transfer
* @xfer_count: Number of bytes transferred so far
* @start_pkt_count: Packet count at start of transfer
@@ -132,6 +134,7 @@ struct dwc2_host_chan {
u8 *xfer_buf;
dma_addr_t xfer_dma;
+ dma_addr_t align_buf;
u32 xfer_len;
u32 xfer_count;
u16 start_pkt_count;
@@ -302,6 +305,9 @@ struct dwc2_hs_transfer_time {
* is tightly packed.
* @ls_duration_us: Duration on the low speed bus schedule.
* @ntd: Actual number of transfer descriptors in a list
+ * @dw_align_buf: Used instead of original buffer if its physical address
+ * is not dword-aligned
+ * @dw_align_buf_dma: DMA address for dw_align_buf
* @qtd_list: List of QTDs for this QH
* @channel: Host channel currently processing transfers for this QH
* @qh_list_entry: Entry for QH in either the periodic or non-periodic
@@ -345,6 +351,8 @@ struct dwc2_qh {
struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES];
u32 ls_start_schedule_slice;
u16 ntd;
+ u8 *dw_align_buf;
+ dma_addr_t dw_align_buf_dma;
struct list_head qtd_list;
struct dwc2_host_chan *channel;
struct list_head qh_list_entry;
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -931,6 +931,14 @@ static int dwc2_xfercomp_isoc_split_in(s
frame_desc->actual_length += len;
+ if (chan->align_buf) {
+ dev_vdbg(hsotg->dev, "non-aligned buffer\n");
+ dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma,
+ DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE);
+ memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma),
+ chan->qh->dw_align_buf, len);
+ }
+
qtd->isoc_split_offset += len;
hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum));
--- a/drivers/usb/dwc2/hcd_queue.c
+++ b/drivers/usb/dwc2/hcd_queue.c
@@ -1632,6 +1632,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg
if (qh->desc_list)
dwc2_hcd_qh_free_ddma(hsotg, qh);
+ else if (hsotg->unaligned_cache && qh->dw_align_buf)
+ kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf);
+
kfree(qh);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 045/217] usb: dwc2: fix isoc split in transfer with no data
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 044/217] usb: dwc2: alloc dma aligned buffer for isoc split in Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 046/217] usb: gadget: composite: fix delayed_status race condition when set_interface Greg Kroah-Hartman
` (159 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gevorg Sahakyan, Heiko Stuebner,
William Wu, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ]
If isoc split in transfer with no data (the length of DATA0
packet is zero), we can't simply return immediately. Because
the DATA0 can be the first transaction or the second transaction
for the isoc split in transaction. If the DATA0 packet with no
data is in the first transaction, we can return immediately.
But if the DATA0 packet with no data is in the second transaction
of isoc split in transaction sequence, we need to increase the
qtd->isoc_frame_index and giveback urb to device driver if needed,
otherwise, the MDATA packet will be lost.
A typical test case is that connect the dwc2 controller with an
usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics
headset) into the downstream port of Hub. Then use the usb mic
to record, we can find noise when playback.
In the case, the isoc split in transaction sequence like this:
- SSPLIT IN transaction
- CSPLIT IN transaction
- MDATA packet (176 bytes)
- CSPLIT IN transaction
- DATA0 packet (0 byte)
This patch use both the length of DATA0 and qtd->isoc_split_offset
to check if the DATA0 is in the second transaction.
Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/hcd_intr.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -923,9 +923,8 @@ static int dwc2_xfercomp_isoc_split_in(s
frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
DWC2_HC_XFER_COMPLETE, NULL);
- if (!len) {
+ if (!len && !qtd->isoc_split_offset) {
qtd->complete_split = 0;
- qtd->isoc_split_offset = 0;
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 046/217] usb: gadget: composite: fix delayed_status race condition when set_interface
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 045/217] usb: dwc2: fix isoc split in transfer with no data Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 047/217] usb: gadget: dwc2: fix memory leak in gadget_init() Greg Kroah-Hartman
` (158 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chunfeng Yun, Jay Hsu, Felipe Balbi,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ]
It happens when enable debug log, if set_alt() returns
USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
is called before increasing count of @delayed_status,
so fix it by using spinlock of @cdev->lock.
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Tested-by: Jay Hsu <shih-chieh.hsu@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1720,6 +1720,8 @@ composite_setup(struct usb_gadget *gadge
*/
if (w_value && !f->get_alt)
break;
+
+ spin_lock(&cdev->lock);
value = f->set_alt(f, w_index, w_value);
if (value == USB_GADGET_DELAYED_STATUS) {
DBG(cdev,
@@ -1729,6 +1731,7 @@ composite_setup(struct usb_gadget *gadge
DBG(cdev, "delayed_status count %d\n",
cdev->delayed_status);
}
+ spin_unlock(&cdev->lock);
break;
case USB_REQ_GET_INTERFACE:
if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 047/217] usb: gadget: dwc2: fix memory leak in gadget_init()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 046/217] usb: gadget: composite: fix delayed_status race condition when set_interface Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 048/217] dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation Greg Kroah-Hartman
` (157 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Marek Szyprowski,
Minas Harutyunyan, Grigor Tovmasyan, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
[ Upstream commit 9bb073a053f0464ea74a4d4c331fdb7da58568d6 ]
Freed allocated request for ep0 to prevent memory leak in case when
dwc2_driver_probe() failed.
Cc: Stefan Wahren <stefan.wahren@i2se.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -4717,9 +4717,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *
}
ret = usb_add_gadget_udc(dev, &hsotg->gadget);
- if (ret)
+ if (ret) {
+ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+ hsotg->ctrl_req);
return ret;
-
+ }
dwc2_hsotg_dump(hsotg);
return 0;
@@ -4732,6 +4734,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *
int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
{
usb_del_gadget_udc(&hsotg->gadget);
+ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 048/217] dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 047/217] usb: gadget: dwc2: fix memory leak in gadget_init() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 049/217] xen: add error handling for xenbus_printf Greg Kroah-Hartman
` (156 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Minas Harutyunyan, Felipe Balbi, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
[ Upstream commit 1d8e5c00275825fc42aaa5597dab1d0b5b26bb64 ]
PID bitfield in descriptor should be set based on particular request
length, not based on EP's mc value. PID value can't be set to 0 even
request length is 0.
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -848,6 +848,7 @@ static int dwc2_gadget_fill_isoc_desc(st
u32 index;
u32 maxsize = 0;
u32 mask = 0;
+ u8 pid = 0;
maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask);
if (len > maxsize) {
@@ -893,7 +894,11 @@ static int dwc2_gadget_fill_isoc_desc(st
((len << DEV_DMA_NBYTES_SHIFT) & mask));
if (hs_ep->dir_in) {
- desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) &
+ if (len)
+ pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket);
+ else
+ pid = 1;
+ desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) &
DEV_DMA_ISOC_PID_MASK) |
((len % hs_ep->ep.maxpacket) ?
DEV_DMA_SHORT : 0) |
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 049/217] xen: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 048/217] dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 050/217] pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception Greg Kroah-Hartman
` (155 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Boris Ostrovsky,
Juergen Gross, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 84c029a73327cef571eaa61c7d6e67e8031b52ec ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/manage.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -292,8 +292,15 @@ static void sysrq_handler(struct xenbus_
return;
}
- if (sysrq_key != '\0')
- xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+ if (sysrq_key != '\0') {
+ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+ if (err) {
+ pr_err("%s: Error %d writing sysrq in control/sysrq\n",
+ __func__, err);
+ xenbus_transaction_end(xbt, 1);
+ return;
+ }
+ }
err = xenbus_transaction_end(xbt, 0);
if (err == -EAGAIN)
@@ -345,7 +352,12 @@ static int setup_shutdown_watcher(void)
continue;
snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
shutdown_handlers[idx].command);
- xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+ if (err) {
+ pr_err("%s: Error %d writing %s\n", __func__,
+ err, node);
+ return err;
+ }
}
return 0;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 050/217] pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 049/217] xen: add error handling for xenbus_printf Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 051/217] scsi: xen-scsifront: add error handling for xenbus_printf Greg Kroah-Hartman
` (154 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 2dbf8dffbf35fd8f611083b9d9fe74fdccf912a3 ]
Right now, we can call nfs_commit_inode() while holding the session slot,
which could lead to NFSv4 deadlocks. Ensure we only keep the slot if
the server returned a layout that we have to process.
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8429,6 +8429,8 @@ nfs4_layoutget_handle_exception(struct r
dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
+ nfs4_sequence_free_slot(&lgp->res.seq_res);
+
switch (nfs4err) {
case 0:
goto out;
@@ -8493,7 +8495,6 @@ nfs4_layoutget_handle_exception(struct r
goto out;
}
- nfs4_sequence_free_slot(&lgp->res.seq_res);
err = nfs4_handle_exception(server, nfs4err, exception);
if (!status) {
if (exception->retry)
@@ -8619,20 +8620,22 @@ nfs4_proc_layoutget(struct nfs4_layoutge
if (IS_ERR(task))
return ERR_CAST(task);
status = rpc_wait_for_completion_task(task);
- if (status == 0) {
+ if (status != 0)
+ goto out;
+
+ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+ if (task->tk_status < 0 || lgp->res.layoutp->len == 0) {
status = nfs4_layoutget_handle_exception(task, lgp, &exception);
*timeout = exception.timeout;
- }
-
+ } else
+ lseg = pnfs_layout_process(lgp);
+out:
trace_nfs4_layoutget(lgp->args.ctx,
&lgp->args.range,
&lgp->res.range,
&lgp->res.stateid,
status);
- /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
- if (status == 0 && lgp->res.layoutp->len)
- lseg = pnfs_layout_process(lgp);
rpc_put_task(task);
dprintk("<-- %s status=%d\n", __func__, status);
if (status)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 051/217] scsi: xen-scsifront: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 050/217] pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 052/217] xen/scsiback: " Greg Kroah-Hartman
` (153 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Juergen Gross, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 93efbd39870474cc536b9caf4a6efeb03b0bc56f ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/xen-scsifront.c | 33 ++++++++++++++++++++++++++-------
1 file changed, 26 insertions(+), 7 deletions(-)
--- a/drivers/scsi/xen-scsifront.c
+++ b/drivers/scsi/xen-scsifront.c
@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(s
static int scsifront_sdev_configure(struct scsi_device *sdev)
{
struct vscsifrnt_info *info = shost_priv(sdev->host);
+ int err;
- if (info && current == info->curr)
- xenbus_printf(XBT_NIL, info->dev->nodename,
+ if (info && current == info->curr) {
+ err = xenbus_printf(XBT_NIL, info->dev->nodename,
info->dev_state_path, "%d", XenbusStateConnected);
+ if (err) {
+ xenbus_dev_error(info->dev, err,
+ "%s: writing dev_state_path", __func__);
+ return err;
+ }
+ }
return 0;
}
@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(stru
static void scsifront_sdev_destroy(struct scsi_device *sdev)
{
struct vscsifrnt_info *info = shost_priv(sdev->host);
+ int err;
- if (info && current == info->curr)
- xenbus_printf(XBT_NIL, info->dev->nodename,
+ if (info && current == info->curr) {
+ err = xenbus_printf(XBT_NIL, info->dev->nodename,
info->dev_state_path, "%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing dev_state_path", __func__);
+ }
}
static struct scsi_host_template scsifront_sht = {
@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(str
if (scsi_add_device(info->host, chn, tgt, lun)) {
dev_err(&dev->dev, "scsi_add_device\n");
- xenbus_printf(XBT_NIL, dev->nodename,
+ err = xenbus_printf(XBT_NIL, dev->nodename,
info->dev_state_path,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(dev, err,
+ "%s: writing dev_state_path", __func__);
}
break;
case VSCSIFRONT_OP_DEL_LUN:
@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(str
}
break;
case VSCSIFRONT_OP_READD_LUN:
- if (device_state == XenbusStateConnected)
- xenbus_printf(XBT_NIL, dev->nodename,
+ if (device_state == XenbusStateConnected) {
+ err = xenbus_printf(XBT_NIL, dev->nodename,
info->dev_state_path,
"%d", XenbusStateConnected);
+ if (err)
+ xenbus_dev_error(dev, err,
+ "%s: writing dev_state_path", __func__);
+ }
break;
default:
break;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 052/217] xen/scsiback: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 051/217] scsi: xen-scsifront: add error handling for xenbus_printf Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 053/217] arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag Greg Kroah-Hartman
` (152 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Juergen Gross, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 7c63ca24c878e0051c91904b72174029320ef4bd ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-scsiback.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct v
{
struct v2p_entry *entry;
unsigned long flags;
+ int err;
if (try) {
spin_lock_irqsave(&info->v2p_lock, flags);
@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct v
scsiback_del_translation_entry(info, vir);
}
} else if (!try) {
- xenbus_printf(XBT_NIL, info->dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
}
}
@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(str
snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
if (IS_ERR(val)) {
- xenbus_printf(XBT_NIL, dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
return;
}
strlcpy(phy, val, VSCSI_NAMELEN);
@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(str
err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
&vir.hst, &vir.chn, &vir.tgt, &vir.lun);
if (XENBUS_EXIST_ERR(err)) {
- xenbus_printf(XBT_NIL, dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
return;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 053/217] arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 052/217] xen/scsiback: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 054/217] arm64: make secondary_start_kernel() notrace Greg Kroah-Hartman
` (151 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Catalin Marinas,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit dd65a941f6ba473a5cb9d013d57fa43b48450a04 ]
dma_alloc_*() buffers might be exposed to userspace via mmap() call, so
they should be cleared on allocation. In case of IOMMU-based dma-mapping
implementation such buffer clearing was missing in the code path for
DMA_ATTR_FORCE_CONTIGUOUS flag handling, because dma_alloc_from_contiguous()
doesn't honor __GFP_ZERO flag. This patch fixes this issue. For more
information on clearing buffers allocated by dma_alloc_* functions,
see commit 6829e274a623 ("arm64: dma-mapping: always clear allocated
buffers").
Fixes: 44176bb38fa4 ("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/dma-mapping.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -629,13 +629,14 @@ static void *__iommu_alloc_attrs(struct
size >> PAGE_SHIFT);
return NULL;
}
- if (!coherent)
- __dma_flush_area(page_to_virt(page), iosize);
-
addr = dma_common_contiguous_remap(page, size, VM_USERMAP,
prot,
__builtin_return_address(0));
- if (!addr) {
+ if (addr) {
+ memset(addr, 0, size);
+ if (!coherent)
+ __dma_flush_area(page_to_virt(page), iosize);
+ } else {
iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
dma_release_from_contiguous(dev, page,
size >> PAGE_SHIFT);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 054/217] arm64: make secondary_start_kernel() notrace
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 053/217] arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 055/217] qed: Fix possible memory leak in Rx error path handling Greg Kroah-Hartman
` (150 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Suzuki K Poulose,
Zhizhou Zhang, Catalin Marinas, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ]
We can't call function trace hook before setup percpu offset.
When entering secondary_start_kernel(), percpu offset has not
been initialized. So this lead hotplug malfunction.
Here is the flow to reproduce this bug:
echo 0 > /sys/devices/system/cpu/cpu1/online
echo function > /sys/kernel/debug/tracing/current_tracer
echo 1 > /sys/kernel/debug/tracing/tracing_on
echo 1 > /sys/devices/system/cpu/cpu1/online
Acked-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -214,7 +214,7 @@ int __cpu_up(unsigned int cpu, struct ta
* This is the secondary CPU boot entry. We're using this CPUs
* idle thread stack, but a set of temporary page tables.
*/
-asmlinkage void secondary_start_kernel(void)
+asmlinkage notrace void secondary_start_kernel(void)
{
struct mm_struct *mm = &init_mm;
unsigned int cpu;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 055/217] qed: Fix possible memory leak in Rx error path handling.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 054/217] arm64: make secondary_start_kernel() notrace Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 056/217] qed: Add sanity check for SIMD fastpath handler Greg Kroah-Hartman
` (149 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
Michal Kalderon, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit 4f9de4df901fb84709fe3a864dfa4eaf35700f68 ]
Memory for packet buffers need to be freed in the error paths as there is
no consumer (e.g., upper layer) for such packets and that memory will never
get freed.
The issue was uncovered when port was attacked with flood of isatap
packets, these are multicast packets hence were directed at all the PFs.
For foce PF, this meant they were routed to the ll2 module which in turn
drops such packets.
Fixes: 0a7fb11c ("qed: Add Light L2 support")
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *c
skb = build_skb(buffer->data, 0);
if (!skb) {
- rc = -ENOMEM;
- goto out_post;
+ DP_INFO(cdev, "Failed to build SKB\n");
+ kfree(buffer->data);
+ goto out_post1;
}
data->u.placement_offset += NET_SKB_PAD;
@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *c
cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
data->opaque_data_0,
data->opaque_data_1);
+ } else {
+ DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
+ QED_MSG_LL2 | QED_MSG_STORAGE),
+ "Dropping the packet\n");
+ kfree(buffer->data);
}
+out_post1:
/* Update Buffer information and update FW producer */
buffer->data = new_data;
buffer->phys_addr = new_phys_addr;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 056/217] qed: Add sanity check for SIMD fastpath handler.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 055/217] qed: Fix possible memory leak in Rx error path handling Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 057/217] qed: Do not advertise DCBX_LLD_MANAGED capability Greg Kroah-Hartman
` (148 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
Michal Kalderon, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit 3935a70968820c3994db4de7e6e1c7e814bff875 ]
Avoid calling a SIMD fastpath handler if it is NULL. The check is needed
to handle an unlikely scenario where unsolicited interrupt is destined to
a PF in INTa mode.
Fixes: fe56b9e6a ("qed: Add module with basic common support")
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qed/qed_main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -565,8 +565,16 @@ static irqreturn_t qed_single_int(int ir
/* Fastpath interrupts */
for (j = 0; j < 64; j++) {
if ((0x2ULL << j) & status) {
- hwfn->simd_proto_handler[j].func(
- hwfn->simd_proto_handler[j].token);
+ struct qed_simd_fp_handler *p_handler =
+ &hwfn->simd_proto_handler[j];
+
+ if (p_handler->func)
+ p_handler->func(p_handler->token);
+ else
+ DP_NOTICE(hwfn,
+ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
+ j, status);
+
status &= ~(0x2ULL << j);
rc = IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 057/217] qed: Do not advertise DCBX_LLD_MANAGED capability.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 056/217] qed: Add sanity check for SIMD fastpath handler Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 058/217] enic: initialize enic->rfs_h.lock in enic_probe Greg Kroah-Hartman
` (147 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
Michal Kalderon, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit ff54d5cd9ec15546abc870452dd0b66eef4b4606 ]
Do not advertise DCBX_LLD_MANAGED capability i.e., do not allow
external agent to manage the dcbx/lldp negotiation. MFW acts as lldp agent
for qed* devices, and no other lldp agent is allowed to coexist with mfw.
Also updated a debug print, to not to display the redundant info.
Fixes: a1d8d8a51 ("qed: Add dcbnl support.")
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qe
*type = DCBX_PROTOCOL_ROCE_V2;
} else {
*type = DCBX_MAX_PROTOCOL_TYPE;
- DP_ERR(p_hwfn,
- "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n",
- id, app_prio_bitmap);
+ DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n",
+ app_prio_bitmap);
return false;
}
@@ -1472,8 +1471,8 @@ static u8 qed_dcbnl_getcap(struct qed_de
*cap = 0x80;
break;
case DCB_CAP_ATTR_DCBX:
- *cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE |
- DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC);
+ *cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE |
+ DCB_CAP_DCBX_STATIC);
break;
default:
*cap = false;
@@ -1541,8 +1540,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_d
if (!dcbx_info)
return 0;
- if (dcbx_info->operational.enabled)
- mode |= DCB_CAP_DCBX_LLD_MANAGED;
if (dcbx_info->operational.ieee)
mode |= DCB_CAP_DCBX_VER_IEEE;
if (dcbx_info->operational.cee)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 058/217] enic: initialize enic->rfs_h.lock in enic_probe
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 057/217] qed: Do not advertise DCBX_LLD_MANAGED capability Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 059/217] net: hamradio: use eth_broadcast_addr Greg Kroah-Hartman
` (146 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Govindarajulu Varadarajan,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Govindarajulu Varadarajan <gvaradar@cisco.com>
[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ]
lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without
initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops
can be called when interface is down.
Move enic_rfs_flw_tbl_init to enic_probe.
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
Call Trace:
dump_stack+0x85/0xc0
register_lock_class+0x550/0x560
? __handle_mm_fault+0xa8b/0x1100
__lock_acquire+0x81/0x670
lock_acquire+0xb9/0x1e0
? enic_get_rxnfc+0x139/0x2b0 [enic]
_raw_spin_lock_bh+0x38/0x80
? enic_get_rxnfc+0x139/0x2b0 [enic]
enic_get_rxnfc+0x139/0x2b0 [enic]
ethtool_get_rxnfc+0x8d/0x1c0
dev_ethtool+0x16c8/0x2400
? __mutex_lock+0x64d/0xa00
? dev_load+0x6a/0x150
dev_ioctl+0x253/0x4b0
sock_do_ioctl+0x9a/0x130
sock_ioctl+0x1af/0x350
do_vfs_ioctl+0x8e/0x670
? syscall_trace_enter+0x1e2/0x380
ksys_ioctl+0x60/0x90
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x5a/0x170
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +--
drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic *
enic->rfs_h.max = enic->config.num_arfs;
enic->rfs_h.free = enic->rfs_h.max;
enic->rfs_h.toclean = 0;
- enic_rfs_timer_start(enic);
}
void enic_rfs_flw_tbl_free(struct enic *enic)
@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic *
enic_rfs_timer_stop(enic);
spin_lock_bh(&enic->rfs_h.lock);
- enic->rfs_h.free = 0;
for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
struct hlist_head *hhead;
struct hlist_node *tmp;
@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic *
enic_delfltr(enic, n->fltr_id);
hlist_del(&n->node);
kfree(n);
+ enic->rfs_h.free++;
}
}
spin_unlock_bh(&enic->rfs_h.lock);
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1930,7 +1930,7 @@ static int enic_open(struct net_device *
vnic_intr_unmask(&enic->intr[i]);
enic_notify_timer_start(enic);
- enic_rfs_flw_tbl_init(enic);
+ enic_rfs_timer_start(enic);
return 0;
@@ -2854,6 +2854,7 @@ static int enic_probe(struct pci_dev *pd
enic->notify_timer.function = enic_notify_timer;
enic->notify_timer.data = (unsigned long)enic;
+ enic_rfs_flw_tbl_init(enic);
enic_set_rx_coal_setting(enic);
INIT_WORK(&enic->reset, enic_reset);
INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 059/217] net: hamradio: use eth_broadcast_addr
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 058/217] enic: initialize enic->rfs_h.lock in enic_probe Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 060/217] net: propagate dev_get_valid_name return code Greg Kroah-Hartman
` (145 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ]
The array bpq_eth_addr is only used to get the size of an
address, whereas the bcast_addr is used to set the broadcast
address. This leads to a warning when using clang:
drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not
needed and will not be emitted [-Wunneeded-internal-declaration]
static char bpq_eth_addr[6];
^
Remove both variables and use the common eth_broadcast_addr
to set the broadcast address.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/hamradio/bpqether.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -89,10 +89,6 @@
static const char banner[] __initconst = KERN_INFO \
"AX.25: bpqether driver version 004\n";
-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
-
-static char bpq_eth_addr[6];
-
static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
static int bpq_device_event(struct notifier_block *, unsigned long, void *);
@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_dev
bpq->ethdev = edev;
bpq->axdev = ndev;
- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
+ eth_broadcast_addr(bpq->dest_addr);
+ eth_broadcast_addr(bpq->acpt_addr);
err = register_netdevice(ndev);
if (err)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 060/217] net: propagate dev_get_valid_name return code
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 059/217] net: hamradio: use eth_broadcast_addr Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 061/217] net: stmmac: socfpga: add additional ocp reset line for Stratix10 Greg Kroah-Hartman
` (144 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Li RongQing, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ]
if dev_get_valid_name failed, propagate its return code
and remove the setting err to ENODEV, it will be set to
0 again before dev_change_net_namespace exits.
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8297,7 +8297,8 @@ int dev_change_net_namespace(struct net_
/* We get here if we can't use the current device name */
if (!pat)
goto out;
- if (dev_get_valid_name(net, dev, pat) < 0)
+ err = dev_get_valid_name(net, dev, pat);
+ if (err < 0)
goto out;
}
@@ -8309,7 +8310,6 @@ int dev_change_net_namespace(struct net_
dev_close(dev);
/* And unlink it from device chain */
- err = -ENODEV;
unlist_netdevice(dev);
synchronize_net();
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 061/217] net: stmmac: socfpga: add additional ocp reset line for Stratix10
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 060/217] net: propagate dev_get_valid_name return code Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 062/217] nvmet: reset keep alive timer in controller enable Greg Kroah-Hartman
` (143 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinh Nguyen, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinh Nguyen <dinguyen@kernel.org>
[ Upstream commit bc8a2d9bcbf1ca548b1deb315d14e1da81945bea ]
The Stratix10 platform has an additional reset line, OCP(Open Core Protocol),
that also needs to get deasserted for the stmmac ethernet controller to work.
Thus we need to update the Kconfig to include ARCH_STRATIX10 in order to build
dwmac-socfpga.
Also, remove the redundant check for the reset controller pointer. The
reset driver already checks for the pointer and returns 0 if the pointer
is NULL.
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 18 ++++++++++++++----
2 files changed, 15 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP
config DWMAC_SOCFPGA
tristate "SOCFPGA dwmac support"
default ARCH_SOCFPGA
- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
+ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
select MFD_SYSCON
help
Support for ethernet controller on Altera SOCFPGA
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -55,6 +55,7 @@ struct socfpga_dwmac {
struct device *dev;
struct regmap *sys_mgr_base_addr;
struct reset_control *stmmac_rst;
+ struct reset_control *stmmac_ocp_rst;
void __iomem *splitter_base;
bool f2h_ptp_ref_clk;
struct tse_pcs pcs;
@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(st
val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
/* Assert reset to the enet controller before changing the phy mode */
- if (dwmac->stmmac_rst)
- reset_control_assert(dwmac->stmmac_rst);
+ reset_control_assert(dwmac->stmmac_ocp_rst);
+ reset_control_assert(dwmac->stmmac_rst);
regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(st
/* Deassert reset for the phy configuration to be sampled by
* the enet controller, and operation to start in requested mode
*/
- if (dwmac->stmmac_rst)
- reset_control_deassert(dwmac->stmmac_rst);
+ reset_control_deassert(dwmac->stmmac_ocp_rst);
+ reset_control_deassert(dwmac->stmmac_rst);
if (phymode == PHY_INTERFACE_MODE_SGMII) {
if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
dev_err(dwmac->dev, "Unable to initialize TSE PCS");
@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct pl
goto err_remove_config_dt;
}
+ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
+ if (IS_ERR(dwmac->stmmac_ocp_rst)) {
+ ret = PTR_ERR(dwmac->stmmac_ocp_rst);
+ dev_err(dev, "error getting reset control of ocp %d\n", ret);
+ goto err_remove_config_dt;
+ }
+
+ reset_control_deassert(dwmac->stmmac_ocp_rst);
+
ret = socfpga_dwmac_parse_data(dwmac, dev);
if (ret) {
dev_err(dev, "Unable to parse OF data\n");
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 062/217] nvmet: reset keep alive timer in controller enable
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 061/217] net: stmmac: socfpga: add additional ocp reset line for Stratix10 Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 063/217] block: sed-opal: Fix a couple off by one bugs Greg Kroah-Hartman
` (142 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Gurtovoy, Sagi Grimberg,
Christoph Hellwig, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Gurtuvoy <maxg@mellanox.com>
[ Upstream commit d68a90e148f5a82aa67654c5012071e31c0e4baa ]
Controllers that are not yet enabled should not really enforce keep alive
timeouts, but we still want to track a timeout and cleanup in case a host
died before it enabled the controller. Hence, simply reset the keep
alive timer when the controller is enabled.
Suggested-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/core.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -598,6 +598,14 @@ static void nvmet_start_ctrl(struct nvme
}
ctrl->csts = NVME_CSTS_RDY;
+
+ /*
+ * Controllers that are not yet enabled should not really enforce the
+ * keep alive timeout, but we still want to track a timeout and cleanup
+ * in case a host died before it enabled the controller. Hence, simply
+ * reset the keep alive timer when the controller is enabled.
+ */
+ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
}
static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 063/217] block: sed-opal: Fix a couple off by one bugs
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 062/217] nvmet: reset keep alive timer in controller enable Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 064/217] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP Greg Kroah-Hartman
` (141 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Scott Bauer, Dan Carpenter,
Jens Axboe, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit ce042c183bcb94eb2919e8036473a1fc203420f9 ]
resp->num is the number of tokens in resp->tok[]. It gets set in
response_parse(). So if n == resp->num then we're reading beyond the
end of the data.
Fixes: 455a7b238cd6 ("block: Add Sed-opal library")
Reviewed-by: Scott Bauer <scott.bauer@intel.com>
Tested-by: Scott Bauer <scott.bauer@intel.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/sed-opal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -877,7 +877,7 @@ static size_t response_get_string(const
return 0;
}
- if (n > resp->num) {
+ if (n >= resp->num) {
pr_debug("Response has %d tokens. Can't access %d\n",
resp->num, n);
return 0;
@@ -899,7 +899,7 @@ static u64 response_get_u64(const struct
return 0;
}
- if (n > resp->num) {
+ if (n >= resp->num) {
pr_debug("Response has %d tokens. Can't access %d\n",
resp->num, n);
return 0;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 064/217] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 063/217] block: sed-opal: Fix a couple off by one bugs Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 065/217] nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag Greg Kroah-Hartman
` (140 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
[ Upstream commit 2f24ef7413a4d91657ef04e77c27ce0b313e6c95 ]
machine_desc->init_per_cpu() hook is supposed to be per cpu
initialization and would seem to apply equally to UP and/or SMP.
Infact the comment in header file seems to suggest it works for
UP too, which was not the case and this patch.
This enables !CONFIG_SMP build for platforms such as hsdk.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
[vgupta: trimmeed changelog]
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/include/asm/mach_desc.h | 2 --
arch/arc/kernel/irq.c | 2 +-
2 files changed, 1 insertion(+), 3 deletions(-)
--- a/arch/arc/include/asm/mach_desc.h
+++ b/arch/arc/include/asm/mach_desc.h
@@ -34,9 +34,7 @@ struct machine_desc {
const char *name;
const char **dt_compat;
void (*init_early)(void);
-#ifdef CONFIG_SMP
void (*init_per_cpu)(unsigned int);
-#endif
void (*init_machine)(void);
void (*init_late)(void);
--- a/arch/arc/kernel/irq.c
+++ b/arch/arc/kernel/irq.c
@@ -31,10 +31,10 @@ void __init init_IRQ(void)
/* a SMP H/w block could do IPI IRQ request here */
if (plat_smp_ops.init_per_cpu)
plat_smp_ops.init_per_cpu(smp_processor_id());
+#endif
if (machine_desc->init_per_cpu)
machine_desc->init_per_cpu(smp_processor_id());
-#endif
}
/*
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 065/217] nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 064/217] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.14 066/217] net: davinci_emac: match the mdio device against its compatible if possible Greg Kroah-Hartman
` (139 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Doron Roberts-Kedes,
Jens Axboe, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doron Roberts-Kedes <doronrk@fb.com>
[ Upstream commit 08ba91ee6e2c1c08d3f0648f978cbb5dbf3491d8 ]
If NBD_DISCONNECT_ON_CLOSE is set on a device, then the driver will
issue a disconnect from nbd_release if the device has no remaining
bdev->bd_openers.
Fix ret val so reconfigure with only setting the flag succeeds.
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Doron Roberts-Kedes <doronrk@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nbd.c | 40 +++++++++++++++++++++++++++++++++-------
include/uapi/linux/nbd.h | 3 +++
2 files changed, 36 insertions(+), 7 deletions(-)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -76,6 +76,7 @@ struct link_dead_args {
#define NBD_HAS_CONFIG_REF 4
#define NBD_BOUND 5
#define NBD_DESTROY_ON_DISCONNECT 6
+#define NBD_DISCONNECT_ON_CLOSE 7
struct nbd_config {
u32 flags;
@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_de
static void nbd_connect_reply(struct genl_info *info, int index);
static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
static void nbd_dead_link_work(struct work_struct *work);
+static void nbd_disconnect_and_put(struct nbd_device *nbd);
static inline struct device *nbd_to_dev(struct nbd_device *nbd)
{
@@ -1291,6 +1293,12 @@ out:
static void nbd_release(struct gendisk *disk, fmode_t mode)
{
struct nbd_device *nbd = disk->private_data;
+ struct block_device *bdev = bdget_disk(disk, 0);
+
+ if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
+ bdev->bd_openers == 0)
+ nbd_disconnect_and_put(nbd);
+
nbd_config_put(nbd);
nbd_put(nbd);
}
@@ -1690,6 +1698,10 @@ again:
&config->runtime_flags);
put_dev = true;
}
+ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+ set_bit(NBD_DISCONNECT_ON_CLOSE,
+ &config->runtime_flags);
+ }
}
if (info->attrs[NBD_ATTR_SOCKETS]) {
@@ -1734,6 +1746,16 @@ out:
return ret;
}
+static void nbd_disconnect_and_put(struct nbd_device *nbd)
+{
+ mutex_lock(&nbd->config_lock);
+ nbd_disconnect(nbd);
+ mutex_unlock(&nbd->config_lock);
+ if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+ &nbd->config->runtime_flags))
+ nbd_config_put(nbd);
+}
+
static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
{
struct nbd_device *nbd;
@@ -1766,12 +1788,7 @@ static int nbd_genl_disconnect(struct sk
nbd_put(nbd);
return 0;
}
- mutex_lock(&nbd->config_lock);
- nbd_disconnect(nbd);
- mutex_unlock(&nbd->config_lock);
- if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
- &nbd->config->runtime_flags))
- nbd_config_put(nbd);
+ nbd_disconnect_and_put(nbd);
nbd_config_put(nbd);
nbd_put(nbd);
return 0;
@@ -1782,7 +1799,7 @@ static int nbd_genl_reconfigure(struct s
struct nbd_device *nbd = NULL;
struct nbd_config *config;
int index;
- int ret = -EINVAL;
+ int ret = 0;
bool put_dev = false;
if (!netlink_capable(skb, CAP_SYS_ADMIN))
@@ -1822,6 +1839,7 @@ static int nbd_genl_reconfigure(struct s
!nbd->task_recv) {
dev_err(nbd_to_dev(nbd),
"not configured, cannot reconfigure\n");
+ ret = -EINVAL;
goto out;
}
@@ -1846,6 +1864,14 @@ static int nbd_genl_reconfigure(struct s
&config->runtime_flags))
refcount_inc(&nbd->refs);
}
+
+ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+ set_bit(NBD_DISCONNECT_ON_CLOSE,
+ &config->runtime_flags);
+ } else {
+ clear_bit(NBD_DISCONNECT_ON_CLOSE,
+ &config->runtime_flags);
+ }
}
if (info->attrs[NBD_ATTR_SOCKETS]) {
--- a/include/uapi/linux/nbd.h
+++ b/include/uapi/linux/nbd.h
@@ -53,6 +53,9 @@ enum {
/* These are client behavior specific flags. */
#define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on
disconnect. */
+#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on
+ * close by last opener.
+ */
/* userspace doesn't need the nbd_device structure */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 066/217] net: davinci_emac: match the mdio device against its compatible if possible
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 065/217] nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 067/217] sctp: fix erroneous inc of snmp SctpFragUsrMsgs Greg Kroah-Hartman
` (138 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bartosz Golaszewski, David S. Miller,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ]
Device tree based systems without of_dev_auxdata will have the mdio
device named differently than "davinci_mdio(.0)". In this case use the
device's parent's compatible string for matching
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ti/davinci_emac.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_devi
static int match_first_device(struct device *dev, void *data)
{
+ if (dev->parent && dev->parent->of_node)
+ return of_device_is_compatible(dev->parent->of_node,
+ "ti,davinci_mdio");
+
return !strncmp(dev_name(dev), "davinci_mdio", 12);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 067/217] sctp: fix erroneous inc of snmp SctpFragUsrMsgs
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.14 066/217] net: davinci_emac: match the mdio device against its compatible if possible Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 068/217] KVM: arm/arm64: Drop resource size check for GICV window Greg Kroah-Hartman
` (137 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcelo Ricardo Leitner, Neil Horman,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
[ Upstream commit fedb1bd3d274b33c432cb83c80c6b3cf54d509c8 ]
Currently it is incrementing SctpFragUsrMsgs when the user message size
is of the exactly same size as the maximum fragment size, which is wrong.
The fix is to increment it only when user message is bigger than the
maximum fragment size.
Fixes: bfd2e4b8734d ("sctp: refactor sctp_datamsg_from_user")
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/chunk.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -230,7 +230,9 @@ struct sctp_datamsg *sctp_datamsg_from_u
/* Account for a different sized first fragment */
if (msg_len >= first_len) {
msg->can_delay = 0;
- SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
+ if (msg_len > first_len)
+ SCTP_INC_STATS(sock_net(asoc->base.sk),
+ SCTP_MIB_FRAGUSRMSGS);
} else {
/* Which may be the only one... */
first_len = msg_len;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 068/217] KVM: arm/arm64: Drop resource size check for GICV window
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 067/217] sctp: fix erroneous inc of snmp SctpFragUsrMsgs Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 069/217] drm/bridge/sii8620: fix display of packed pixel modes in MHL2 Greg Kroah-Hartman
` (136 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Marc Zyngier, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[ Upstream commit ba56bc3a0786992755e6804fbcbdc60ef6cfc24c ]
When booting a 64 KB pages kernel on a ACPI GICv3 system that
implements support for v2 emulation, the following warning is
produced
GICV size 0x2000 not a multiple of page size 0x10000
and support for v2 emulation is disabled, preventing GICv2 VMs
from being able to run on such hosts.
The reason is that vgic_v3_probe() performs a sanity check on the
size of the window (it should be a multiple of the page size),
while the ACPI MADT parsing code hardcodes the size of the window
to 8 KB. This makes sense, considering that ACPI does not bother
to describe the size in the first place, under the assumption that
platforms implementing ACPI will follow the architecture and not
put anything else in the same 64 KB window.
So let's just drop the sanity check altogether, and assume that
the window is at least 64 KB in size.
Fixes: 909777324588 ("KVM: arm/arm64: vgic-new: vgic_init: implement kvm_vgic_hyp_init")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/arm/vgic/vgic-v3.c | 5 -----
1 file changed, 5 deletions(-)
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -492,11 +492,6 @@ int vgic_v3_probe(const struct gic_kvm_i
pr_warn("GICV physical address 0x%llx not page aligned\n",
(unsigned long long)info->vcpu.start);
kvm_vgic_global_state.vcpu_base = 0;
- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
- (unsigned long long)resource_size(&info->vcpu),
- PAGE_SIZE);
- kvm_vgic_global_state.vcpu_base = 0;
} else {
kvm_vgic_global_state.vcpu_base = info->vcpu.start;
kvm_vgic_global_state.can_emulate_gicv2 = true;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 069/217] drm/bridge/sii8620: fix display of packed pixel modes in MHL2
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 068/217] KVM: arm/arm64: Drop resource size check for GICV window Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 070/217] locking/lockdep: Do not record IRQ state within lockdep code Greg Kroah-Hartman
` (135 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej Purski, Andrzej Hajda, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Purski <m.purski@samsung.com>
[ Upstream commit e8b92efa629dac0e70ea4145c5e70616de5f89c8 ]
Currently packed pixel modes in MHL2 can't be displayed. The device
automatically recognizes output format, so setting format other than
RGB causes failure. Fix it by writing proper values to registers.
Tested on MHL1 and MHL2 using various vendors' dongles both in
DVI and HDMI mode.
Signed-off-by: Maciej Purski <m.purski@samsung.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1516706239-9104-1-git-send-email-m.purski@samsung.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/sil-sii8620.c | 17 +----------------
1 file changed, 1 insertion(+), 16 deletions(-)
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -1038,20 +1038,11 @@ static void sii8620_stop_video(struct si
static void sii8620_set_format(struct sii8620 *ctx)
{
- u8 out_fmt;
-
if (sii8620_is_mhl3(ctx)) {
sii8620_setbits(ctx, REG_M3_P0CTRL,
BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
ctx->use_packed_pixel ? ~0 : 0);
} else {
- if (ctx->use_packed_pixel)
- sii8620_write_seq_static(ctx,
- REG_VID_MODE, BIT_VID_MODE_M1080P,
- REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
- REG_MHLTX_CTL6, 0x60
- );
- else
sii8620_write_seq_static(ctx,
REG_VID_MODE, 0,
REG_MHL_TOP_CTL, 1,
@@ -1059,15 +1050,9 @@ static void sii8620_set_format(struct si
);
}
- if (ctx->use_packed_pixel)
- out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) |
- BIT_TPI_OUTPUT_CSCMODE709;
- else
- out_fmt = VAL_TPI_FORMAT(RGB, FULL);
-
sii8620_write_seq(ctx,
REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
- REG_TPI_OUTPUT, out_fmt,
+ REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 070/217] locking/lockdep: Do not record IRQ state within lockdep code
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 069/217] drm/bridge/sii8620: fix display of packed pixel modes in MHL2 Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 071/217] selftests: bpf: notification about privilege required to run test_kmod.sh testing script Greg Kroah-Hartman
` (134 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware),
Andrew Morton, Linus Torvalds, Paul E. McKenney, Peter Zijlstra,
Thomas Gleixner, Will Deacon, Ingo Molnar, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ]
While debugging where things were going wrong with mapping
enabling/disabling interrupts with the lockdep state and actual real
enabling and disabling interrupts, I had to silent the IRQ
disabling/enabling in debug_check_no_locks_freed() because it was
always showing up as it was called before the splat was.
Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed()
but for all internal lockdep functions, as they hide useful information
about where interrupts were used incorrectly last.
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/lockdep.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -1296,11 +1296,11 @@ unsigned long lockdep_count_forward_deps
this.parent = NULL;
this.class = class;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
arch_spin_lock(&lockdep_lock);
ret = __lockdep_count_forward_deps(&this);
arch_spin_unlock(&lockdep_lock);
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
return ret;
}
@@ -1323,11 +1323,11 @@ unsigned long lockdep_count_backward_dep
this.parent = NULL;
this.class = class;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
arch_spin_lock(&lockdep_lock);
ret = __lockdep_count_backward_deps(&this);
arch_spin_unlock(&lockdep_lock);
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
return ret;
}
@@ -4478,7 +4478,7 @@ void debug_check_no_locks_freed(const vo
if (unlikely(!debug_locks))
return;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
for (i = 0; i < curr->lockdep_depth; i++) {
hlock = curr->held_locks + i;
@@ -4489,7 +4489,7 @@ void debug_check_no_locks_freed(const vo
print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
break;
}
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
}
EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 071/217] selftests: bpf: notification about privilege required to run test_kmod.sh testing script
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 070/217] locking/lockdep: Do not record IRQ state within lockdep code Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 073/217] x86/microcode/intel: Fix memleak in save_microcode_patch() Greg Kroah-Hartman
` (133 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeffrin Jose T (Rajagiri SET),
Daniel Borkmann, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrin Jose T <ahiliation@gmail.com>
[ Upstream commit 81e167c2a216e7b54e6add9d2badcda267fe33b1 ]
The test_kmod.sh script require root privilege for the successful
execution of the test.
This patch is to notify the user about the privilege the script
demands for the successful execution of the test.
Signed-off-by: Jeffrin Jose T (Rajagiri SET) <ahiliation@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/bpf/test_kmod.sh | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/tools/testing/selftests/bpf/test_kmod.sh
+++ b/tools/testing/selftests/bpf/test_kmod.sh
@@ -1,6 +1,15 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+msg="skip all tests:"
+if [ "$(id -u)" != "0" ]; then
+ echo $msg please run this as root >&2
+ exit $ksft_skip
+fi
+
SRC_TREE=../../../../
test_run()
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 073/217] x86/microcode/intel: Fix memleak in save_microcode_patch()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 071/217] selftests: bpf: notification about privilege required to run test_kmod.sh testing script Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 074/217] ipv6: mcast: fix unsolicited report interval after receiving querys Greg Kroah-Hartman
` (132 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhenzhong Duan, Borislav Petkov,
Thomas Gleixner, Srinivas REDDY Eeda, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
[ Upstream commit 0218c766263e70795c5eaa17d75ed54bca350950 ]
Free useless ucode_patch entry when it's replaced.
[ bp: Drop the memfree_patch() two-liner. ]
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Srinivas REDDY Eeda <srinivas.eeda@oracle.com>
Link: http://lkml.kernel.org/r/888102f0-fd22-459d-b090-a1bd8a00cb2b@default
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/intel.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -190,8 +190,11 @@ static void save_microcode_patch(void *d
p = memdup_patch(data, size);
if (!p)
pr_err("Error allocating buffer %p\n", data);
- else
+ else {
list_replace(&iter->plist, &p->plist);
+ kfree(iter->data);
+ kfree(iter);
+ }
}
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 074/217] ipv6: mcast: fix unsolicited report interval after receiving querys
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 073/217] x86/microcode/intel: Fix memleak in save_microcode_patch() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 075/217] Smack: Mark inode instant in smack_task_to_inode Greg Kroah-Hartman
` (131 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hangbin Liu, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ]
After recieving MLD querys, we update idev->mc_maxdelay with max_delay
from query header. This make the later unsolicited reports have the same
interval with mc_maxdelay, which means we may send unsolicited reports with
long interval time instead of default configured interval time.
Also as we will not call ipv6_mc_reset() after device up. This issue will
be there even after leave the group and join other groups.
Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2083,7 +2083,8 @@ void ipv6_mc_dad_complete(struct inet6_d
mld_send_initial_cr(idev);
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev, idev->mc_maxdelay);
+ mld_dad_start_timer(idev,
+ unsolicited_report_interval(idev));
}
}
@@ -2095,7 +2096,8 @@ static void mld_dad_timer_expire(unsigne
if (idev->mc_dad_count) {
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev, idev->mc_maxdelay);
+ mld_dad_start_timer(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
@@ -2453,7 +2455,8 @@ static void mld_ifc_timer_expire(unsigne
if (idev->mc_ifc_count) {
idev->mc_ifc_count--;
if (idev->mc_ifc_count)
- mld_ifc_start_timer(idev, idev->mc_maxdelay);
+ mld_ifc_start_timer(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 075/217] Smack: Mark inode instant in smack_task_to_inode
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 074/217] ipv6: mcast: fix unsolicited report interval after receiving querys Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 076/217] arm64: dts: msm8916: fix Coresight ETF graph connections Greg Kroah-Hartman
` (130 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Casey Schaufler, James Morris, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <casey@schaufler-ca.com>
[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ]
Smack: Mark inode instant in smack_task_to_inode
/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188
resulted in smack_task_to_inode() being called before smack_d_instantiate.
This resulted in the smk_inode value being ignored, even while present
for files in /proc/self. Marking the inode as instant here fixes that.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/smack/smack_lsm.c | 1 +
1 file changed, 1 insertion(+)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2281,6 +2281,7 @@ static void smack_task_to_inode(struct t
struct smack_known *skp = smk_of_task_struct(p);
isp->smk_inode = skp;
+ isp->smk_flags |= SMK_INODE_INSTANT;
}
/*
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 076/217] arm64: dts: msm8916: fix Coresight ETF graph connections
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 075/217] Smack: Mark inode instant in smack_task_to_inode Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 077/217] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump Greg Kroah-Hartman
` (129 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ivan T. Ivanov, Mathieu Poirier,
Andy Gross, David Brown, linux-arm-msm, Rob Herring, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <robh@kernel.org>
[ Upstream commit 6b4154a655a258c67bcfabbd4c3a06637e74ebcd ]
The ETF input should be connected to the funnel output, and the ETF
output should be connected to the replicator input. The labels are wrong
and these got swapped:
Warning (graph_endpoint): /soc/funnel@821000/ports/port@8/endpoint: graph connection to node '/soc/etf@825000/ports/port@1/endpoint' is not bidirectional
Warning (graph_endpoint): /soc/replicator@824000/ports/port@2/endpoint: graph connection to node '/soc/etf@825000/ports/port@0/endpoint' is not bidirectional
Fixes: 7c10da373698 ("arm64: dts: qcom: Add msm8916 CoreSight components")
Cc: Ivan T. Ivanov <ivan.ivanov@linaro.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Andy Gross <andy.gross@linaro.org>
Cc: David Brown <david.brown@linaro.org>
Cc: linux-arm-msm@vger.kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1132,14 +1132,14 @@
port@0 {
reg = <0>;
- etf_out: endpoint {
+ etf_in: endpoint {
slave-mode;
remote-endpoint = <&funnel0_out>;
};
};
port@1 {
reg = <0>;
- etf_in: endpoint {
+ etf_out: endpoint {
remote-endpoint = <&replicator_in>;
};
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 077/217] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 076/217] arm64: dts: msm8916: fix Coresight ETF graph connections Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 078/217] batman-adv: Fix bat_v " Greg Kroah-Hartman
` (128 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Ziegler, Sven Eckelmann,
Marek Lindner, Simon Wunderlich, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit b5685d2687d6612adf5eac519eb7008f74dfd1ec ]
A reference for the best gateway is taken when the list of gateways in the
mesh is sent via netlink. This is necessary to check whether the currently
dumped entry is the currently selected gateway or not. This information is
then transferred as flag BATADV_ATTR_FLAG_BEST.
After the comparison of the current entry is done,
batadv_iv_gw_dump_entry() has to decrease the reference counter again.
Otherwise the reference will be held and thus prevents a proper shutdown of
the batman-adv interfaces (and some of the interfaces enslaved in it).
Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations")
Reported-by: Andreas Ziegler <dev@andreas-ziegler.de>
Tested-by: Andreas Ziegler <dev@andreas-ziegler.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2718,7 +2718,7 @@ static int batadv_iv_gw_dump_entry(struc
{
struct batadv_neigh_ifinfo *router_ifinfo = NULL;
struct batadv_neigh_node *router;
- struct batadv_gw_node *curr_gw;
+ struct batadv_gw_node *curr_gw = NULL;
int ret = 0;
void *hdr;
@@ -2766,6 +2766,8 @@ static int batadv_iv_gw_dump_entry(struc
ret = 0;
out:
+ if (curr_gw)
+ batadv_gw_node_put(curr_gw);
if (router_ifinfo)
batadv_neigh_ifinfo_put(router_ifinfo);
if (router)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 078/217] batman-adv: Fix bat_v best gw refcnt after netlink dump
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 077/217] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 081/217] cxgb4: when disabling dcb set txq dcb priority to 0 Greg Kroah-Hartman
` (127 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Marek Lindner,
Simon Wunderlich, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit 9713cb0cf19f1cec6c007e3b37be0697042b6720 ]
A reference for the best gateway is taken when the list of gateways in the
mesh is sent via netlink. This is necessary to check whether the currently
dumped entry is the currently selected gateway or not. This information is
then transferred as flag BATADV_ATTR_FLAG_BEST.
After the comparison of the current entry is done,
batadv_v_gw_dump_entry() has to decrease the reference counter again.
Otherwise the reference will be held and thus prevents a proper shutdown of
the batman-adv interfaces (and some of the interfaces enslaved in it).
Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_v.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -929,7 +929,7 @@ static int batadv_v_gw_dump_entry(struct
{
struct batadv_neigh_ifinfo *router_ifinfo = NULL;
struct batadv_neigh_node *router;
- struct batadv_gw_node *curr_gw;
+ struct batadv_gw_node *curr_gw = NULL;
int ret = 0;
void *hdr;
@@ -997,6 +997,8 @@ static int batadv_v_gw_dump_entry(struct
ret = 0;
out:
+ if (curr_gw)
+ batadv_gw_node_put(curr_gw);
if (router_ifinfo)
batadv_neigh_ifinfo_put(router_ifinfo);
if (router)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 081/217] cxgb4: when disabling dcb set txq dcb priority to 0
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 078/217] batman-adv: Fix bat_v " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 082/217] iio: pressure: bmp280: fix relative humidity unit Greg Kroah-Hartman
` (126 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, AMG Zollner Robert, David Ahern,
Casey Leedom, Ganesh Goudar, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganesh Goudar <ganeshgr@chelsio.com>
[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ]
When we are disabling DCB, store "0" in txq->dcb_prio
since that's used for future TX Work Request "OVLAN_IDX"
values. Setting non zero priority upon disabling DCB
would halt the traffic.
Reported-by: AMG Zollner Robert <robert@cloudmedia.eu>
CC: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Casey Leedom <leedom@chelsio.com>
Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -253,7 +253,7 @@ static void dcb_tx_queue_prio_enable(str
"Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
enable ? "set" : "unset", pi->port_id, i, -err);
else
- txq->dcb_prio = value;
+ txq->dcb_prio = enable ? value : 0;
}
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 082/217] iio: pressure: bmp280: fix relative humidity unit
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 081/217] cxgb4: when disabling dcb set txq dcb priority to 0 Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 083/217] brcmfmac: stop watchdog before detach and free everything Greg Kroah-Hartman
` (125 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomasz Duszynski, Matt Ranostay,
Jonathan Cameron, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Duszynski <tduszyns@gmail.com>
[ Upstream commit 13399ff25f179811ce9c1df1523eb39f9e4a4772 ]
According to IIO ABI relative humidity reading should be
returned in milli percent.
This patch addresses that by applying proper scaling and
returning integer instead of fractional format type specifier.
Note that the fixes tag is before the driver was heavily refactored
to introduce spi support, so the patch won't apply that far back.
Signed-off-by: Tomasz Duszynski <tduszyns@gmail.com>
Fixes: 14beaa8f5ab1 ("iio: pressure: bmp280: add humidity support")
Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/bmp280-core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -362,10 +362,9 @@ static int bmp280_read_humid(struct bmp2
}
comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
- *val = comp_humidity;
- *val2 = 1024;
+ *val = comp_humidity * 1000 / 1024;
- return IIO_VAL_FRACTIONAL;
+ return IIO_VAL_INT;
}
static int bmp280_read_raw(struct iio_dev *indio_dev,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 083/217] brcmfmac: stop watchdog before detach and free everything
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 082/217] iio: pressure: bmp280: fix relative humidity unit Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 084/217] ARM: dts: am437x: make edt-ft5x06 a wakeup source Greg Kroah-Hartman
` (124 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Trimarchi, Arend van Spriel,
Andy Shevchenko, Kalle Valo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Trimarchi <michael@amarulasolutions.com>
[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ]
Using built-in in kernel image without a firmware in filesystem
or in the kernel image can lead to a kernel NULL pointer deference.
Watchdog need to be stopped in brcmf_sdio_remove
The system is going down NOW!
[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
Sent SIGTERM to all processes
[ 1348.121412] Mem abort info:
[ 1348.126962] ESR = 0x96000004
[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits
[ 1348.135948] SET = 0, FnV = 0
[ 1348.138997] EA = 0, S1PTW = 0
[ 1348.142154] Data abort info:
[ 1348.145045] ISV = 0, ISS = 0x00000004
[ 1348.148884] CM = 0, WnR = 0
[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[ 1348.158475] [00000000000002f8] pgd=0000000000000000
[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 1348.168927] Modules linked in: ipv6
[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
[ 1348.200253] sp : ffff00000b85be30
[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4245,6 +4245,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
brcmf_dbg(TRACE, "Enter\n");
if (bus) {
+ /* Stop watchdog task */
+ if (bus->watchdog_tsk) {
+ send_sig(SIGTERM, bus->watchdog_tsk, 1);
+ kthread_stop(bus->watchdog_tsk);
+ bus->watchdog_tsk = NULL;
+ }
+
/* De-register interrupt handler */
brcmf_sdiod_intr_unregister(bus->sdiodev);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 084/217] ARM: dts: am437x: make edt-ft5x06 a wakeup source
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 083/217] brcmfmac: stop watchdog before detach and free everything Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 085/217] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl Greg Kroah-Hartman
` (123 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Tony Lindgren, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <daniel@zonque.org>
[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ]
The touchscreen driver no longer configures the device as wakeup source by
default. A "wakeup-source" property is needed.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/boot/dts/am437x-sk-evm.dts
+++ b/arch/arm/boot/dts/am437x-sk-evm.dts
@@ -535,6 +535,8 @@
touchscreen-size-x = <480>;
touchscreen-size-y = <272>;
+
+ wakeup-source;
};
tlv320aic3106: tlv320aic3106@1b {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 085/217] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 084/217] ARM: dts: am437x: make edt-ft5x06 a wakeup source Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 086/217] usb: xhci: remove the code build warning Greg Kroah-Hartman
` (122 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit c9a4c63888dbb79ce4d068ca1dd8b05bc3f156b1 ]
The kernel may spew a WARNING with UBSAN undefined behavior at
handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT:
UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14
signed integer overflow:
2147483647 + 1 cannot be represented in type 'int'
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x122/0x1c8 lib/dump_stack.c:113
ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
handle_overflow+0x1c2/0x21f lib/ubsan.c:190
__ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007
snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144
....
It happens only when INT_MAX is passed there, as we're incrementing it
unconditionally. So the fix is trivial, check the value with
INT_MAX. Although the bug itself is fairly harmless, it's better to
fix it so that fuzzers won't hit this again later.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_clientmgr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -2001,7 +2001,8 @@ static int snd_seq_ioctl_query_next_clie
struct snd_seq_client *cptr = NULL;
/* search for next client */
- info->client++;
+ if (info->client < INT_MAX)
+ info->client++;
if (info->client < 0)
info->client = 0;
for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 086/217] usb: xhci: remove the code build warning
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 085/217] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 087/217] usb: xhci: increase CRS timeout value Greg Kroah-Hartman
` (121 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongjiu Geng, Thierry Reding,
Jon Hunter, Mathias Nyman, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongjiu Geng <gengdongjiu@huawei.com>
[ Upstream commit 36eb93509c45d0bdbd8d09a01ab9d857972f5963 ]
Initialize the 'err' variate to remove the build warning,
the warning is shown as below:
drivers/usb/host/xhci-tegra.c: In function 'tegra_xusb_mbox_thread':
drivers/usb/host/xhci-tegra.c:552:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/host/xhci-tegra.c:482:6: note: 'err' was declared here
Fixes: e84fce0f8837 ("usb: xhci: Add NVIDIA Tegra XUSB controller driver")
Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-tegra.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -482,7 +482,7 @@ static void tegra_xusb_mbox_handle(struc
unsigned long mask;
unsigned int port;
bool idle, enable;
- int err;
+ int err = 0;
memset(&rsp, 0, sizeof(rsp));
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 087/217] usb: xhci: increase CRS timeout value
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 086/217] usb: xhci: remove the code build warning Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 088/217] NFC: pn533: Fix wrong GFP flag usage Greg Kroah-Hartman
` (120 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ajay Gupta, Nagaraj Annaiah,
Mathias Nyman, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajay Gupta <ajaykuee@gmail.com>
[ Upstream commit 305886ca87be480ae159908c2affd135c04215cf ]
Some controllers take almost 55ms to complete controller
restore state (CRS).
There is no timeout limit mentioned in xhci specification so
fixing the issue by increasing the timeout limit to 100ms
[reformat code comment -Mathias]
Signed-off-by: Ajay Gupta <ajaykuee@gmail.com>
Signed-off-by: Nagaraj Annaiah <naga.annaiah@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1024,8 +1024,13 @@ int xhci_resume(struct xhci_hcd *xhci, b
command = readl(&xhci->op_regs->command);
command |= CMD_CRS;
writel(command, &xhci->op_regs->command);
+ /*
+ * Some controllers take up to 55+ ms to complete the controller
+ * restore so setting the timeout to 100ms. Xhci specification
+ * doesn't mention any timeout value.
+ */
if (xhci_handshake(&xhci->op_regs->status,
- STS_RESTORE, 0, 10 * 1000)) {
+ STS_RESTORE, 0, 100 * 1000)) {
xhci_warn(xhci, "WARN: xHC restore state timeout\n");
spin_unlock_irq(&xhci->lock);
return -ETIMEDOUT;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 088/217] NFC: pn533: Fix wrong GFP flag usage
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 087/217] usb: xhci: increase CRS timeout value Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 089/217] typec: tcpm: Fix a msecs vs jiffies bug Greg Kroah-Hartman
` (119 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Thalmeier, Hans de Goede,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit ecc443c03fb14abfb8a6af5e3b2d43b5257e60f2 ]
pn533_recv_response() is an urb completion handler, so it must use
GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping
context, so the pn533_submit_urb_for_response() there (and only there)
can use the regular GFP_KERNEL flags.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134
Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...")
Cc: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/pn533/usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -74,7 +74,7 @@ static void pn533_recv_response(struct u
struct sk_buff *skb = NULL;
if (!urb->status) {
- skb = alloc_skb(urb->actual_length, GFP_KERNEL);
+ skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
if (!skb) {
nfc_err(&phy->udev->dev, "failed to alloc memory\n");
} else {
@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct p
if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
/* request for response for sent packet directly */
- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
+ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
if (rc)
goto error;
} else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 089/217] typec: tcpm: Fix a msecs vs jiffies bug
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 088/217] NFC: pn533: Fix wrong GFP flag usage Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 090/217] kconfig: fix line numbers for if-entries in menu tree Greg Kroah-Hartman
` (118 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Heikki Krogerus,
Guenter Roeck, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 9578bcd0bb487b8ecef4b7eee799aafb678aa441 ]
The tcpm_set_state() function take msecs not jiffies.
Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/typec/tcpm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/typec/tcpm.c
+++ b/drivers/staging/typec/tcpm.c
@@ -2479,7 +2479,8 @@ static void run_state_machine(struct tcp
tcpm_port_is_sink(port) &&
time_is_after_jiffies(port->delayed_runtime)) {
tcpm_set_state(port, SNK_DISCOVERY,
- port->delayed_runtime - jiffies);
+ jiffies_to_msecs(port->delayed_runtime -
+ jiffies));
break;
}
tcpm_set_state(port, unattached_state(port), 0);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 090/217] kconfig: fix line numbers for if-entries in menu tree
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 089/217] typec: tcpm: Fix a msecs vs jiffies bug Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 091/217] perf record: Support s390 random socket_id assignment Greg Kroah-Hartman
` (117 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dirk Gouders, Masahiro Yamada, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dirk Gouders <dirk@gouders.net>
[ Upstream commit b2d00d7c61c84edd150310af3f556f8a3c6e2e67 ]
The line numers for if-entries in the menu tree are off by one or more
lines which is confusing when debugging for correctness of unrelated changes.
According to the git log, commit a02f0570ae201c49 (kconfig: improve
error handling in the parser) was the last one that changed that part
of the parser and replaced
"if_entry: T_IF expr T_EOL"
by
"if_entry: T_IF expr nl"
but the commit message does not state why this has been done.
When reverting that part of the commit, only the line numers are
corrected (checked with cdebug = DEBUG_PARSE in zconf.y), otherwise
the menu tree remains unchanged (checked with zconfdump() enabled in
conf.c).
An example for the corrected line numbers:
drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig
drivers/soc/tegra/Kconfig:4:if
drivers/soc/tegra/Kconfig:6:if
changes to:
drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig
drivers/soc/tegra/Kconfig:1:if
drivers/soc/tegra/Kconfig:4:if
Signed-off-by: Dirk Gouders <dirk@gouders.net>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/kconfig/zconf.y | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/scripts/kconfig/zconf.y
+++ b/scripts/kconfig/zconf.y
@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSI
static struct menu *current_menu, *current_entry;
%}
-%expect 32
+%expect 31
%union
{
@@ -345,7 +345,7 @@ choice_block:
/* if entry */
-if_entry: T_IF expr nl
+if_entry: T_IF expr T_EOL
{
printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno());
menu_add_entry(NULL);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 091/217] perf record: Support s390 random socket_id assignment
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 090/217] kconfig: fix line numbers for if-entries in menu tree Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 092/217] perf test session topology: Fix test on s390 Greg Kroah-Hartman
` (116 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
Heiko Carstens, Martin Schwidefsky, Arnaldo Carvalho de Melo,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit 01766229533f9bdb1144a41b4345c8c7286da7b4 ]
On s390 the socket identifier assigned to a CPU identifier is random and
(depending on the configuration of the LPAR) may be higher than the CPU
identifier. This is currently not supported.
Fix this by allowing arbitrary socket identifiers being assigned to
CPU id.
Output before:
[root@p23lp27 perf]# ./perf report --header -I -v
...
socket_id number is too big.You may need to upgrade the perf tool.
Error:
The perf.data file has no samples!
# ========
# captured on : Tue May 29 09:29:57 2018
# header version : 1
...
# Core ID and Socket ID information is not available
...
[root@p23lp27 perf]#
Output after:
[root@p23lp27 perf]# ./perf report --header -I -v
...
Error:
The perf.data file has no samples!
# ========
# captured on : Tue May 29 09:29:57 2018
# header version : 1
...
# CPU 0: Core ID 0, Socket ID 6
# CPU 1: Core ID 1, Socket ID 3
# CPU 2: Core ID -1, Socket ID -1
...
[root@p23lp27 perf]#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Link: http://lkml.kernel.org/r/20180611073153.15592-1-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/header.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1824,6 +1824,7 @@ static int process_cpu_topology(struct f
int cpu_nr = ff->ph->env.nr_cpus_avail;
u64 size = 0;
struct perf_header *ph = ff->ph;
+ bool do_core_id_test = true;
ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu));
if (!ph->env.cpu)
@@ -1878,6 +1879,13 @@ static int process_cpu_topology(struct f
return 0;
}
+ /* On s390 the socket_id number is not related to the numbers of cpus.
+ * The socket_id number might be higher than the numbers of cpus.
+ * This depends on the configuration.
+ */
+ if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
+ do_core_id_test = false;
+
for (i = 0; i < (u32)cpu_nr; i++) {
if (do_read_u32(ff, &nr))
goto free_cpu;
@@ -1887,7 +1895,7 @@ static int process_cpu_topology(struct f
if (do_read_u32(ff, &nr))
goto free_cpu;
- if (nr != (u32)-1 && nr > (u32)cpu_nr) {
+ if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) {
pr_debug("socket_id number is too big."
"You may need to upgrade the perf tool.\n");
goto free_cpu;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 092/217] perf test session topology: Fix test on s390
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 091/217] perf record: Support s390 random socket_id assignment Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 093/217] perf report powerpc: Fix crash if callchain is empty Greg Kroah-Hartman
` (115 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
Heiko Carstens, Martin Schwidefsky, Arnaldo Carvalho de Melo,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit b930e62ecd362843002bdf84c2940439822af321 ]
On s390 this test case fails because the socket identifiction numbers
assigned to the CPU are higher than the CPU identification numbers.
F/ix this by adding the platform architecture into the perf data header
flag information. This helps identifiing the test platform and handles
s390 specifics in process_cpu_topology().
Before:
[root@p23lp27 perf]# perf test -vvvvv -F 39
39: Session topology :
--- start ---
templ file: /tmp/perf-test-iUv755
socket_id number is too big.You may need to upgrade the perf tool.
---- end ----
Session topology: Skip
[root@p23lp27 perf]#
After:
[root@p23lp27 perf]# perf test -vvvvv -F 39
39: Session topology :
--- start ---
templ file: /tmp/perf-test-8X8VTs
CPU 0, core 0, socket 6
CPU 1, core 1, socket 3
---- end ----
Session topology: Ok
[root@p23lp27 perf]#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Fixes: c84974ed9fb6 ("perf test: Add entry to test cpu topology")
Link: http://lkml.kernel.org/r/20180611073153.15592-2-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/tests/topology.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/perf/tests/topology.c
+++ b/tools/perf/tests/topology.c
@@ -43,6 +43,7 @@ static int session_write_header(char *pa
perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
perf_header__set_feat(&session->header, HEADER_NRCPUS);
+ perf_header__set_feat(&session->header, HEADER_ARCH);
session->header.data_size += DATA_SIZE;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 093/217] perf report powerpc: Fix crash if callchain is empty
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 092/217] perf test session topology: Fix test on s390 Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 095/217] perf bench: Fix numa report output code Greg Kroah-Hartman
` (114 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ravi Bangoria, Sandipan Das,
Jiri Olsa, Naveen N. Rao, Sukadev Bhattiprolu,
Arnaldo Carvalho de Melo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan@linux.ibm.com>
[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ]
For some cases, the callchain provided by the kernel may be empty. So,
the callchain ip filtering code will cause a crash if we do not check
whether the struct ip_callchain pointer is NULL before accessing any
members.
This can be observed on a powerpc64le system running Fedora 27 as shown
below.
# perf record -b -e cycles:u ls
Before:
# perf report --branch-history
perf: Segmentation fault
-------- backtrace --------
perf[0x1027615c]
linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
perf(arch_skip_callchain_idx+0x44)[0x10257c58]
perf[0x1017f2e4]
perf(thread__resolve_callchain+0x124)[0x1017ff5c]
perf(sample__resolve_callchain+0xf0)[0x10172788]
...
After:
# perf report --branch-history
Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
Overhead Source:Line Symbol Shared Object
+ 11.60% _init+35736 [.] _init ls
+ 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ 8.83% _init+236 [.] _init ls
...
Reported-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
Acked-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct threa
u64 ip;
u64 skip_slot = -1;
- if (chain->nr < 3)
+ if (!chain || chain->nr < 3)
return skip_slot;
ip = chain->ips[2];
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 095/217] perf bench: Fix numa report output code
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 093/217] perf report powerpc: Fix crash if callchain is empty Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 096/217] ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD Greg Kroah-Hartman
` (113 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Alexander Shishkin,
David Ahern, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 983107072be1a39cbde67d45cb0059138190e015 ]
Currently we can hit following assert when running numa bench:
$ perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZ0cm --thp 1
perf: bench/numa.c:1577: __bench_numa: Assertion `!(!(((wait_stat) & 0x7f) == 0))' failed.
The assertion is correct, because we hit the SIGFPE in following line:
Thread 2.2 "thread 0/0" received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0x7fffd28c6700 (LWP 11750)]
0x000.. in worker_thread (__tdata=0x7.. ) at bench/numa.c:1257
1257 td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
We don't check if the runtime is actually bigger than 1 second,
and thus this might end up with zero division within FPU.
Adding the check to prevent this.
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20180620094036.17278-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/bench/numa.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata
u8 *global_data;
u8 *process_data;
u8 *thread_data;
- u64 bytes_done;
+ u64 bytes_done, secs;
long work_done;
u32 l;
struct rusage rusage;
@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata
timersub(&stop, &start0, &diff);
td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
+ secs = td->runtime_ns / NSEC_PER_SEC;
+ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
getrusage(RUSAGE_THREAD, &rusage);
td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 096/217] ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 095/217] perf bench: Fix numa report output code Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 097/217] netfilter: nf_log: fix uninit read in nf_log_proc_dostring Greg Kroah-Hartman
` (112 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Ford, Sekhar Nori, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <aford173@gmail.com>
[ Upstream commit 1b6fe9798af8cb7d80fad5dd30ee1bcd1e0f51eb ]
When booting from MMC/SD in rw mode on DA850 EVM, the system
crashes because the write protect pin should be active high
and not active low. This patch fixes the polarity of the WP pin.
Fixes: bdf0e8364fd3 ("ARM: davinci: da850-evm: use gpio descriptor for mmc pins")
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-davinci/board-da850-evm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -773,7 +773,7 @@ static struct gpiod_lookup_table mmc_gpi
GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
GPIO_ACTIVE_LOW),
GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
- GPIO_ACTIVE_LOW),
+ GPIO_ACTIVE_HIGH),
},
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 097/217] netfilter: nf_log: fix uninit read in nf_log_proc_dostring
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 096/217] ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 098/217] ceph: fix dentry leak in splice_dentry() Greg Kroah-Hartman
` (111 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Pablo Neira Ayuso, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
[ Upstream commit dffd22aed2aa1e804bccf19b30a421e89ee2ae61 ]
When proc_dostring() is called with a non-zero offset in strict mode, it
doesn't just write to the ->data buffer, it also reads. Make sure it
doesn't read uninitialized data.
Fixes: c6ac37d8d884 ("netfilter: nf_log: fix error on write NONE to [...]")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_log.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -440,6 +440,10 @@ static int nf_log_proc_dostring(struct c
if (write) {
struct ctl_table tmp = *table;
+ /* proc_dostring() can append to existing strings, so we need to
+ * initialize it as an empty string.
+ */
+ buf[0] = '\0';
tmp.data = buf;
r = proc_dostring(&tmp, write, buffer, lenp, ppos);
if (r)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 098/217] ceph: fix dentry leak in splice_dentry()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 097/217] netfilter: nf_log: fix uninit read in nf_log_proc_dostring Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 099/217] net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager Greg Kroah-Hartman
` (110 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yan, Zheng, Jeff Layton,
Ilya Dryomov, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <zyan@redhat.com>
[ Upstream commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3 ]
In any case, d_splice_alias() does not drop reference of original
dentry.
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/inode.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1087,6 +1087,7 @@ static struct dentry *splice_dentry(stru
if (IS_ERR(realdn)) {
pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
PTR_ERR(realdn), dn, in, ceph_vinop(in));
+ dput(dn);
dn = realdn; /* note realdn contains the error */
goto out;
} else if (realdn) {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 099/217] net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 098/217] ceph: fix dentry leak in splice_dentry() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 100/217] nfp: cast sizeof() to int when comparing with error code Greg Kroah-Hartman
` (109 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eli Cohen, Or Gerlitz, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eli Cohen <eli@mellanox.com>
[ Upstream commit a8d70a054a718b63058b3d3ac58b6181815e4289 ]
In smartnic env, if the host (PF) driver is not an e-switch manager, we
are not allowed to apply eswitch ports setups such as vlan (VST),
spoof-checks, min/max rate or state.
Make sure we are eswitch manager when coming to issue these callbacks
and err otherwise.
Also fix the definition of ESW_ALLOWED to rely on eswitch_manager
capability and on the vport_group_manger.
Operations on the VF nic vport context, such as setting a mac or reading
the vport counters are allowed to the PF in this scheme.
The modify nic vport guid code was modified to omit checking the
nic_vport_node_guid_modify eswitch capability.
The reason for doing so is that modifying node guid requires vport group
manager capability, and there's no need to check further capabilities.
1. set_vf_vlan - disallowed
2. set_vf_spoofchk - disallowed
3. set_vf_mac - allowed
4. get_vf_config - allowed
5. set_vf_trust - disallowed
6. set_vf_rate - disallowed
7. get_vf_stat - allowed
8. set_vf_link_state - disallowed
Fixes: f942380c1239 ('net/mlx5: E-Switch, Vport ingress/egress ACLs rules for spoofchk')
Signed-off-by: Eli Cohen <eli@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Tested-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 12 +++++-------
drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 --
2 files changed, 5 insertions(+), 9 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1525,17 +1525,15 @@ static void esw_disable_vport(struct mlx
}
/* Public E-Switch API */
-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev))
+#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev))
+
int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
{
int err;
int i, enabled_events;
- if (!ESW_ALLOWED(esw))
- return 0;
-
- if (!MLX5_ESWITCH_MANAGER(esw->dev) ||
+ if (!ESW_ALLOWED(esw) ||
!MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
return -EOPNOTSUPP;
@@ -1728,7 +1726,7 @@ int mlx5_eswitch_set_vport_mac(struct ml
u64 node_guid;
int err = 0;
- if (!ESW_ALLOWED(esw))
+ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
return -EPERM;
if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
return -EINVAL;
@@ -1805,7 +1803,7 @@ int mlx5_eswitch_get_vport_config(struct
{
struct mlx5_vport *evport;
- if (!ESW_ALLOWED(esw))
+ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
return -EPERM;
if (!LEGAL_VPORT(esw, vport))
return -EINVAL;
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(stru
return -EINVAL;
if (!MLX5_CAP_GEN(mdev, vport_group_manager))
return -EACCES;
- if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
- return -EOPNOTSUPP;
in = kvzalloc(inlen, GFP_KERNEL);
if (!in)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 100/217] nfp: cast sizeof() to int when comparing with error code
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 099/217] net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 101/217] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs Greg Kroah-Hartman
` (108 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengguang Xu, Jakub Kicinski,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengguang Xu <cgxu519@gmx.com>
[ Upstream commit 2d2595719a97c876f35b1e60e5768e58753b268c ]
sizeof() will return unsigned value so in the error check
negative error code will be always larger than sizeof().
Fixes: a0d8e02c35ff ("nfp: add support for reading nffw info")
Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open
err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res),
nfp_resource_address(state->res),
fwinf, sizeof(*fwinf));
- if (err < sizeof(*fwinf))
+ if (err < (int)sizeof(*fwinf))
goto err_release;
if (!nffw_res_flg_init_get(fwinf))
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 101/217] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 100/217] nfp: cast sizeof() to int when comparing with error code Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 102/217] selftests/x86/sigreturn: Do minor cleanups Greg Kroah-Hartman
` (107 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Borislav Petkov,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit ec348020566009d3da9b99f07c05814d13969c78 ]
When I wrote the sigreturn test, I didn't realize that AMD's busted
IRET behavior was different from Intel's busted IRET behavior:
On AMD CPUs, the CPU leaks the high 32 bits of the kernel stack pointer
to certain userspace contexts. Gee, thanks. There's very little
the kernel can do about it. Modify the test so it passes.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/86e7fd3564497f657de30a36da4505799eebef01.1530076529.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/x86/sigreturn.c | 46 ++++++++++++++++++++------------
1 file changed, 29 insertions(+), 17 deletions(-)
--- a/tools/testing/selftests/x86/sigreturn.c
+++ b/tools/testing/selftests/x86/sigreturn.c
@@ -612,19 +612,38 @@ static int test_valid_sigreturn(int cs_b
greg_t req = requested_regs[i], res = resulting_regs[i];
if (i == REG_TRAPNO || i == REG_IP)
continue; /* don't care */
- if (i == REG_SP) {
- printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
- (unsigned long long)res);
+ if (i == REG_SP) {
/*
- * In many circumstances, the high 32 bits of rsp
- * are zeroed. For example, we could be a real
- * 32-bit program, or we could hit any of a number
- * of poorly-documented IRET or segmented ESP
- * oddities. If this happens, it's okay.
+ * If we were using a 16-bit stack segment, then
+ * the kernel is a bit stuck: IRET only restores
+ * the low 16 bits of ESP/RSP if SS is 16-bit.
+ * The kernel uses a hack to restore bits 31:16,
+ * but that hack doesn't help with bits 63:32.
+ * On Intel CPUs, bits 63:32 end up zeroed, and, on
+ * AMD CPUs, they leak the high bits of the kernel
+ * espfix64 stack pointer. There's very little that
+ * the kernel can do about it.
+ *
+ * Similarly, if we are returning to a 32-bit context,
+ * the CPU will often lose the high 32 bits of RSP.
*/
- if (res == (req & 0xFFFFFFFF))
- continue; /* OK; not expected to work */
+
+ if (res == req)
+ continue;
+
+ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
+ printf("[NOTE]\tSP: %llx -> %llx\n",
+ (unsigned long long)req,
+ (unsigned long long)res);
+ continue;
+ }
+
+ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
+ (unsigned long long)requested_regs[i],
+ (unsigned long long)resulting_regs[i]);
+ nerrs++;
+ continue;
}
bool ignore_reg = false;
@@ -663,13 +682,6 @@ static int test_valid_sigreturn(int cs_b
}
if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
- /*
- * SP is particularly interesting here. The
- * usual cause of failures is that we hit the
- * nasty IRET case of returning to a 16-bit SS,
- * in which case bits 16:31 of the *kernel*
- * stack pointer persist in ESP.
- */
printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
i, (unsigned long long)requested_regs[i],
(unsigned long long)resulting_regs[i]);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 102/217] selftests/x86/sigreturn: Do minor cleanups
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 101/217] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 103/217] ARM: dts: da850: Fix interrups property for gpio Greg Kroah-Hartman
` (106 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Borislav Petkov,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit e8a445dea219c32727016af14f847d2e8f7ebec8 ]
We have short names for the requested and resulting register values.
Use them instead of spelling out the whole register entry for each
case.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/bb3bc1f923a2f6fe7912d22a1068fe29d6033d38.1530076529.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/x86/sigreturn.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/tools/testing/selftests/x86/sigreturn.c
+++ b/tools/testing/selftests/x86/sigreturn.c
@@ -610,6 +610,7 @@ static int test_valid_sigreturn(int cs_b
*/
for (int i = 0; i < NGREG; i++) {
greg_t req = requested_regs[i], res = resulting_regs[i];
+
if (i == REG_TRAPNO || i == REG_IP)
continue; /* don't care */
@@ -673,18 +674,18 @@ static int test_valid_sigreturn(int cs_b
#endif
/* Sanity check on the kernel */
- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
+ if (i == REG_CX && req != res) {
printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
- (unsigned long long)requested_regs[i],
- (unsigned long long)resulting_regs[i]);
+ (unsigned long long)req,
+ (unsigned long long)res);
nerrs++;
continue;
}
- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+ if (req != res && !ignore_reg) {
printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
- i, (unsigned long long)requested_regs[i],
- (unsigned long long)resulting_regs[i]);
+ i, (unsigned long long)req,
+ (unsigned long long)res);
nerrs++;
}
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 103/217] ARM: dts: da850: Fix interrups property for gpio
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 102/217] selftests/x86/sigreturn: Do minor cleanups Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 104/217] ARM64: dts: meson-gxl: fix Mali GPU compatible string Greg Kroah-Hartman
` (105 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Keerthy, Sekhar Nori, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keerthy <j-keerthy@ti.com>
[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ]
The intc #interrupt-cells is equal to 1. Currently gpio
node has 2 cells per IRQ which is wrong. Remove the additional
cell for each of the interrupts.
Signed-off-by: Keerthy <j-keerthy@ti.com>
Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node")
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/da850.dtsi | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/arch/arm/boot/dts/da850.dtsi
+++ b/arch/arm/boot/dts/da850.dtsi
@@ -518,11 +518,7 @@
gpio-controller;
#gpio-cells = <2>;
reg = <0x226000 0x1000>;
- interrupts = <42 IRQ_TYPE_EDGE_BOTH
- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
+ interrupts = <42 43 44 45 46 47 48 49 50>;
ti,ngpio = <144>;
ti,davinci-gpio-unbanked = <0>;
status = "disabled";
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 104/217] ARM64: dts: meson-gxl: fix Mali GPU compatible string
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 103/217] ARM: dts: da850: Fix interrups property for gpio Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 105/217] dmaengine: pl330: report BURST residue granularity Greg Kroah-Hartman
` (104 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Neil Armstrong,
Kevin Hilman, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 1c38f4afd5d40234b67635b3c608a4093be04b96 ]
meson-gxl-mali.dtsi is only used on GXL SoCs. Thus it should use the GXL
specific compatible string instead of the GXBB one.
For now this is purely cosmetic since the (out-of-tree) lima driver for
this GPU currently uses the "arm,mali-450" match instead of the SoC
specific one. However, update the .dts to match the documentation since
this driver behavior might change in the future.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
@@ -7,7 +7,7 @@
&apb {
mali: gpu@c0000 {
- compatible = "amlogic,meson-gxbb-mali", "arm,mali-450";
+ compatible = "amlogic,meson-gxl-mali", "arm,mali-450";
reg = <0x0 0xc0000 0x0 0x40000>;
interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 105/217] dmaengine: pl330: report BURST residue granularity
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 104/217] ARM64: dts: meson-gxl: fix Mali GPU compatible string Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 106/217] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() Greg Kroah-Hartman
` (103 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Vinod Koul, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit e3f329c600033f011a978a8bc4ddb1e2e94c4f4d ]
The reported residue is already calculated in BURST unit granularity, so
advertise this capability properly to other devices in the system.
Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/pl330.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2923,7 +2923,7 @@ pl330_probe(struct amba_device *adev, co
pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
+ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
1 : PL330_MAX_BURST);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 106/217] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 105/217] dmaengine: pl330: report BURST residue granularity Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 108/217] md/raid10: fix that replacement cannot complete recovery after reassemble Greg Kroah-Hartman
` (102 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Vinod Koul, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ]
The d->chans[] array has d->dma_requests elements so the > should be
>= here.
Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/k3dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -787,7 +787,7 @@ static struct dma_chan *k3_of_dma_simple
struct k3_dma_dev *d = ofdma->of_dma_data;
unsigned int request = dma_spec->args[0];
- if (request > d->dma_requests)
+ if (request >= d->dma_requests)
return NULL;
return dma_get_slave_channel(&(d->chans[request].vc.chan));
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 108/217] md/raid10: fix that replacement cannot complete recovery after reassemble
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 106/217] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 109/217] dev-dax: check_vma: ratelimit dev_info-s Greg Kroah-Hartman
` (101 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Chen, Alex Wu,
Chung-Chiang Cheng, BingJing Chang, Shaohua Li, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: BingJing Chang <bingjingc@synology.com>
[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ]
During assemble, the spare marked for replacement is not checked.
conf->fullsync cannot be updated to be 1. As a result, recovery will
treat it as a clean array. All recovering sectors are skipped. Original
device is replaced with the not-recovered spare.
mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123]
mdadm /dev/md0 -a /dev/loop4
mdadm /dev/md0 --replace /dev/loop0
mdadm -S /dev/md0 # stop array during recovery
mdadm -A /dev/md0 /dev/loop[01234]
After reassemble, you can see recovery go on, but it completes
immediately. In fact, recovery is not actually processed.
To solve this problem, we just add the missing logics for replacment
spares. (In raid1.c or raid5.c, they have already been checked.)
Reported-by: Alex Chen <alexchen@synology.com>
Reviewed-by: Alex Wu <alexwu@synology.com>
Reviewed-by: Chung-Chiang Cheng <cccheng@synology.com>
Signed-off-by: BingJing Chang <bingjingc@synology.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3754,6 +3754,13 @@ static int raid10_run(struct mddev *mdde
disk->rdev->saved_raid_disk < 0)
conf->fullsync = 1;
}
+
+ if (disk->replacement &&
+ !test_bit(In_sync, &disk->replacement->flags) &&
+ disk->replacement->saved_raid_disk < 0) {
+ conf->fullsync = 1;
+ }
+
disk->recovery_disabled = mddev->recovery_disabled - 1;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 109/217] dev-dax: check_vma: ratelimit dev_info-s
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 108/217] md/raid10: fix that replacement cannot complete recovery after reassemble Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 110/217] nl80211: relax ht operation checks for mesh Greg Kroah-Hartman
` (100 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeff Moyer, Dan Williams, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Moyer <jmoyer@redhat.com>
[ Upstream commit 5a14e91d559aee5bdb0e002e1153fd9c4338a29e ]
This is easily triggered from userspace, so let's ratelimit the
messages.
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dax/device.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -188,14 +188,16 @@ static int check_vma(struct dev_dax *dev
/* prevent private mappings from being established */
if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
- dev_info(dev, "%s: %s: fail, attempted private mapping\n",
+ dev_info_ratelimited(dev,
+ "%s: %s: fail, attempted private mapping\n",
current->comm, func);
return -EINVAL;
}
mask = dax_region->align - 1;
if (vma->vm_start & mask || vma->vm_end & mask) {
- dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
+ dev_info_ratelimited(dev,
+ "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
current->comm, func, vma->vm_start, vma->vm_end,
mask);
return -EINVAL;
@@ -203,13 +205,15 @@ static int check_vma(struct dev_dax *dev
if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV
&& (vma->vm_flags & VM_DONTCOPY) == 0) {
- dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n",
+ dev_info_ratelimited(dev,
+ "%s: %s: fail, dax range requires MADV_DONTFORK\n",
current->comm, func);
return -EINVAL;
}
if (!vma_is_dax(vma)) {
- dev_info(dev, "%s: %s: fail, vma is not DAX capable\n",
+ dev_info_ratelimited(dev,
+ "%s: %s: fail, vma is not DAX capable\n",
current->comm, func);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 110/217] nl80211: relax ht operation checks for mesh
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 109/217] dev-dax: check_vma: ratelimit dev_info-s Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 111/217] nl80211: check nla_parse_nested() return values Greg Kroah-Hartman
` (99 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masashi Honma, Bob Copeland,
Johannes Berg, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <me@bobcopeland.com>
[ Upstream commit 188f60ab8e787fcbb5ac9d64ede23a0070231f09 ]
Commit 9757235f451c, "nl80211: correct checks for
NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT
operation field in meshconf, while also adding checks requiring
the non-greenfield and non-ht-sta bits to be set in certain
circumstances. The latter bit is actually reserved for mesh BSSes
according to Table 9-168 in 802.11-2016, so in fact it should not
be set.
wpa_supplicant sets these bits because the mesh and AP code share
the same implementation, but authsae does not. As a result, some
meshconf updates from authsae which set only the NONHT_MIXED
protection bits were being rejected.
In order to avoid breaking userspace by changing the rules again,
simply accept the values with or without the bits set, and mask
off the reserved bit to match the spec.
While in here, update the 802.11-2012 reference to 802.11-2016.
Fixes: 9757235f451c ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value")
Cc: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Bob Copeland <bobcopeland@fb.com>
Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/nl80211.c | 19 +++----------------
1 file changed, 3 insertions(+), 16 deletions(-)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5990,7 +5990,7 @@ do { \
nl80211_check_s32);
/*
* Check HT operation mode based on
- * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+ * IEEE 802.11-2016 9.4.2.57 HT Operation element.
*/
if (tb[NL80211_MESHCONF_HT_OPMODE]) {
ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
@@ -6000,22 +6000,9 @@ do { \
IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
return -EINVAL;
- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
- return -EINVAL;
+ /* NON_HT_STA bit is reserved, but some programs set it */
+ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
- case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
- return -EINVAL;
- break;
- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
- return -EINVAL;
- break;
- }
cfg->ht_opmode = ht_opmode;
mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 111/217] nl80211: check nla_parse_nested() return values
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 110/217] nl80211: relax ht operation checks for mesh Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 112/217] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes Greg Kroah-Hartman
` (98 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 95bca62fb723a121954fc7ae5473bb2c1f0d5986 ]
At the very least we should check the return value if
nla_parse_nested() is called with a non-NULL policy.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/nl80211.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10529,9 +10529,12 @@ static int nl80211_set_wowlan(struct sk_
rem) {
u8 *mask_pat;
- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
- nl80211_packet_pattern_policy,
- info->extack);
+ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+ nl80211_packet_pattern_policy,
+ info->extack);
+ if (err)
+ goto error;
+
err = -EINVAL;
if (!pat_tb[NL80211_PKTPAT_MASK] ||
!pat_tb[NL80211_PKTPAT_PATTERN])
@@ -10780,8 +10783,11 @@ static int nl80211_parse_coalesce_rule(s
rem) {
u8 *mask_pat;
- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
- nl80211_packet_pattern_policy, NULL);
+ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+ nl80211_packet_pattern_policy, NULL);
+ if (err)
+ return err;
+
if (!pat_tb[NL80211_PKTPAT_MASK] ||
!pat_tb[NL80211_PKTPAT_PATTERN])
return -EINVAL;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 112/217] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 111/217] nl80211: check nla_parse_nested() return values Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 113/217] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes Greg Kroah-Hartman
` (97 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ]
Fix following issues related to planar YUV pixel format configuration:
- NV16/61 modes were incorrectly programmed as NV12/21,
- YVU420 was programmed as YUV420 on source,
- YVU420 and YUV422 were programmed as YUV420 on output.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++---------
drivers/gpu/drm/exynos/regs-gsc.h | 1 +
2 files changed, 21 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device
GSC_IN_CHROMA_ORDER_CRCB);
break;
case DRM_FORMAT_NV21:
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
+ break;
case DRM_FORMAT_NV61:
- cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
- GSC_IN_YUV420_2P);
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
break;
case DRM_FORMAT_YUV422:
cfg |= GSC_IN_YUV422_3P;
break;
case DRM_FORMAT_YUV420:
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
+ break;
case DRM_FORMAT_YVU420:
- cfg |= GSC_IN_YUV420_3P;
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
break;
case DRM_FORMAT_NV12:
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
+ break;
case DRM_FORMAT_NV16:
- cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
- GSC_IN_YUV420_2P);
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
break;
default:
dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device
GSC_OUT_CHROMA_ORDER_CRCB);
break;
case DRM_FORMAT_NV21:
- case DRM_FORMAT_NV61:
cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
break;
+ case DRM_FORMAT_NV61:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
+ break;
case DRM_FORMAT_YUV422:
+ cfg |= GSC_OUT_YUV422_3P;
+ break;
case DRM_FORMAT_YUV420:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
+ break;
case DRM_FORMAT_YVU420:
- cfg |= GSC_OUT_YUV420_3P;
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
break;
case DRM_FORMAT_NV12:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
+ break;
case DRM_FORMAT_NV16:
- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
- GSC_OUT_YUV420_2P);
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
break;
default:
dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
--- a/drivers/gpu/drm/exynos/regs-gsc.h
+++ b/drivers/gpu/drm/exynos/regs-gsc.h
@@ -138,6 +138,7 @@
#define GSC_OUT_YUV420_3P (3 << 4)
#define GSC_OUT_YUV422_1P (4 << 4)
#define GSC_OUT_YUV422_2P (5 << 4)
+#define GSC_OUT_YUV422_3P (6 << 4)
#define GSC_OUT_YUV444 (7 << 4)
#define GSC_OUT_TILE_TYPE_MASK (1 << 2)
#define GSC_OUT_TILE_C_16x8 (0 << 2)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 113/217] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 112/217] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 114/217] drm/exynos: decon5433: Fix WINCONx reset value Greg Kroah-Hartman
` (96 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit ab337fc274a1957ff0771f19e826c736253f7c39 ]
Set per-plane global alpha to maximum value to get proper blending of
XRGB and ARGB planes. This fixes the strange order of overlapping planes.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -352,8 +352,8 @@ static void decon_update_plane(struct ex
writel(val, ctx->addr + DECON_VIDOSDxB(win));
}
- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
- VIDOSD_Wx_ALPHA_B_F(0x0);
+ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) |
+ VIDOSD_Wx_ALPHA_B_F(0xff);
writel(val, ctx->addr + DECON_VIDOSDxC(win));
val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 114/217] drm/exynos: decon5433: Fix WINCONx reset value
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 113/217] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 115/217] drbd: Fix drbd_request_prepare() discard handling Greg Kroah-Hartman
` (95 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 7b7aa62c05eac9789c208b946f515983a9255d8d ]
The only bits that should be preserved in decon_win_set_fmt() is
WINCONx_ENWIN_F. All other bits depends on the selected pixel formats and
are set by the mentioned function.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -261,7 +261,7 @@ static void decon_win_set_pixfmt(struct
unsigned long val;
val = readl(ctx->addr + DECON_WINCONx(win));
- val &= ~WINCONx_BPPMODE_MASK;
+ val &= WINCONx_ENWIN_F;
switch (fb->format->format) {
case DRM_FORMAT_XRGB1555:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 115/217] drbd: Fix drbd_request_prepare() discard handling
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 114/217] drm/exynos: decon5433: Fix WINCONx reset value Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 116/217] bpf, s390: fix potential memleak when later bpf_jit_prog fails Greg Kroah-Hartman
` (94 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Philipp Reisner, Lars Ellenberg,
Bart Van Assche, Christoph Hellwig, Jens Axboe, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
[ Upstream commit fad2d4ef636654e926d374ef038f4cd4286661f6 ]
Fix the test that verifies whether bio_op(bio) represents a discard
or write zeroes operation. Compile-tested only.
Cc: Philipp Reisner <philipp.reisner@linbit.com>
Cc: Lars Ellenberg <lars.ellenberg@linbit.com>
Fixes: 7435e9018f91 ("drbd: zero-out partial unaligned discards on local backend")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/drbd/drbd_req.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device
_drbd_start_io_acct(device, req);
/* process discards always from our submitter thread */
- if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) ||
- (bio_op(bio) & REQ_OP_DISCARD))
+ if (bio_op(bio) == REQ_OP_WRITE_ZEROES ||
+ bio_op(bio) == REQ_OP_DISCARD)
goto queue_for_submitter_thread;
if (rw == WRITE && req->private_bio && req->i.size
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 116/217] bpf, s390: fix potential memleak when later bpf_jit_prog fails
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 115/217] drbd: Fix drbd_request_prepare() discard handling Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 117/217] PCI: xilinx: Add missing of_node_put() Greg Kroah-Hartman
` (93 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Martin Schwidefsky,
Alexei Starovoitov, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit f605ce5eb26ac934fb8106d75d46a2c875a2bf23 ]
If we would ever fail in the bpf_jit_prog() pass that writes the
actual insns to the image after we got header via bpf_jit_binary_alloc()
then we also need to make sure to free it through bpf_jit_binary_free()
again when bailing out. Given we had prior bpf_jit_prog() passes to
initially probe for clobbered registers, program size and to fill in
addrs arrray for jump targets, this is more of a theoretical one,
but at least make sure this doesn't break with future changes.
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/net/bpf_jit_comp.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1403,6 +1403,7 @@ struct bpf_prog *bpf_int_jit_compile(str
goto free_addrs;
}
if (bpf_jit_prog(&jit, fp)) {
+ bpf_jit_binary_free(header);
fp = orig_fp;
goto free_addrs;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 117/217] PCI: xilinx: Add missing of_node_put()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 116/217] bpf, s390: fix potential memleak when later bpf_jit_prog fails Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 118/217] PCI: xilinx-nwl: " Greg Kroah-Hartman
` (92 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Lorenzo Pieralisi,
Bjorn Helgaas, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <hofrat@osadl.org>
[ Upstream commit 8c3f9bd851a4d3acf0a0f222d4e9e41c0cd1ea8e ]
The call to of_get_next_child() returns a node pointer with refcount
incremented thus it must be explicitly decremented here after the last
usage.
Fixes: 8961def56845 ("PCI: xilinx: Add Xilinx AXI PCIe Host Bridge IP driver")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[lorenzo.pieralisi@arm.com: reworked commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-xilinx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/host/pcie-xilinx.c
+++ b/drivers/pci/host/pcie-xilinx.c
@@ -511,6 +511,7 @@ static int xilinx_pcie_init_irq_domain(s
port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
&intx_domain_ops,
port);
+ of_node_put(pcie_intc_node);
if (!port->leg_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
return -ENODEV;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 118/217] PCI: xilinx-nwl: Add missing of_node_put()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 117/217] PCI: xilinx: Add missing of_node_put() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 119/217] PCI: faraday: " Greg Kroah-Hartman
` (91 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Lorenzo Pieralisi,
Bjorn Helgaas, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <hofrat@osadl.org>
[ Upstream commit 342639d996f18bc0a4db2f42a84230c0a966dc94 ]
The call to of_get_next_child() returns a node pointer with
refcount incremented thus it must be explicitly decremented
here after the last usage.
Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[lorenzo.pieralisi@arm.com: updated commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-xilinx-nwl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/host/pcie-xilinx-nwl.c
+++ b/drivers/pci/host/pcie-xilinx-nwl.c
@@ -561,7 +561,7 @@ static int nwl_pcie_init_irq_domain(stru
PCI_NUM_INTX,
&legacy_domain_ops,
pcie);
-
+ of_node_put(legacy_intc_node);
if (!pcie->legacy_irq_domain) {
dev_err(dev, "failed to create IRQ domain\n");
return -ENOMEM;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 119/217] PCI: faraday: Add missing of_node_put()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 118/217] PCI: xilinx-nwl: " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 120/217] bnx2x: Fix receiving tx-timeout in error or recovery state Greg Kroah-Hartman
` (90 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Lorenzo Pieralisi,
Bjorn Helgaas, Linus Walleij, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <hofrat@osadl.org>
[ Upstream commit 3dc6ddfedc2818eaaa36842fbb049191e0c5e50f ]
The call to of_get_next_child() returns a node pointer with refcount
incremented thus it must be explicitly decremented here in the error
path and after the last usage.
Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[lorenzo.pieralisi@arm.com: updated commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pci-ftpci100.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/pci/host/pci-ftpci100.c
+++ b/drivers/pci/host/pci-ftpci100.c
@@ -353,11 +353,13 @@ static int faraday_pci_setup_cascaded_ir
irq = of_irq_get(intc, 0);
if (irq <= 0) {
dev_err(p->dev, "failed to get parent IRQ\n");
+ of_node_put(intc);
return irq ?: -EINVAL;
}
p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX,
&faraday_pci_irqdomain_ops, p);
+ of_node_put(intc);
if (!p->irqdomain) {
dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n");
return -EINVAL;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 120/217] bnx2x: Fix receiving tx-timeout in error or recovery state.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 119/217] PCI: faraday: " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 121/217] fsl/fman: fix parser reporting bad checksum on short frames Greg Kroah-Hartman
` (89 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ]
Driver performs the internal reload when it receives tx-timeout event from
the OS. Internal reload might fail in some scenarios e.g., fatal HW issues.
In such cases OS still see the link, which would result in undesirable
functionalities such as re-generation of tx-timeouts.
The patch addresses this issue by indicating the link-down to OS when
tx-timeout is detected, and keeping the link in down state till the
internal reload is successful.
Please consider applying it to 'net' branch.
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++
3 files changed, 13 insertions(+)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1529,6 +1529,7 @@ struct bnx2x {
struct link_vars link_vars;
u32 link_cnt;
struct bnx2x_link_report_data last_reported_link;
+ bool force_link_down;
struct mdio_if_info mdio;
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1260,6 +1260,11 @@ void __bnx2x_link_report(struct bnx2x *b
{
struct bnx2x_link_report_data cur_data;
+ if (bp->force_link_down) {
+ bp->link_vars.link_up = 0;
+ return;
+ }
+
/* reread mf_cfg */
if (IS_PF(bp) && !CHIP_IS_E1(bp))
bnx2x_read_mf_cfg(bp);
@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int
bp->pending_max = 0;
}
+ bp->force_link_down = false;
if (bp->port.pmf) {
rc = bnx2x_initial_phy_init(bp, load_mode);
if (rc)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct wo
bp->sp_rtnl_state = 0;
smp_mb();
+ /* Immediately indicate link as down */
+ bp->link_vars.link_up = 0;
+ bp->force_link_down = true;
+ netif_carrier_off(bp->dev);
+ BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
+
bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
bnx2x_nic_load(bp, LOAD_NORMAL);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 121/217] fsl/fman: fix parser reporting bad checksum on short frames
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 120/217] bnx2x: Fix receiving tx-timeout in error or recovery state Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 122/217] dpaa_eth: DPAA SGT needs to be 256B Greg Kroah-Hartman
` (88 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Madalin Bucur, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madalin Bucur <madalin.bucur@nxp.com>
[ Upstream commit b95f6fbc8e15803a596ca5e5e21008fba29694c6 ]
The FMan hardware parser needs to be configured to remove the
short frame padding from the checksum calculation, otherwise
short UDP and TCP frames are likely to be marked as having a
bad checksum.
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/fman/fman_port.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/net/ethernet/freescale/fman/fman_port.c
+++ b/drivers/net/ethernet/freescale/fman/fman_port.c
@@ -324,6 +324,10 @@ struct fman_port_qmi_regs {
#define HWP_HXS_PHE_REPORT 0x00000800
#define HWP_HXS_PCAC_PSTAT 0x00000100
#define HWP_HXS_PCAC_PSTOP 0x00000001
+#define HWP_HXS_TCP_OFFSET 0xA
+#define HWP_HXS_UDP_OFFSET 0xB
+#define HWP_HXS_SH_PAD_REM 0x80000000
+
struct fman_port_hwp_regs {
struct {
u32 ssa; /* Soft Sequence Attachment */
@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *p
iowrite32be(0xffffffff, ®s->pmda[i].lcv);
}
+ /* Short packet padding removal from checksum calculation */
+ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_TCP_OFFSET].ssa);
+ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_UDP_OFFSET].ssa);
+
start_port_hwp(port);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 122/217] dpaa_eth: DPAA SGT needs to be 256B
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 121/217] fsl/fman: fix parser reporting bad checksum on short frames Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 123/217] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value Greg Kroah-Hartman
` (87 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Madalin Bucur, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madalin Bucur <madalin.bucur@nxp.com>
[ Upstream commit 595e802e53f24642a145cf7f3e4ac9afab4c21ec ]
The DPAA HW requires that at least 256 bytes from the start of the
first scatter-gather table entry are allocated and accessible. The
hardware reads the maximum size the table can have in one access,
thus requiring that the allocation and mapping to be done for the
maximum size of 256B even if there is a smaller number of entries
in the table.
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx tim
/* Default alignment for start of data in an Rx FD */
#define DPAA_FD_DATA_ALIGNMENT 16
+/* The DPAA requires 256 bytes reserved and mapped for the SGT */
+#define DPAA_SGT_SIZE 256
+
/* Values for the L3R field of the FM Parse Results
*/
/* L3 Type field: First IP Present IPv4 */
@@ -1622,8 +1625,8 @@ static struct sk_buff *dpaa_cleanup_tx_f
if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
nr_frags = skb_shinfo(skb)->nr_frags;
- dma_unmap_single(dev, addr, qm_fd_get_offset(fd) +
- sizeof(struct qm_sg_entry) * (1 + nr_frags),
+ dma_unmap_single(dev, addr,
+ qm_fd_get_offset(fd) + DPAA_SGT_SIZE,
dma_dir);
/* The sgt buffer has been allocated with netdev_alloc_frag(),
@@ -1907,8 +1910,7 @@ static int skb_to_sg_fd(struct dpaa_priv
void *sgt_buf;
/* get a page frag to store the SGTable */
- sz = SKB_DATA_ALIGN(priv->tx_headroom +
- sizeof(struct qm_sg_entry) * (1 + nr_frags));
+ sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE);
sgt_buf = netdev_alloc_frag(sz);
if (unlikely(!sgt_buf)) {
netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n",
@@ -1976,9 +1978,8 @@ static int skb_to_sg_fd(struct dpaa_priv
skbh = (struct sk_buff **)buffer_start;
*skbh = skb;
- addr = dma_map_single(dev, buffer_start, priv->tx_headroom +
- sizeof(struct qm_sg_entry) * (1 + nr_frags),
- dma_dir);
+ addr = dma_map_single(dev, buffer_start,
+ priv->tx_headroom + DPAA_SGT_SIZE, dma_dir);
if (unlikely(dma_mapping_error(dev, addr))) {
dev_err(dev, "DMA mapping failed");
err = -EINVAL;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 123/217] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 122/217] dpaa_eth: DPAA SGT needs to be 256B Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 124/217] openrisc: entry: Fix delay slot exception detection Greg Kroah-Hartman
` (86 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jiang, Dan Williams, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit c1985cefd844e26bd19673a6df8d8f0b1918c2db ]
cmd_rc is passed in by reference to the acpi_nfit_ctl() function and the
caller expects a value returned. However, when the package is pass through
via the ND_CMD_CALL command, cmd_rc is not touched. Make sure cmd_rc is
always set.
Fixes: aef253382266 ("libnvdimm, nfit: centralize command status translation")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -224,6 +224,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
const guid_t *guid;
int rc, i;
+ *cmd_rc = -EINVAL;
func = cmd;
if (cmd == ND_CMD_CALL) {
call_pkg = buf;
@@ -314,6 +315,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
* If we return an error (like elsewhere) then caller wouldn't
* be able to rely upon data returned to make calculation.
*/
+ *cmd_rc = 0;
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 124/217] openrisc: entry: Fix delay slot exception detection
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 123/217] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.14 126/217] objtool: Support GCC 8 -fnoreorder-functions Greg Kroah-Hartman
` (85 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stafford Horne, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stafford Horne <shorne@gmail.com>
[ Upstream commit ae15a41a641449f536578b0d9ec0e4ade130deb5 ]
Originally in patch e6d20c55a4 ("openrisc: entry: Fix delay slot
detection") I fixed delay slot detection, but only for QEMU. We missed
that hardware delay slot detection using delay slot exception flag (DSX)
was still broken. This was because QEMU set the DSX flag in both
pre-exception supervision register (ESR) and supervision register (SR)
register, but on real hardware the DSX flag is only set on the SR
register during exceptions.
Fix this by carrying the DSX flag into the SR register during exception.
We also update the DSX flag read locations to read the value from the SR
register not the pt_regs SR register which represents ESR. The ESR
should never have the DSX flag set.
In the process I updated/removed a few comments to match the current
state. Including removing a comment saying that the DSX detection logic
was inefficient and needed to be rewritten.
I have tested this on QEMU with a patch ensuring it matches the hardware
specification.
Link: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00000.html
Fixes: e6d20c55a4 ("openrisc: entry: Fix delay slot detection")
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/openrisc/kernel/entry.S | 8 +-------
arch/openrisc/kernel/head.S | 9 ++++++---
arch/openrisc/kernel/traps.c | 2 +-
3 files changed, 8 insertions(+), 11 deletions(-)
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -221,12 +221,6 @@ EXCEPTION_ENTRY(_data_page_fault_handler
l.addi r3,r1,0 // pt_regs
/* r4 set be EXCEPTION_HANDLE */ // effective address of fault
- /*
- * __PHX__: TODO
- *
- * all this can be written much simpler. look at
- * DTLB miss handler in the CONFIG_GUARD_PROTECTED_CORE part
- */
#ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX
l.lwz r6,PT_PC(r3) // address of an offending insn
l.lwz r6,0(r6) // instruction that caused pf
@@ -258,7 +252,7 @@ EXCEPTION_ENTRY(_data_page_fault_handler
#else
- l.lwz r6,PT_SR(r3) // SR
+ l.mfspr r6,r0,SPR_SR // SR
l.andi r6,r6,SPR_SR_DSX // check for delay slot exception
l.sfne r6,r0 // exception happened in delay slot
l.bnf 7f
--- a/arch/openrisc/kernel/head.S
+++ b/arch/openrisc/kernel/head.S
@@ -141,8 +141,7 @@
* r4 - EEAR exception EA
* r10 - current pointing to current_thread_info struct
* r12 - syscall 0, since we didn't come from syscall
- * r13 - temp it actually contains new SR, not needed anymore
- * r31 - handler address of the handler we'll jump to
+ * r30 - handler address of the handler we'll jump to
*
* handler has to save remaining registers to the exception
* ksp frame *before* tainting them!
@@ -178,6 +177,7 @@
/* r1 is KSP, r30 is __pa(KSP) */ ;\
tophys (r30,r1) ;\
l.sw PT_GPR12(r30),r12 ;\
+ /* r4 use for tmp before EA */ ;\
l.mfspr r12,r0,SPR_EPCR_BASE ;\
l.sw PT_PC(r30),r12 ;\
l.mfspr r12,r0,SPR_ESR_BASE ;\
@@ -197,7 +197,10 @@
/* r12 == 1 if we come from syscall */ ;\
CLEAR_GPR(r12) ;\
/* ----- turn on MMU ----- */ ;\
- l.ori r30,r0,(EXCEPTION_SR) ;\
+ /* Carry DSX into exception SR */ ;\
+ l.mfspr r30,r0,SPR_SR ;\
+ l.andi r30,r30,SPR_SR_DSX ;\
+ l.ori r30,r30,(EXCEPTION_SR) ;\
l.mtspr r0,r30,SPR_ESR_BASE ;\
/* r30: EA address of handler */ ;\
LOAD_SYMBOL_2_GPR(r30,handler) ;\
--- a/arch/openrisc/kernel/traps.c
+++ b/arch/openrisc/kernel/traps.c
@@ -358,7 +358,7 @@ static inline int in_delay_slot(struct p
return 0;
}
#else
- return regs->sr & SPR_SR_DSX;
+ return mfspr(SPR_SR) & SPR_SR_DSX;
#endif
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 126/217] objtool: Support GCC 8 -fnoreorder-functions
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 124/217] openrisc: entry: Fix delay slot exception detection Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 127/217] ipvlan: call dev_change_flags when ipvlan mode is reset Greg Kroah-Hartman
` (84 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Allan Xavier,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Linus Torvalds, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
[ Upstream commit 08b393d01c88aff27347ed2b1b354eb4db2f1532 ]
Since the following commit:
cd77849a69cf ("objtool: Fix GCC 8 cold subfunction detection for aliased functions")
... if the kernel is built with EXTRA_CFLAGS='-fno-reorder-functions',
objtool can get stuck in an infinite loop.
That flag causes the new GCC 8 cold subfunctions to be placed in .text
instead of .text.unlikely. But it also has an unfortunate quirk: in the
symbol table, the subfunction (e.g., nmi_panic.cold.7) is nested inside
the parent (nmi_panic).
That function overlap confuses objtool, and causes it to get into an
infinite loop in next_insn_same_func(). Here's Allan's description of
the loop:
"Objtool iterates through the instructions in nmi_panic using
next_insn_same_func. Once it reaches the end of nmi_panic at 0x534 it
jumps to 0x528 as that's the start of nmi_panic.cold.7. However, since
the instructions starting at 0x528 are still associated with nmi_panic
objtool will get stuck in a loop, continually jumping back to 0x528
after reaching 0x534."
Fix it by shortening the length of the parent function so that the
functions no longer overlap.
Reported-and-analyzed-by: Allan Xavier <allan.x.xavier@oracle.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Allan Xavier <allan.x.xavier@oracle.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/9e704c52bee651129b036be14feda317ae5606ae.1530136978.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/elf.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf)
continue;
sym->pfunc = sym->cfunc = sym;
coldstr = strstr(sym->name, ".cold.");
- if (coldstr) {
- coldstr[0] = '\0';
- pfunc = find_symbol_by_name(elf, sym->name);
- coldstr[0] = '.';
+ if (!coldstr)
+ continue;
+
+ coldstr[0] = '\0';
+ pfunc = find_symbol_by_name(elf, sym->name);
+ coldstr[0] = '.';
+
+ if (!pfunc) {
+ WARN("%s(): can't find parent function",
+ sym->name);
+ goto err;
+ }
- if (!pfunc) {
- WARN("%s(): can't find parent function",
- sym->name);
- goto err;
- }
+ sym->pfunc = pfunc;
+ pfunc->cfunc = sym;
- sym->pfunc = pfunc;
- pfunc->cfunc = sym;
+ /*
+ * Unfortunately, -fnoreorder-functions puts the child
+ * inside the parent. Remove the overlap so we can
+ * have sane assumptions.
+ *
+ * Note that pfunc->len now no longer matches
+ * pfunc->sym.st_size.
+ */
+ if (sym->sec == pfunc->sec &&
+ sym->offset >= pfunc->offset &&
+ sym->offset + sym->len == pfunc->offset + pfunc->len) {
+ pfunc->len -= sym->len;
}
}
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 127/217] ipvlan: call dev_change_flags when ipvlan mode is reset
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.14 126/217] objtool: Support GCC 8 -fnoreorder-functions Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 128/217] drm/amdgpu: fix swapped emit_ib_size in vce3 Greg Kroah-Hartman
` (83 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianlin Shi, Stefano Brivio,
Sabrina Dubroca, Hangbin Liu, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 5dc2d3996a8b221c20dd0900bdad45031a572530 ]
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipvlan/ipvlan_main.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -73,10 +73,23 @@ static int ipvlan_set_port_mode(struct i
{
struct ipvl_dev *ipvlan;
struct net_device *mdev = port->dev;
- int err = 0;
+ unsigned int flags;
+ int err;
ASSERT_RTNL();
if (port->mode != nval) {
+ list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+ flags = ipvlan->dev->flags;
+ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
+ err = dev_change_flags(ipvlan->dev,
+ flags | IFF_NOARP);
+ } else {
+ err = dev_change_flags(ipvlan->dev,
+ flags & ~IFF_NOARP);
+ }
+ if (unlikely(err))
+ goto fail;
+ }
if (nval == IPVLAN_MODE_L3S) {
/* New mode is L3S */
err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
@@ -84,21 +97,28 @@ static int ipvlan_set_port_mode(struct i
mdev->l3mdev_ops = &ipvl_l3mdev_ops;
mdev->priv_flags |= IFF_L3MDEV_MASTER;
} else
- return err;
+ goto fail;
} else if (port->mode == IPVLAN_MODE_L3S) {
/* Old mode was L3S */
mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
mdev->l3mdev_ops = NULL;
}
- list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
- ipvlan->dev->flags |= IFF_NOARP;
- else
- ipvlan->dev->flags &= ~IFF_NOARP;
- }
port->mode = nval;
}
+ return 0;
+
+fail:
+ /* Undo the flags changes that have been done so far. */
+ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
+ flags = ipvlan->dev->flags;
+ if (port->mode == IPVLAN_MODE_L3 ||
+ port->mode == IPVLAN_MODE_L3S)
+ dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
+ else
+ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
+ }
+
return err;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 128/217] drm/amdgpu: fix swapped emit_ib_size in vce3
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 127/217] ipvlan: call dev_change_flags when ipvlan mode is reset Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 129/217] x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all() Greg Kroah-Hartman
` (82 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junwei Zhang, Alex Deucher, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 0859df22ab7cfb3ad2df2caed76cadce6ac33a80 ]
The phys and vm versions had the values swapped.
Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -899,7 +899,7 @@ static const struct amdgpu_ring_funcs vc
.emit_frame_size =
4 + /* vce_v3_0_emit_pipeline_sync */
6, /* amdgpu_vce_ring_emit_fence x1 no user fence */
- .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
+ .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
.emit_ib = amdgpu_vce_ring_emit_ib,
.emit_fence = amdgpu_vce_ring_emit_fence,
.test_ring = amdgpu_vce_ring_test_ring,
@@ -923,7 +923,7 @@ static const struct amdgpu_ring_funcs vc
6 + /* vce_v3_0_emit_vm_flush */
4 + /* vce_v3_0_emit_pipeline_sync */
6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */
- .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
+ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
.emit_ib = vce_v3_0_ring_emit_ib,
.emit_vm_flush = vce_v3_0_emit_vm_flush,
.emit_pipeline_sync = vce_v3_0_emit_pipeline_sync,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 129/217] x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 128/217] drm/amdgpu: fix swapped emit_ib_size in vce3 Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 130/217] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos Greg Kroah-Hartman
` (81 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhenzhong Duan, Andy Lutomirski,
Borislav Petkov, Linus Torvalds, Peter Zijlstra, Thomas Gleixner,
H. Peter Anvin, Ingo Molnar, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
[ Upstream commit 4fb5f58e8d191f7c81637ad81284e4848afb4244 ]
On 32-bit kernels, __flush_tlb_all() may have read the CR4 shadow before the
initialization of CR4 shadow in cpu_init().
Fix it by adding an explicit cr4_init_shadow() call into start_secondary()
which is the first function called on non-boot SMP CPUs - ahead of the
__flush_tlb_all() call.
( This is somewhat of a layering violation, but start_secondary() does
CR4 bootstrap in the PCID case anyway. )
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: http://lkml.kernel.org/r/b07b6ae9-4b57-4b40-b9bc-50c2c67f1d91@default
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/smpboot.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -223,6 +223,11 @@ static void notrace start_secondary(void
#ifdef CONFIG_X86_32
/* switch away from the initial page table */
load_cr3(swapper_pg_dir);
+ /*
+ * Initialize the CR4 shadow before doing anything that could
+ * try to read it.
+ */
+ cr4_init_shadow();
__flush_tlb_all();
#endif
load_current_idt();
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 130/217] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 129/217] x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all() Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 131/217] ARM: imx_v6_v7_defconfig: Select ULPI support Greg Kroah-Hartman
` (80 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Jiri Kosina, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <killertofu@gmail.com>
[ Upstream commit 3b8d573586d1b9dee33edf6cb6f2ca05f4bca568 ]
The touch sensors on the 2nd-gen Intuos tablets don't use a 4096x4096
sensor like other similar tablets (3rd-gen Bamboo, Intuos5, etc.).
The incorrect maximum XY values don't normally affect userspace since
touch input from these devices is typically relative rather than
absolute. It does, however, cause problems when absolute distances
need to be measured, e.g. for gesture recognition. Since the resolution
of the touch sensor on these devices is 10 units / mm (versus 100 for
the pen sensor), the proper maximum values can be calculated by simply
dividing by 10.
Fixes: b5fd2a3e92 ("Input: wacom - add support for three new Intuos devices")
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3212,8 +3212,14 @@ void wacom_setup_device_quirks(struct wa
if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
features->device_type |= WACOM_DEVICETYPE_PAD;
- features->x_max = 4096;
- features->y_max = 4096;
+ if (features->type == INTUOSHT2) {
+ features->x_max = features->x_max / 10;
+ features->y_max = features->y_max / 10;
+ }
+ else {
+ features->x_max = 4096;
+ features->y_max = 4096;
+ }
}
else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
features->device_type |= WACOM_DEVICETYPE_PAD;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 131/217] ARM: imx_v6_v7_defconfig: Select ULPI support
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 130/217] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 132/217] ARM: imx_v4_v5_defconfig: " Greg Kroah-Hartman
` (79 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Smirnov, Fabio Estevam,
Shawn Guo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
[ Upstream commit 157bcc06094c3c5800d3f4676527047b79b618e7 ]
Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
USB ULPI can be functional on some boards like imx51-babbge.
This fixes a kernel hang in 4.18-rc1 on i.mx51-babbage, caused by commit
03e6275ae381 ("usb: chipidea: Fix ULPI on imx51").
Suggested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/imx_v6_v7_defconfig | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -289,6 +289,7 @@ CONFIG_USB_STORAGE=y
CONFIG_USB_CHIPIDEA=y
CONFIG_USB_CHIPIDEA_UDC=y
CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_ULPI=y
CONFIG_USB_SERIAL=m
CONFIG_USB_SERIAL_GENERIC=y
CONFIG_USB_SERIAL_FTDI_SIO=m
@@ -325,6 +326,7 @@ CONFIG_USB_GADGETFS=m
CONFIG_USB_FUNCTIONFS=m
CONFIG_USB_MASS_STORAGE=m
CONFIG_USB_G_SERIAL=m
+CONFIG_USB_ULPI_BUS=y
CONFIG_MMC=y
CONFIG_MMC_SDHCI=y
CONFIG_MMC_SDHCI_PLTFM=y
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 132/217] ARM: imx_v4_v5_defconfig: Select ULPI support
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 131/217] ARM: imx_v6_v7_defconfig: Select ULPI support Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 133/217] bpf: hash map: decrement counter on error Greg Kroah-Hartman
` (78 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ]
Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
USB ULPI can be functional on some boards like that use ULPI
interface.
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/imx_v4_v5_defconfig | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -144,9 +144,11 @@ CONFIG_USB_STORAGE=y
CONFIG_USB_CHIPIDEA=y
CONFIG_USB_CHIPIDEA_UDC=y
CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_ULPI=y
CONFIG_NOP_USB_XCEIV=y
CONFIG_USB_GADGET=y
CONFIG_USB_ETH=m
+CONFIG_USB_ULPI_BUS=y
CONFIG_MMC=y
CONFIG_MMC_SDHCI=y
CONFIG_MMC_SDHCI_PLTFM=y
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 133/217] bpf: hash map: decrement counter on error
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 132/217] ARM: imx_v4_v5_defconfig: " Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 135/217] kasan: fix shadow_size calculation error in kasan_module_alloc Greg Kroah-Hartman
` (77 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauricio Vasquez B,
Alexei Starovoitov, Daniel Borkmann, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauricio Vasquez B <mauricio.vasquez@polito.it>
[ Upstream commit ed2b82c03dc187018307c7c6bf9299705f3db383 ]
Decrement the number of elements in the map in case the allocation
of a new node fails.
Fixes: 6c9059817432 ("bpf: pre-allocate hash map elements")
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/hashtab.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -730,13 +730,15 @@ static struct htab_elem *alloc_htab_elem
* old element will be freed immediately.
* Otherwise return an error
*/
- atomic_dec(&htab->count);
- return ERR_PTR(-E2BIG);
+ l_new = ERR_PTR(-E2BIG);
+ goto dec_count;
}
l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
htab->map.numa_node);
- if (!l_new)
- return ERR_PTR(-ENOMEM);
+ if (!l_new) {
+ l_new = ERR_PTR(-ENOMEM);
+ goto dec_count;
+ }
}
memcpy(l_new->key, key, key_size);
@@ -749,7 +751,8 @@ static struct htab_elem *alloc_htab_elem
GFP_ATOMIC | __GFP_NOWARN);
if (!pptr) {
kfree(l_new);
- return ERR_PTR(-ENOMEM);
+ l_new = ERR_PTR(-ENOMEM);
+ goto dec_count;
}
}
@@ -763,6 +766,9 @@ static struct htab_elem *alloc_htab_elem
l_new->hash = hash;
return l_new;
+dec_count:
+ atomic_dec(&htab->count);
+ return l_new;
}
static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 135/217] kasan: fix shadow_size calculation error in kasan_module_alloc
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 133/217] bpf: hash map: decrement counter on error Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 136/217] smsc75xx: Add workaround for gigabit link up hardware errata Greg Kroah-Hartman
` (76 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhen Lei, Dmitriy Vyukov,
Andrey Ryabinin, Alexander Potapenko, Hanjun Guo, Libin,
Andrew Morton, Linus Torvalds, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 1e8e18f694a52d703665012ca486826f64bac29d ]
There is a special case that the size is "(N << KASAN_SHADOW_SCALE_SHIFT)
Pages plus X", the value of X is [1, KASAN_SHADOW_SCALE_SIZE-1]. The
operation "size >> KASAN_SHADOW_SCALE_SHIFT" will drop X, and the
roundup operation can not retrieve the missed one page. For example:
size=0x28006, PAGE_SIZE=0x1000, KASAN_SHADOW_SCALE_SHIFT=3, we will get
shadow_size=0x5000, but actually we need 6 pages.
shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, PAGE_SIZE);
This can lead to a kernel crash when kasan is enabled and the value of
mod->core_layout.size or mod->init_layout.size is like above. Because
the shadow memory of X has not been allocated and mapped.
move_module:
ptr = module_alloc(mod->core_layout.size);
...
memset(ptr, 0, mod->core_layout.size); //crashed
Unable to handle kernel paging request at virtual address ffff0fffff97b000
......
Call trace:
__asan_storeN+0x174/0x1a8
memset+0x24/0x48
layout_and_allocate+0xcd8/0x1800
load_module+0x190/0x23e8
SyS_finit_module+0x148/0x180
Link: http://lkml.kernel.org/r/1529659626-12660-1-git-send-email-thunder.leizhen@huawei.com
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dmitriy Vyukov <dvyukov@google.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Libin <huawei.libin@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kasan/kasan.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -613,12 +613,13 @@ void kasan_kfree_large(const void *ptr)
int kasan_module_alloc(void *addr, size_t size)
{
void *ret;
+ size_t scaled_size;
size_t shadow_size;
unsigned long shadow_start;
shadow_start = (unsigned long)kasan_mem_to_shadow(addr);
- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT,
- PAGE_SIZE);
+ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
+ shadow_size = round_up(scaled_size, PAGE_SIZE);
if (WARN_ON(!PAGE_ALIGNED(shadow_start)))
return -EINVAL;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 136/217] smsc75xx: Add workaround for gigabit link up hardware errata.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 135/217] kasan: fix shadow_size calculation error in kasan_module_alloc Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 137/217] drm/bridge/sii8620: Fix display of packed pixel modes Greg Kroah-Hartman
` (75 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yuiko Oshino, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuiko Oshino <yuiko.oshino@microchip.com>
[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ]
In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state.
Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices")
Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -82,6 +82,9 @@ static bool turbo_mode = true;
module_param(turbo_mode, bool, 0644);
MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
+
static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
u32 *data, int in_pm)
{
@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struc
return -EIO;
}
+ /* phy workaround for gig link */
+ smsc75xx_phy_gig_workaround(dev);
+
smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
ADVERTISE_PAUSE_ASYM);
@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct us
return -EIO;
}
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+ struct mii_if_info *mii = &dev->mii;
+ int ret = 0, timeout = 0;
+ u32 buf, link_up = 0;
+
+ /* Set the phy in Gig loopback */
+ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+
+ /* Wait for the link up */
+ do {
+ link_up = smsc75xx_link_ok_nopm(dev);
+ usleep_range(10000, 20000);
+ timeout++;
+ } while ((!link_up) && (timeout < 1000));
+
+ if (timeout >= 1000) {
+ netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+ return -EIO;
+ }
+
+ /* phy reset */
+ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+ return ret;
+ }
+
+ buf |= PMT_CTL_PHY_RST;
+
+ ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+ return ret;
+ }
+
+ timeout = 0;
+ do {
+ usleep_range(10000, 20000);
+ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+ ret);
+ return ret;
+ }
+ timeout++;
+ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+
+ if (timeout >= 100) {
+ netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+ return -EIO;
+ }
+
+ return 0;
+}
+
static int smsc75xx_reset(struct usbnet *dev)
{
struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 137/217] drm/bridge/sii8620: Fix display of packed pixel modes
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 136/217] smsc75xx: Add workaround for gigabit link up hardware errata Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 138/217] samples/bpf: add missing <linux/if_vlan.h> Greg Kroah-Hartman
` (74 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej Purski, Andrzej Hajda, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Purski <m.purski@samsung.com>
[ Upstream commit fdddc65ab35d575b42aab411b2dc687601eab680 ]
Current implementation does not guarantee packed pixel modes working
with every dongle. There are some dongles, which require selecting
the output mode explicitly.
Write proper values to registers in packed_pixel mode, based on how it
is done in vendor's code. Select output color space: RGB
(no packed pixel) or YCBCR422 (packed pixel).
This reverts commit e8b92efa629dac0e70ea4145c5e70616de5f89c8
("drm/bridge/sii8620: fix display of packed pixel modes in MHL2").
Signed-off-by: Maciej Purski <m.purski@samsung.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1530204243-6370-3-git-send-email-m.purski@samsung.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/sil-sii8620.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -1038,21 +1038,36 @@ static void sii8620_stop_video(struct si
static void sii8620_set_format(struct sii8620 *ctx)
{
+ u8 out_fmt;
+
if (sii8620_is_mhl3(ctx)) {
sii8620_setbits(ctx, REG_M3_P0CTRL,
BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
ctx->use_packed_pixel ? ~0 : 0);
} else {
+ if (ctx->use_packed_pixel) {
+ sii8620_write_seq_static(ctx,
+ REG_VID_MODE, BIT_VID_MODE_M1080P,
+ REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
+ REG_MHLTX_CTL6, 0x60
+ );
+ } else {
sii8620_write_seq_static(ctx,
REG_VID_MODE, 0,
REG_MHL_TOP_CTL, 1,
REG_MHLTX_CTL6, 0xa0
);
+ }
}
+ if (ctx->use_packed_pixel)
+ out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL);
+ else
+ out_fmt = VAL_TPI_FORMAT(RGB, FULL);
+
sii8620_write_seq(ctx,
REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
- REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
+ REG_TPI_OUTPUT, out_fmt,
);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 138/217] samples/bpf: add missing <linux/if_vlan.h>
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 137/217] drm/bridge/sii8620: Fix display of packed pixel modes Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 140/217] samples/bpf: Check the error of write() and read() Greg Kroah-Hartman
` (73 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Taeung Song, David S. Miller,
Daniel Borkmann, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeung Song <treeze.taeung@gmail.com>
[ Upstream commit 4d5d33a085335ef469c9a87792bcaaaa8e64d8c4 ]
This fixes build error regarding redefinition:
CLANG-bpf samples/bpf/parse_varlen.o
samples/bpf/parse_varlen.c:111:8: error: redefinition of 'vlan_hdr'
struct vlan_hdr {
^
./include/linux/if_vlan.h:38:8: note: previous definition is here
So remove duplicate 'struct vlan_hdr' in sample code and include if_vlan.h
Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
samples/bpf/parse_varlen.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/samples/bpf/parse_varlen.c
+++ b/samples/bpf/parse_varlen.c
@@ -6,6 +6,7 @@
*/
#define KBUILD_MODNAME "foo"
#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/in.h>
@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64
return 0;
}
-struct vlan_hdr {
- uint16_t h_vlan_TCI;
- uint16_t h_vlan_encapsulated_proto;
-};
-
SEC("varlen")
int handle_ingress(struct __sk_buff *skb)
{
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 140/217] samples/bpf: Check the error of write() and read()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 138/217] samples/bpf: add missing <linux/if_vlan.h> Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 141/217] ieee802154: 6lowpan: set IFLA_LINK Greg Kroah-Hartman
` (72 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Laight, Taeung Song,
David S. Miller, Daniel Borkmann, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeung Song <treeze.taeung@gmail.com>
[ Upstream commit 02a2f000a3629274bfad60bfc4de9edec49e63e7 ]
test_task_rename() and test_urandom_read()
can be failed during write() and read(),
So check the result of them.
Reviewed-by: David Laight <David.Laight@ACULAB.COM>
Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
samples/bpf/test_overhead_user.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/samples/bpf/test_overhead_user.c
+++ b/samples/bpf/test_overhead_user.c
@@ -6,6 +6,7 @@
*/
#define _GNU_SOURCE
#include <sched.h>
+#include <errno.h>
#include <stdio.h>
#include <sys/types.h>
#include <asm/unistd.h>
@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
exit(1);
}
start_time = time_get_ns();
- for (i = 0; i < MAX_CNT; i++)
- write(fd, buf, sizeof(buf));
+ for (i = 0; i < MAX_CNT; i++) {
+ if (write(fd, buf, sizeof(buf)) < 0) {
+ printf("task rename failed: %s\n", strerror(errno));
+ close(fd);
+ return;
+ }
+ }
printf("task_rename:%d: %lld events per sec\n",
cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
close(fd);
@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
exit(1);
}
start_time = time_get_ns();
- for (i = 0; i < MAX_CNT; i++)
- read(fd, buf, sizeof(buf));
+ for (i = 0; i < MAX_CNT; i++) {
+ if (read(fd, buf, sizeof(buf)) < 0) {
+ printf("failed to read from /dev/urandom: %s\n", strerror(errno));
+ close(fd);
+ return;
+ }
+ }
printf("urandom_read:%d: %lld events per sec\n",
cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
close(fd);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 141/217] ieee802154: 6lowpan: set IFLA_LINK
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 140/217] samples/bpf: Check the error of write() and read() Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 142/217] netfilter: x_tables: set module owner for icmp(6) matches Greg Kroah-Hartman
` (71 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lubomir Rintel, Alexander Aring,
Stefan Schmidt, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <lkundrak@v3.sk>
[ Upstream commit b30c122c0bbb0a1dc413085e177ea09467e65fdb ]
Otherwise NetworkManager (and iproute alike) is not able to identify the
parent IEEE 802.15.4 interface of a 6LoWPAN link.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ieee802154/6lowpan/core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct
return 0;
}
+static int lowpan_get_iflink(const struct net_device *dev)
+{
+ return lowpan_802154_dev(dev)->wdev->ifindex;
+}
+
static const struct net_device_ops lowpan_netdev_ops = {
.ndo_init = lowpan_dev_init,
.ndo_start_xmit = lowpan_xmit,
.ndo_open = lowpan_open,
.ndo_stop = lowpan_stop,
.ndo_neigh_construct = lowpan_neigh_construct,
+ .ndo_get_iflink = lowpan_get_iflink,
};
static void lowpan_setup(struct net_device *ldev)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 142/217] netfilter: x_tables: set module owner for icmp(6) matches
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 141/217] ieee802154: 6lowpan: set IFLA_LINK Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 143/217] ipv6: make ipv6_renew_options() interrupt/kernel safe Greg Kroah-Hartman
` (70 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ]
nft_compat relies on xt_request_find_match to increment
refcount of the module that provides the match/target.
The (builtin) icmp matches did't set the module owner so it
was possible to rmmod ip(6)tables while icmp extensions were still in use.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
2 files changed, 2 insertions(+)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1894,6 +1894,7 @@ static struct xt_match ipt_builtin_mt[]
.checkentry = icmp_checkentry,
.proto = IPPROTO_ICMP,
.family = NFPROTO_IPV4,
+ .me = THIS_MODULE,
},
};
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1907,6 +1907,7 @@ static struct xt_match ip6t_builtin_mt[]
.checkentry = icmp6_checkentry,
.proto = IPPROTO_ICMPV6,
.family = NFPROTO_IPV6,
+ .me = THIS_MODULE,
},
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 143/217] ipv6: make ipv6_renew_options() interrupt/kernel safe
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 142/217] netfilter: x_tables: set module owner for icmp(6) matches Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 144/217] net: qrtr: Broadcast messages only from control port Greg Kroah-Hartman
` (69 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Al Viro, Paul Moore, David S. Miller,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit a9ba23d48dbc6ffd08426bb10f05720e0b9f5c14 ]
At present the ipv6_renew_options_kern() function ends up calling into
access_ok() which is problematic if done from inside an interrupt as
access_ok() calls WARN_ON_IN_IRQ() on some (all?) architectures
(x86-64 is affected). Example warning/backtrace is shown below:
WARNING: CPU: 1 PID: 3144 at lib/usercopy.c:11 _copy_from_user+0x85/0x90
...
Call Trace:
<IRQ>
ipv6_renew_option+0xb2/0xf0
ipv6_renew_options+0x26a/0x340
ipv6_renew_options_kern+0x2c/0x40
calipso_req_setattr+0x72/0xe0
netlbl_req_setattr+0x126/0x1b0
selinux_netlbl_inet_conn_request+0x80/0x100
selinux_inet_conn_request+0x6d/0xb0
security_inet_conn_request+0x32/0x50
tcp_conn_request+0x35f/0xe00
? __lock_acquire+0x250/0x16c0
? selinux_socket_sock_rcv_skb+0x1ae/0x210
? tcp_rcv_state_process+0x289/0x106b
tcp_rcv_state_process+0x289/0x106b
? tcp_v6_do_rcv+0x1a7/0x3c0
tcp_v6_do_rcv+0x1a7/0x3c0
tcp_v6_rcv+0xc82/0xcf0
ip6_input_finish+0x10d/0x690
ip6_input+0x45/0x1e0
? ip6_rcv_finish+0x1d0/0x1d0
ipv6_rcv+0x32b/0x880
? ip6_make_skb+0x1e0/0x1e0
__netif_receive_skb_core+0x6f2/0xdf0
? process_backlog+0x85/0x250
? process_backlog+0x85/0x250
? process_backlog+0xec/0x250
process_backlog+0xec/0x250
net_rx_action+0x153/0x480
__do_softirq+0xd9/0x4f7
do_softirq_own_stack+0x2a/0x40
</IRQ>
...
While not present in the backtrace, ipv6_renew_option() ends up calling
access_ok() via the following chain:
access_ok()
_copy_from_user()
copy_from_user()
ipv6_renew_option()
The fix presented in this patch is to perform the userspace copy
earlier in the call chain such that it is only called when the option
data is actually coming from userspace; that place is
do_ipv6_setsockopt(). Not only does this solve the problem seen in
the backtrace above, it also allows us to simplify the code quite a
bit by removing ipv6_renew_options_kern() completely. We also take
this opportunity to cleanup ipv6_renew_options()/ipv6_renew_option()
a small amount as well.
This patch is heavily based on a rough patch by Al Viro. I've taken
his original patch, converted a kmemdup() call in do_ipv6_setsockopt()
to a memdup_user() call, made better use of the e_inval jump target in
the same function, and cleaned up the use ipv6_renew_option() by
ipv6_renew_options().
CC: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ipv6.h | 9 ---
net/ipv6/calipso.c | 9 +--
net/ipv6/exthdrs.c | 111 ++++++++++++-----------------------------------
net/ipv6/ipv6_sockglue.c | 27 ++++++++---
4 files changed, 53 insertions(+), 103 deletions(-)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -313,14 +313,7 @@ struct ipv6_txoptions *ipv6_dup_options(
struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
struct ipv6_txoptions *opt,
int newtype,
- struct ipv6_opt_hdr __user *newopt,
- int newoptlen);
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk,
- struct ipv6_txoptions *opt,
- int newtype,
- struct ipv6_opt_hdr *newopt,
- int newoptlen);
+ struct ipv6_opt_hdr *newopt);
struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
struct ipv6_txoptions *opt);
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -799,8 +799,7 @@ static int calipso_opt_update(struct soc
{
struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
- hop, hop ? ipv6_optlen(hop) : 0);
+ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
txopt_put(old);
if (IS_ERR(txopts))
return PTR_ERR(txopts);
@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct re
if (IS_ERR(new))
return PTR_ERR(new);
- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
- new, new ? ipv6_optlen(new) : 0);
+ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
kfree(new);
@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct r
if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
return; /* Nothing to do */
- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
- new, new ? ipv6_optlen(new) : 0);
+ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
if (!IS_ERR(txopts)) {
txopts = xchg(&req_inet->ipv6_opt, txopts);
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -987,29 +987,21 @@ ipv6_dup_options(struct sock *sk, struct
}
EXPORT_SYMBOL_GPL(ipv6_dup_options);
-static int ipv6_renew_option(void *ohdr,
- struct ipv6_opt_hdr __user *newopt, int newoptlen,
- int inherit,
- struct ipv6_opt_hdr **hdr,
- char **p)
+static void ipv6_renew_option(int renewtype,
+ struct ipv6_opt_hdr **dest,
+ struct ipv6_opt_hdr *old,
+ struct ipv6_opt_hdr *new,
+ int newtype, char **p)
{
- if (inherit) {
- if (ohdr) {
- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
- *hdr = (struct ipv6_opt_hdr *)*p;
- *p += CMSG_ALIGN(ipv6_optlen(*hdr));
- }
- } else {
- if (newopt) {
- if (copy_from_user(*p, newopt, newoptlen))
- return -EFAULT;
- *hdr = (struct ipv6_opt_hdr *)*p;
- if (ipv6_optlen(*hdr) > newoptlen)
- return -EINVAL;
- *p += CMSG_ALIGN(newoptlen);
- }
- }
- return 0;
+ struct ipv6_opt_hdr *src;
+
+ src = (renewtype == newtype ? new : old);
+ if (!src)
+ return;
+
+ memcpy(*p, src, ipv6_optlen(src));
+ *dest = (struct ipv6_opt_hdr *)*p;
+ *p += CMSG_ALIGN(ipv6_optlen(*dest));
}
/**
@@ -1035,13 +1027,11 @@ static int ipv6_renew_option(void *ohdr,
*/
struct ipv6_txoptions *
ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
- int newtype,
- struct ipv6_opt_hdr __user *newopt, int newoptlen)
+ int newtype, struct ipv6_opt_hdr *newopt)
{
int tot_len = 0;
char *p;
struct ipv6_txoptions *opt2;
- int err;
if (opt) {
if (newtype != IPV6_HOPOPTS && opt->hopopt)
@@ -1054,8 +1044,8 @@ ipv6_renew_options(struct sock *sk, stru
tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
}
- if (newopt && newoptlen)
- tot_len += CMSG_ALIGN(newoptlen);
+ if (newopt)
+ tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
if (!tot_len)
return NULL;
@@ -1070,29 +1060,19 @@ ipv6_renew_options(struct sock *sk, stru
opt2->tot_len = tot_len;
p = (char *)(opt2 + 1);
- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
- newtype != IPV6_HOPOPTS,
- &opt2->hopopt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
- newtype != IPV6_RTHDRDSTOPTS,
- &opt2->dst0opt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
- newtype != IPV6_RTHDR,
- (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
- newtype != IPV6_DSTOPTS,
- &opt2->dst1opt, &p);
- if (err)
- goto out;
+ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
+ (opt ? opt->hopopt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
+ (opt ? opt->dst0opt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_RTHDR,
+ (struct ipv6_opt_hdr **)&opt2->srcrt,
+ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
+ (opt ? opt->dst1opt : NULL),
+ newopt, newtype, &p);
opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
(opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
@@ -1100,37 +1080,6 @@ ipv6_renew_options(struct sock *sk, stru
opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
return opt2;
-out:
- sock_kfree_s(sk, opt2, opt2->tot_len);
- return ERR_PTR(err);
-}
-
-/**
- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
- *
- * @sk: sock from which to allocate memory
- * @opt: original options
- * @newtype: option type to replace in @opt
- * @newopt: new option of type @newtype to replace (kernel-mem)
- * @newoptlen: length of @newopt
- *
- * See ipv6_renew_options(). The difference is that @newopt is
- * kernel memory, rather than user memory.
- */
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
- int newtype, struct ipv6_opt_hdr *newopt,
- int newoptlen)
-{
- struct ipv6_txoptions *ret_val;
- const mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
- ret_val = ipv6_renew_options(sk, opt, newtype,
- (struct ipv6_opt_hdr __user *)newopt,
- newoptlen);
- set_fs(old_fs);
- return ret_val;
}
struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -390,6 +390,12 @@ static int do_ipv6_setsockopt(struct soc
case IPV6_DSTOPTS:
{
struct ipv6_txoptions *opt;
+ struct ipv6_opt_hdr *new = NULL;
+
+ /* hop-by-hop / destination options are privileged option */
+ retv = -EPERM;
+ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+ break;
/* remove any sticky options header with a zero option
* length, per RFC3542.
@@ -401,17 +407,22 @@ static int do_ipv6_setsockopt(struct soc
else if (optlen < sizeof(struct ipv6_opt_hdr) ||
optlen & 0x7 || optlen > 8 * 255)
goto e_inval;
-
- /* hop-by-hop / destination options are privileged option */
- retv = -EPERM;
- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
- break;
+ else {
+ new = memdup_user(optval, optlen);
+ if (IS_ERR(new)) {
+ retv = PTR_ERR(new);
+ break;
+ }
+ if (unlikely(ipv6_optlen(new) > optlen)) {
+ kfree(new);
+ goto e_inval;
+ }
+ }
opt = rcu_dereference_protected(np->opt,
lockdep_sock_is_held(sk));
- opt = ipv6_renew_options(sk, opt, optname,
- (struct ipv6_opt_hdr __user *)optval,
- optlen);
+ opt = ipv6_renew_options(sk, opt, optname, new);
+ kfree(new);
if (IS_ERR(opt)) {
retv = PTR_ERR(opt);
break;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 144/217] net: qrtr: Broadcast messages only from control port
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 143/217] ipv6: make ipv6_renew_options() interrupt/kernel safe Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 145/217] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool Greg Kroah-Hartman
` (68 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arun Kumar Neelakantam,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Kumar Neelakantam <aneela@codeaurora.org>
[ Upstream commit fdf5fd3975666804118e62c69de25dc85cc0909c ]
The broadcast node id should only be sent with the control port id.
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/qrtr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -710,6 +710,10 @@ static int qrtr_sendmsg(struct socket *s
node = NULL;
if (addr->sq_node == QRTR_NODE_BCAST) {
enqueue_fn = qrtr_bcast_enqueue;
+ if (addr->sq_port != QRTR_PORT_CTRL) {
+ release_sock(sk);
+ return -ENOTCONN;
+ }
} else if (addr->sq_node == ipc->us.sq_node) {
enqueue_fn = qrtr_local_enqueue;
} else {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 145/217] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 144/217] net: qrtr: Broadcast messages only from control port Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 146/217] sh_eth: fix invalid context bug while changing link options " Greg Kroah-Hartman
` (67 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 53a710b5044d8475faa6813000b6dd659400ef7b ]
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however the helper function is
called in atomic context.
The bug can be reproduced by running "ethtool -r" command, the bug
is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2156,18 +2156,10 @@ static void sh_eth_get_regs(struct net_d
static int sh_eth_nway_reset(struct net_device *ndev)
{
- struct sh_eth_private *mdp = netdev_priv(ndev);
- unsigned long flags;
- int ret;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&mdp->lock, flags);
- ret = phy_start_aneg(ndev->phydev);
- spin_unlock_irqrestore(&mdp->lock, flags);
-
- return ret;
+ return phy_start_aneg(ndev->phydev);
}
static u32 sh_eth_get_msglevel(struct net_device *ndev)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 146/217] sh_eth: fix invalid context bug while changing link options by ethtool
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 145/217] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 147/217] ravb: fix invalid context bug while calling auto-negotiation " Greg Kroah-Hartman
` (66 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 5cb3f52a11e18628fc4bee76dd14b1f0b76349de ]
The change fixes sleep in atomic context bug, which is encountered
every time when link settings are changed by ethtool.
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however that helper function is
called in atomic context under a grabbed spinlock, because
phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
replaced phy_ethtool_sset() helpers from phylib.
Now duplex mode setting is enforced in sh_eth_adjust_link() only,
also now RX/TX is disabled when link is put down or modifications
to E-MAC registers ECMR and GECMR are expected for both cases of
checked and ignored link status pin state from E-MAC interrupt handler.
For reference the change is a partial rework of commit 1e1b812bbe10
("sh_eth: fix handling of no LINK signal").
Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 49 ++++++++++------------------------
1 file changed, 15 insertions(+), 34 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1821,8 +1821,15 @@ static void sh_eth_adjust_link(struct ne
{
struct sh_eth_private *mdp = netdev_priv(ndev);
struct phy_device *phydev = ndev->phydev;
+ unsigned long flags;
int new_state = 0;
+ spin_lock_irqsave(&mdp->lock, flags);
+
+ /* Disable TX and RX right over here, if E-MAC change is ignored */
+ if (mdp->cd->no_psr || mdp->no_ether_link)
+ sh_eth_rcv_snd_disable(ndev);
+
if (phydev->link) {
if (phydev->duplex != mdp->duplex) {
new_state = 1;
@@ -1841,18 +1848,21 @@ static void sh_eth_adjust_link(struct ne
sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
new_state = 1;
mdp->link = phydev->link;
- if (mdp->cd->no_psr || mdp->no_ether_link)
- sh_eth_rcv_snd_enable(ndev);
}
} else if (mdp->link) {
new_state = 1;
mdp->link = 0;
mdp->speed = 0;
mdp->duplex = -1;
- if (mdp->cd->no_psr || mdp->no_ether_link)
- sh_eth_rcv_snd_disable(ndev);
}
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
+ sh_eth_rcv_snd_enable(ndev);
+
+ mmiowb();
+ spin_unlock_irqrestore(&mdp->lock, flags);
+
if (new_state && netif_msg_link(mdp))
phy_print_status(phydev);
}
@@ -1933,39 +1943,10 @@ static int sh_eth_get_link_ksettings(str
static int sh_eth_set_link_ksettings(struct net_device *ndev,
const struct ethtool_link_ksettings *cmd)
{
- struct sh_eth_private *mdp = netdev_priv(ndev);
- unsigned long flags;
- int ret;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&mdp->lock, flags);
-
- /* disable tx and rx */
- sh_eth_rcv_snd_disable(ndev);
-
- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
- if (ret)
- goto error_exit;
-
- if (cmd->base.duplex == DUPLEX_FULL)
- mdp->duplex = 1;
- else
- mdp->duplex = 0;
-
- if (mdp->cd->set_duplex)
- mdp->cd->set_duplex(ndev);
-
-error_exit:
- mdelay(1);
-
- /* enable tx and rx */
- sh_eth_rcv_snd_enable(ndev);
-
- spin_unlock_irqrestore(&mdp->lock, flags);
-
- return ret;
+ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
}
/* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 147/217] ravb: fix invalid context bug while calling auto-negotiation by ethtool
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 146/217] sh_eth: fix invalid context bug while changing link options " Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 148/217] ravb: fix invalid context bug while changing link options " Greg Kroah-Hartman
` (65 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 0973a4dd79fe56a3beecfcff675ba4c01df0b0c1 ]
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however the helper function is
called in atomic context.
The bug can be reproduced by running "ethtool -r" command, the bug
is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1131,15 +1131,10 @@ error_exit:
static int ravb_nway_reset(struct net_device *ndev)
{
- struct ravb_private *priv = netdev_priv(ndev);
int error = -ENODEV;
- unsigned long flags;
- if (ndev->phydev) {
- spin_lock_irqsave(&priv->lock, flags);
+ if (ndev->phydev)
error = phy_start_aneg(ndev->phydev);
- spin_unlock_irqrestore(&priv->lock, flags);
- }
return error;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 148/217] ravb: fix invalid context bug while changing link options by ethtool
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 147/217] ravb: fix invalid context bug while calling auto-negotiation " Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 149/217] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume Greg Kroah-Hartman
` (64 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 05925e52a7d379192a5fdff2c33710f573190ead ]
The change fixes sleep in atomic context bug, which is encountered
every time when link settings are changed by ethtool.
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however that helper function is
called in atomic context under a grabbed spinlock, because
phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
replaced phy_ethtool_sset() helpers from phylib.
Now duplex mode setting is enforced in ravb_adjust_link() only, also
now RX/TX is disabled when link is put down or modifications to E-MAC
registers ECMR and GECMR are expected for both cases of checked and
ignored link status pin state from E-MAC interrupt handler.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 49 +++++++++----------------------
1 file changed, 15 insertions(+), 34 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -959,6 +959,13 @@ static void ravb_adjust_link(struct net_
struct ravb_private *priv = netdev_priv(ndev);
struct phy_device *phydev = ndev->phydev;
bool new_state = false;
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->lock, flags);
+
+ /* Disable TX and RX right over here, if E-MAC change is ignored */
+ if (priv->no_avb_link)
+ ravb_rcv_snd_disable(ndev);
if (phydev->link) {
if (phydev->duplex != priv->duplex) {
@@ -976,18 +983,21 @@ static void ravb_adjust_link(struct net_
ravb_modify(ndev, ECMR, ECMR_TXF, 0);
new_state = true;
priv->link = phydev->link;
- if (priv->no_avb_link)
- ravb_rcv_snd_enable(ndev);
}
} else if (priv->link) {
new_state = true;
priv->link = 0;
priv->speed = 0;
priv->duplex = -1;
- if (priv->no_avb_link)
- ravb_rcv_snd_disable(ndev);
}
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+ if (priv->no_avb_link && phydev->link)
+ ravb_rcv_snd_enable(ndev);
+
+ mmiowb();
+ spin_unlock_irqrestore(&priv->lock, flags);
+
if (new_state && netif_msg_link(priv))
phy_print_status(phydev);
}
@@ -1094,39 +1104,10 @@ static int ravb_get_link_ksettings(struc
static int ravb_set_link_ksettings(struct net_device *ndev,
const struct ethtool_link_ksettings *cmd)
{
- struct ravb_private *priv = netdev_priv(ndev);
- unsigned long flags;
- int error;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&priv->lock, flags);
-
- /* Disable TX and RX */
- ravb_rcv_snd_disable(ndev);
-
- error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
- if (error)
- goto error_exit;
-
- if (cmd->base.duplex == DUPLEX_FULL)
- priv->duplex = 1;
- else
- priv->duplex = 0;
-
- ravb_set_duplex(ndev);
-
-error_exit:
- mdelay(1);
-
- /* Enable TX and RX */
- ravb_rcv_snd_enable(ndev);
-
- mmiowb();
- spin_unlock_irqrestore(&priv->lock, flags);
-
- return error;
+ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
}
static int ravb_nway_reset(struct net_device *ndev)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 149/217] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 148/217] ravb: fix invalid context bug while changing link options " Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 150/217] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used Greg Kroah-Hartman
` (63 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Robert Jarzmik, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <daniel@zonque.org>
[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ]
PXA3xx platforms have 56 interrupts that are stored in two ICMR
registers. The code in pxa_irq_suspend() and pxa_irq_resume() however
does a simple division by 32 which only leads to one register being
saved at suspend and restored at resume time. The NAND interrupt
setting, for instance, is lost.
Fix this by using DIV_ROUND_UP() instead.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-pxa/irq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
{
int i;
- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
void __iomem *base = irq_base(i);
saved_icmr[i] = __raw_readl(base + ICMR);
@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
{
int i;
- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
void __iomem *base = irq_base(i);
__raw_writel(saved_icmr[i], base + ICMR);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 150/217] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 149/217] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 151/217] nvmem: Dont let a NULL cell_id for nvmem_cell_get() crash us Greg Kroah-Hartman
` (62 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Davide Caratti, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <dcaratti@redhat.com>
[ Upstream commit 38230a3e0e0933bbcf5df6fa469ba0667f667568 ]
the control action in the common member of struct tcf_tunnel_key must be a
valid value, as it can contain the chain index when 'goto chain' is used.
Ensure that the control action can be read as x->tcfa_action, when x is a
pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to
prevent the following command:
# tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
> $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1
from causing a NULL dereference when a matching packet is received:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 3491 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421
Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Call Trace:
<IRQ>
fl_classify+0x1ad/0x1c0 [cls_flower]
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? update_load_avg+0x665/0x690
? update_load_avg+0x665/0x690
? kmem_cache_alloc+0x38/0x1c0
tcf_classify+0x89/0x140
__netif_receive_skb_core+0x5ea/0xb70
? enqueue_entity+0xd0/0x270
? process_backlog+0x97/0x150
process_backlog+0x97/0x150
net_rx_action+0x14b/0x3e0
__do_softirq+0xde/0x2b4
do_softirq_own_stack+0x2a/0x40
</IRQ>
do_softirq.part.18+0x49/0x50
__local_bh_enable_ip+0x49/0x50
__dev_queue_xmit+0x4ab/0x8a0
? wait_woken+0x80/0x80
? packet_sendmsg+0x38f/0x810
? __dev_queue_xmit+0x8a0/0x8a0
packet_sendmsg+0x38f/0x810
sock_sendmsg+0x36/0x40
__sys_sendto+0x10e/0x140
? do_vfs_ioctl+0xa4/0x630
? syscall_trace_enter+0x1df/0x2e0
? __audit_syscall_exit+0x22a/0x290
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x5b/0x180
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fd67e18dc93
Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93
RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003
RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003
Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me
mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca
CR2: 0000000000000000
---[ end trace 1ab8b5b5d4639dfc ]---
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tc_act/tc_tunnel_key.h | 1 -
net/sched/act_tunnel_key.c | 6 +++---
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/include/net/tc_act/tc_tunnel_key.h
+++ b/include/net/tc_act/tc_tunnel_key.h
@@ -18,7 +18,6 @@
struct tcf_tunnel_key_params {
struct rcu_head rcu;
int tcft_action;
- int action;
struct metadata_dst *tcft_enc_metadata;
};
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff
tcf_lastuse_update(&t->tcf_tm);
bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
- action = params->action;
+ action = READ_ONCE(t->tcf_action);
switch (params->tcft_action) {
case TCA_TUNNEL_KEY_ACT_RELEASE:
@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *n
params_old = rtnl_dereference(t->params);
- params_new->action = parm->action;
+ t->tcf_action = parm->action;
params_new->tcft_action = parm->t_action;
params_new->tcft_enc_metadata = metadata;
@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buf
.index = t->tcf_index,
.refcnt = t->tcf_refcnt - ref,
.bindcnt = t->tcf_bindcnt - bind,
+ .action = t->tcf_action,
};
struct tcf_t tm;
params = rtnl_dereference(t->params);
opt.t_action = params->tcft_action;
- opt.action = params->action;
if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 151/217] nvmem: Dont let a NULL cell_id for nvmem_cell_get() crash us
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 150/217] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 152/217] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
` (61 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Douglas Anderson,
Srinivas Kandagatla, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 87ed1405ef09d29a14df43295f7b6a93b63bfe6e ]
In commit ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on
Qcom chips") you can see a call like:
devm_nvmem_cell_get(dev, NULL);
Note that the cell ID passed to the function is NULL. This is because
the qcom-qusb2 driver is expected to work only on systems where the
PHY node is hooked up via device-tree and is nameless.
This works OK for the most part. The first thing nvmem_cell_get()
does is to call of_nvmem_cell_get() and there it's documented that a
NULL name is fine. The problem happens when the call to
of_nvmem_cell_get() returns -EINVAL. In such a case we'll fall back
to nvmem_cell_get_from_list() and eventually might (if nvmem_cells
isn't an empty list) crash with something that looks like:
strcmp
nvmem_find_cell
__nvmem_device_get
nvmem_cell_get_from_list
nvmem_cell_get
devm_nvmem_cell_get
qusb2_phy_probe
There are several different ways we could fix this problem:
One could argue that perhaps the qcom-qusb2 driver should be changed
to use of_nvmem_cell_get() which is allowed to have a NULL name. In
that case, we'd need to add a patche to introduce
devm_of_nvmem_cell_get() since the qcom-qusb2 driver is using devm
managed resources.
One could also argue that perhaps we could just add a name to
qcom-qusb2. That would be OK but I believe it effectively changes the
device tree bindings, so maybe it's a no-go.
In this patch I have chosen to fix the problem by simply not crashing
when a NULL cell_id is passed to nvmem_cell_get().
NOTE: that for the qcom-qusb2 driver the "nvmem-cells" property is
defined to be optional and thus it's expected to be a common case that
we would hit this crash and this is more than just a theoretical fix.
Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -865,6 +865,10 @@ struct nvmem_cell *nvmem_cell_get(struct
return cell;
}
+ /* NULL cell_id only allowed for device tree; invalid otherwise */
+ if (!cell_id)
+ return ERR_PTR(-EINVAL);
+
return nvmem_cell_get_from_list(cell_id);
}
EXPORT_SYMBOL_GPL(nvmem_cell_get);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 152/217] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 151/217] nvmem: Dont let a NULL cell_id for nvmem_cell_get() crash us Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 153/217] ieee802154: at86rf230: use __func__ macro for debug messages Greg Kroah-Hartman
` (60 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 20f330452ad8814f2289a589baf65e21270879a7 ]
The check is valid but it does not warrant to crash the kernel. A
WARN_ON() is good enough here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/at86rf230.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw,
static int
at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
{
- BUG_ON(!level);
+ WARN_ON(!level);
*level = 0xbe;
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 153/217] ieee802154: at86rf230: use __func__ macro for debug messages
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 152/217] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 154/217] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
` (59 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 8a81388ec27c4c0adbdecd20e67bb5f411ab46b2 ]
Instead of having the function name hard-coded (it might change and we
forgot to update them in the debug output) we can use __func__ instead
and also shorter the line so we do not need to break it. Also fix an
extra blank line while being here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/at86rf230.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
u16 addr = le16_to_cpu(filt->short_addr);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for saddr\n");
+ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
__at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
__at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
}
@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
if (changed & IEEE802154_AFILT_PANID_CHANGED) {
u16 pan = le16_to_cpu(filt->pan_id);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for pan id\n");
+ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
__at86rf230_write(lp, RG_PAN_ID_0, pan);
__at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
}
@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee80
u8 i, addr[8];
memcpy(addr, &filt->ieee_addr, 8);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for IEEE addr\n");
+ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
for (i = 0; i < 8; i++)
__at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
}
if (changed & IEEE802154_AFILT_PANC_CHANGED) {
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for panc change\n");
+ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
if (filt->pan_coord)
at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
else
@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154
return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
}
-
static int
at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
{
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 154/217] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 153/217] ieee802154: at86rf230: use __func__ macro for debug messages Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 155/217] gpu: host1x: Check whether size of unpin isnt 0 Greg Kroah-Hartman
` (58 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 8f2fbc6c60ff213369e06a73610fc882a42fdf20 ]
The check is valid but it does not warrant to crash the kernel. A
WARN_ON() is good enough here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/fakelb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ieee802154/fakelb.c
+++ b/drivers/net/ieee802154/fakelb.c
@@ -49,7 +49,7 @@ struct fakelb_phy {
static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
{
- BUG_ON(!level);
+ WARN_ON(!level);
*level = 0xbe;
return 0;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 155/217] gpu: host1x: Check whether size of unpin isnt 0
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 154/217] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 156/217] drm/tegra: Fix comparison operator for buffer size Greg Kroah-Hartman
` (57 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Osipenko <digetx@gmail.com>
[ Upstream commit ec58923215dbbeef59ee82923ee94d745f73db58 ]
Only gather pins are mapped by the Host1x driver, regular BO relocations
are not. Check whether size of unpin isn't 0, otherwise IOVA allocation at
0x0 could be erroneously released.
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/host1x/job.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -686,7 +686,8 @@ void host1x_job_unpin(struct host1x_job
for (i = 0; i < job->num_unpins; i++) {
struct host1x_job_unpin_data *unpin = &job->unpins[i];
- if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
+ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
+ unpin->size && host->domain) {
iommu_unmap(host->domain, job->addr_phys[i],
unpin->size);
free_iova(&host->iova,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 156/217] drm/tegra: Fix comparison operator for buffer size
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 155/217] gpu: host1x: Check whether size of unpin isnt 0 Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 157/217] drm/armada: fix colorkey mode property Greg Kroah-Hartman
` (56 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikko Perttunen, Dmitry Osipenko,
Thierry Reding, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 5265f0338bc0feec6c0d544dfe005dec1a93cb93 ]
Here we are checking for the buffer length, not an offset for writing
to, so using > is correct. The current code incorrectly rejects a
command buffer ending at the memory buffer's end.
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/drm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -470,7 +470,7 @@ int tegra_drm_submit(struct tegra_drm_co
* unaligned offset is malformed and cause commands stream
* corruption on the buffer address relocation.
*/
- if (offset & 3 || offset >= obj->gem.size) {
+ if (offset & 3 || offset > obj->gem.size) {
err = -EINVAL;
goto fail;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 157/217] drm/armada: fix colorkey mode property
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 156/217] drm/tegra: Fix comparison operator for buffer size Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 158/217] drm/armada: fix irq handling Greg Kroah-Hartman
` (55 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ]
The colorkey mode property was not correctly disabling the colorkeying
when "disabled" mode was selected. Arrange for this to work as one
would expect.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/armada_hw.h | 1 +
drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++--------
2 files changed, 23 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/armada/armada_hw.h
+++ b/drivers/gpu/drm/armada/armada_hw.h
@@ -160,6 +160,7 @@ enum {
CFG_ALPHAM_GRA = 0x1 << 16,
CFG_ALPHAM_CFG = 0x2 << 16,
CFG_ALPHA_MASK = 0xff << 8,
+#define CFG_ALPHA(x) ((x) << 8)
CFG_PIXCMD_MASK = 0xff,
};
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties {
uint16_t contrast;
uint16_t saturation;
uint32_t colorkey_mode;
+ uint32_t colorkey_enable;
};
struct armada_ovl_plane {
@@ -59,11 +60,13 @@ armada_ovl_update_attr(struct armada_ovl
writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
spin_lock_irq(&dcrtc->irq_lock);
- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
- dcrtc->base + LCD_SPU_DMA_CTRL1);
-
- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
+ armada_updatel(prop->colorkey_mode,
+ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+ dcrtc->base + LCD_SPU_DMA_CTRL1);
+ if (dcrtc->variant->has_spu_adv_reg)
+ armada_updatel(prop->colorkey_enable,
+ ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
+ dcrtc->base + LCD_SPU_ADV_REG);
spin_unlock_irq(&dcrtc->irq_lock);
}
@@ -339,8 +342,17 @@ static int armada_ovl_plane_set_property
dplane->prop.colorkey_vb |= K2B(val);
update_attr = true;
} else if (property == priv->colorkey_mode_prop) {
- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
- dplane->prop.colorkey_mode |= CFG_CKMODE(val);
+ if (val == CKMODE_DISABLE) {
+ dplane->prop.colorkey_mode =
+ CFG_CKMODE(CKMODE_DISABLE) |
+ CFG_ALPHAM_CFG | CFG_ALPHA(255);
+ dplane->prop.colorkey_enable = 0;
+ } else {
+ dplane->prop.colorkey_mode =
+ CFG_CKMODE(val) |
+ CFG_ALPHAM_GRA | CFG_ALPHA(0);
+ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ }
update_attr = true;
} else if (property == priv->brightness_prop) {
dplane->prop.brightness = val - 256;
@@ -470,7 +482,9 @@ int armada_overlay_plane_create(struct d
dplane->prop.colorkey_yr = 0xfefefe00;
dplane->prop.colorkey_ug = 0x01010100;
dplane->prop.colorkey_vb = 0x01010100;
- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
+ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
+ CFG_ALPHAM_GRA | CFG_ALPHA(0);
+ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
dplane->prop.brightness = 0;
dplane->prop.contrast = 0x4000;
dplane->prop.saturation = 0x4000;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 158/217] drm/armada: fix irq handling
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 157/217] drm/armada: fix colorkey mode property Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 159/217] netfilter: nft_compat: explicitly reject ERROR and standard target Greg Kroah-Hartman
` (54 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
[ Upstream commit 92298c1cd8e8a6b56322b602ad72b54e6237631d ]
Add the missing locks to the IRQ enable/disable paths, and fix a comment
in the interrupt handler: reading the ISR clears down the status bits,
but does not reset the interrupt so it can signal again. That seems to
require a write.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/armada_crtc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -483,8 +483,9 @@ static irqreturn_t armada_drm_irq(int ir
u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
/*
- * This is rediculous - rather than writing bits to clear, we
- * have to set the actual status register value. This is racy.
+ * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR
+ * is set. Writing has some other effect to acknowledge the IRQ -
+ * without this, we only get a single IRQ.
*/
writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
@@ -1104,16 +1105,22 @@ armada_drm_crtc_set_property(struct drm_
static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc)
{
struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+ unsigned long flags;
+ spin_lock_irqsave(&dcrtc->irq_lock, flags);
armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA);
+ spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
return 0;
}
static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc)
{
struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+ unsigned long flags;
+ spin_lock_irqsave(&dcrtc->irq_lock, flags);
armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA);
+ spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
}
static const struct drm_crtc_funcs armada_crtc_funcs = {
@@ -1221,6 +1228,7 @@ static int armada_drm_crtc_create(struct
CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1);
writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1);
writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA);
+ readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 159/217] netfilter: nft_compat: explicitly reject ERROR and standard target
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 158/217] drm/armada: fix irq handling Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 160/217] netfilter: nf_conntrack: Fix possible possible crash on module loading Greg Kroah-Hartman
` (53 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 21d5e078192d244df3d6049f9464fff2f72cfd68 ]
iptables-nft never requests these, but make this explicitly illegal.
If it were quested, kernel could oops as ->eval is NULL, furthermore,
the builtin targets have no owning module so its possible to rmmod
eb/ip/ip6_tables module even if they would be loaded.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_compat.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -825,10 +825,18 @@ nft_target_select_ops(const struct nft_c
rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
family = ctx->afi->family;
+ if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
+ strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
+ strcmp(tg_name, "standard") == 0)
+ return ERR_PTR(-EINVAL);
+
/* Re-use the existing target if it's already loaded. */
list_for_each_entry(nft_target, &nft_target_list, head) {
struct xt_target *target = nft_target->ops.data;
+ if (!target->target)
+ continue;
+
if (nft_target_cmp(target, tg_name, rev, family))
return &nft_target->ops;
}
@@ -837,6 +845,11 @@ nft_target_select_ops(const struct nft_c
if (IS_ERR(target))
return ERR_PTR(-ENOENT);
+ if (!target->target) {
+ err = -EINVAL;
+ goto err;
+ }
+
if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
err = -EINVAL;
goto err;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 160/217] netfilter: nf_conntrack: Fix possible possible crash on module loading.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (149 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 159/217] netfilter: nft_compat: explicitly reject ERROR and standard target Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 161/217] ARC: Improve cmpxchg syscall implementation Greg Kroah-Hartman
` (52 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Ryabinin, Pablo Neira Ayuso,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
[ Upstream commit 2045cdfa1b40d66f126f3fd05604fc7c754f0022 ]
Loading the nf_conntrack module with doubled hashsize parameter, i.e.
modprobe nf_conntrack hashsize=12345 hashsize=12345
causes NULL-ptr deref.
If 'hashsize' specified twice, the nf_conntrack_set_hashsize() function
will be called also twice.
The first nf_conntrack_set_hashsize() call will set the
'nf_conntrack_htable_size' variable:
nf_conntrack_set_hashsize()
...
/* On boot, we can set this without any fancy locking. */
if (!nf_conntrack_htable_size)
return param_set_uint(val, kp);
But on the second invocation, the nf_conntrack_htable_size is already set,
so the nf_conntrack_set_hashsize() will take a different path and call
the nf_conntrack_hash_resize() function. Which will crash on the attempt
to dereference 'nf_conntrack_hash' pointer:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
RIP: 0010:nf_conntrack_hash_resize+0x255/0x490 [nf_conntrack]
Call Trace:
nf_conntrack_set_hashsize+0xcd/0x100 [nf_conntrack]
parse_args+0x1f9/0x5a0
load_module+0x1281/0x1a50
__se_sys_finit_module+0xbe/0xf0
do_syscall_64+0x7c/0x390
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this, by checking !nf_conntrack_hash instead of
!nf_conntrack_htable_size. nf_conntrack_hash will be initialized only
after the module loaded, so the second invocation of the
nf_conntrack_set_hashsize() won't crash, it will just reinitialize
nf_conntrack_htable_size again.
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1949,7 +1949,7 @@ int nf_conntrack_set_hashsize(const char
return -EOPNOTSUPP;
/* On boot, we can set this without any fancy locking. */
- if (!nf_conntrack_htable_size)
+ if (!nf_conntrack_hash)
return param_set_uint(val, kp);
rc = kstrtouint(val, 0, &hashsize);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 161/217] ARC: Improve cmpxchg syscall implementation
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (150 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 160/217] netfilter: nf_conntrack: Fix possible possible crash on module loading Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 162/217] bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic Greg Kroah-Hartman
` (51 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Filippov, linux-arch,
Alexey Brodkin, Peter Zijlstra, Vineet Gupta, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit e8708786d4fe21c043d38d760f768949a3d71185 ]
This is used in configs lacking hardware atomics to emulate atomic r-m-w
for user space, implemented by disabling preemption in kernel.
However there are issues in current implementation:
1. Process not terminated if invalid user pointer passed:
i.e. __get_user() failed.
2. The reason for this patch was __put_user() failure not being handled
either, specifically for the COW break scenario.
The zero page is initially wired up and read from __get_user()
succeeds. A subsequent write by __put_user() induces a
Protection Violation, but COW can't finish as Linux page fault
handler is disabled due to preempt disable.
And what's worse is we silently return the stale value to user space.
Fix this specific case by re-enabling preemption and explicitly
fixing up the fault and retrying the whole sequence over.
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: linux-arch@vger.kernel.org
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
[vgupta: rewrote the changelog]
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/kernel/process.c | 47 +++++++++++++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 11 deletions(-)
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls)
SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
{
struct pt_regs *regs = current_pt_regs();
- int uval = -EFAULT;
+ u32 uval;
+ int ret;
/*
* This is only for old cores lacking LLOCK/SCOND, which by defintion
@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *,
/* Z indicates to userspace if operation succeded */
regs->status32 &= ~STATUS_Z_MASK;
- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
- return -EFAULT;
+ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
+ if (!ret)
+ goto fail;
+again:
preempt_disable();
- if (__get_user(uval, uaddr))
- goto done;
+ ret = __get_user(uval, uaddr);
+ if (ret)
+ goto fault;
- if (uval == expected) {
- if (!__put_user(new, uaddr))
- regs->status32 |= STATUS_Z_MASK;
- }
+ if (uval != expected)
+ goto out;
-done:
- preempt_enable();
+ ret = __put_user(new, uaddr);
+ if (ret)
+ goto fault;
+
+ regs->status32 |= STATUS_Z_MASK;
+out:
+ preempt_enable();
return uval;
+
+fault:
+ preempt_enable();
+
+ if (unlikely(ret != -EFAULT))
+ goto fail;
+
+ down_read(¤t->mm->mmap_sem);
+ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
+ FAULT_FLAG_WRITE, NULL);
+ up_read(¤t->mm->mmap_sem);
+
+ if (likely(!ret))
+ goto again;
+
+fail:
+ force_sig(SIGSEGV, current);
+ return ret;
}
#ifdef CONFIG_ISA_ARCV2
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 162/217] bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic.
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (151 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 161/217] ARC: Improve cmpxchg syscall implementation Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 163/217] bnxt_en: Always set output parameters in bnxt_get_max_rings() Greg Kroah-Hartman
` (50 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <michael.chan@broadcom.com>
[ Upstream commit 07f4fde53d12eb8d921b465bb298e964e0bdc38c ]
If there aren't enough RX rings available, the driver will attempt to
use a single RX ring without the aggregation ring. If that also
fails, the BNXT_FLAG_AGG_RINGS flag is cleared but the other ring
parameters are not set consistently to reflect that. If more RX
rings become available at the next open, the RX rings will be in
an inconsistent state and may crash when freeing the RX rings.
Fix it by restoring the BNXT_FLAG_AGG_RINGS if not enough RX rings are
available to run without aggregation rings.
Fixes: bdbd1eb59c56 ("bnxt_en: Handle no aggregation ring gracefully.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7884,8 +7884,11 @@ static int bnxt_get_dflt_rings(struct bn
/* Not enough rings, try disabling agg rings. */
bp->flags &= ~BNXT_FLAG_AGG_RINGS;
rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
- if (rc)
+ if (rc) {
+ /* set BNXT_FLAG_AGG_RINGS back for consistency */
+ bp->flags |= BNXT_FLAG_AGG_RINGS;
return rc;
+ }
bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
bp->dev->hw_features &= ~NETIF_F_LRO;
bp->dev->features &= ~NETIF_F_LRO;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 163/217] bnxt_en: Always set output parameters in bnxt_get_max_rings().
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (152 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 162/217] bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 164/217] bnxt_en: Fix for system hang if request_irq fails Greg Kroah-Hartman
` (49 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <michael.chan@broadcom.com>
[ Upstream commit 78f058a4aa0f2280dc4d45d2c4a95728398ef857 ]
The current code returns -ENOMEM and does not bother to set the output
parameters to 0 when no rings are available. Some callers, such as
bnxt_get_channels() will display garbage ring numbers when that happens.
Fix it by always setting the output parameters.
Fixes: 6e6c5a57fbe1 ("bnxt_en: Modify bnxt_get_max_rings() to support shared or non shared rings.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7866,11 +7866,11 @@ int bnxt_get_max_rings(struct bnxt *bp,
int rx, tx, cp;
_bnxt_get_max_rings(bp, &rx, &tx, &cp);
+ *max_rx = rx;
+ *max_tx = tx;
if (!rx || !tx || !cp)
return -ENOMEM;
- *max_rx = rx;
- *max_tx = tx;
return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 164/217] bnxt_en: Fix for system hang if request_irq fails
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (153 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 163/217] bnxt_en: Always set output parameters in bnxt_get_max_rings() Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 165/217] scsi: qedf: Send the driver state to MFW Greg Kroah-Hartman
` (48 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vikas Gupta, Michael Chan,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikas Gupta <vikas.gupta@broadcom.com>
[ Upstream commit c58387ab1614f6d7fb9e244f214b61e7631421fc ]
Fix bug in the error code path when bnxt_request_irq() returns failure.
bnxt_disable_napi() should not be called in this error path because
NAPI has not been enabled yet.
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6348,7 +6348,7 @@ static int __bnxt_open_nic(struct bnxt *
rc = bnxt_request_irq(bp);
if (rc) {
netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
- goto open_err;
+ goto open_err_irq;
}
}
@@ -6386,6 +6386,8 @@ static int __bnxt_open_nic(struct bnxt *
open_err:
bnxt_disable_napi(bp);
+
+open_err_irq:
bnxt_del_napi(bp);
open_err_free_mem:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 165/217] scsi: qedf: Send the driver state to MFW
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (154 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 164/217] bnxt_en: Fix for system hang if request_irq fails Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 166/217] scsi: qedi: Send " Greg Kroah-Hartman
` (47 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Saurav Kashyap, Chad Dupuis,
Martin K. Petersen, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <saurav.kashyap@cavium.com>
[ Upstream commit 6ac174756dfc9884f08b23af840ca911155f5578 ]
Need to notify firmware when driver is loaded and unloaded.
Signed-off-by: Saurav Kashyap <saurav.kashyap@cavium.com>
Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qedf/qedf_main.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -3240,6 +3240,11 @@ static int __qedf_probe(struct pci_dev *
init_completion(&qedf->flogi_compl);
+ status = qed_ops->common->update_drv_state(qedf->cdev, true);
+ if (status)
+ QEDF_ERR(&(qedf->dbg_ctx),
+ "Failed to send drv state to MFW.\n");
+
memset(&link_params, 0, sizeof(struct qed_link_params));
link_params.link_up = true;
status = qed_ops->common->set_link(qedf->cdev, &link_params);
@@ -3288,6 +3293,7 @@ static int qedf_probe(struct pci_dev *pd
static void __qedf_remove(struct pci_dev *pdev, int mode)
{
struct qedf_ctx *qedf;
+ int rc;
if (!pdev) {
QEDF_ERR(NULL, "pdev is NULL.\n");
@@ -3382,6 +3388,12 @@ static void __qedf_remove(struct pci_dev
qed_ops->common->set_power_state(qedf->cdev, PCI_D0);
pci_set_drvdata(pdev, NULL);
}
+
+ rc = qed_ops->common->update_drv_state(qedf->cdev, false);
+ if (rc)
+ QEDF_ERR(&(qedf->dbg_ctx),
+ "Failed to send drv state to MFW.\n");
+
qed_ops->common->slowpath_stop(qedf->cdev);
qed_ops->common->remove(qedf->cdev);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 166/217] scsi: qedi: Send driver state to MFW
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (155 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 165/217] scsi: qedf: Send the driver state to MFW Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 167/217] perf llvm-utils: Remove bashism from kernel include fetch script Greg Kroah-Hartman
` (46 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manish Rangankar, Martin K. Petersen,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <manish.rangankar@cavium.com>
[ Upstream commit a3440d0d2f57f7ba102fc332086961cf261180af ]
In case of iSCSI offload BFS environment, MFW requires to mark virtual
link based upon qedi load status.
Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qedi/qedi_main.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2087,6 +2087,7 @@ kset_free:
static void __qedi_remove(struct pci_dev *pdev, int mode)
{
struct qedi_ctx *qedi = pci_get_drvdata(pdev);
+ int rval;
if (qedi->tmf_thread) {
flush_workqueue(qedi->tmf_thread);
@@ -2116,6 +2117,10 @@ static void __qedi_remove(struct pci_dev
if (mode == QEDI_MODE_NORMAL)
qedi_free_iscsi_pf_param(qedi);
+ rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
+ if (rval)
+ QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n");
+
if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) {
qedi_ops->common->slowpath_stop(qedi->cdev);
qedi_ops->common->remove(qedi->cdev);
@@ -2390,6 +2395,12 @@ static int __qedi_probe(struct pci_dev *
if (qedi_setup_boot_info(qedi))
QEDI_ERR(&qedi->dbg_ctx,
"No iSCSI boot target configured\n");
+
+ rc = qedi_ops->common->update_drv_state(qedi->cdev, true);
+ if (rc)
+ QEDI_ERR(&qedi->dbg_ctx,
+ "Failed to send drv state to MFW\n");
+
}
return 0;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 167/217] perf llvm-utils: Remove bashism from kernel include fetch script
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (156 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 166/217] scsi: qedi: Send " Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 169/217] perf script python: Fix dict reference counting Greg Kroah-Hartman
` (45 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kim Phillips, Alexander Shishkin,
Hendrik Brueckner, Jiri Olsa, Michael Petlan, Namhyung Kim,
Peter Zijlstra, Sandipan Das, Thomas Richter,
Arnaldo Carvalho de Melo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@arm.com>
[ Upstream commit f6432b9f65001651412dbc3589d251534822d4ab ]
Like system(), popen() calls /bin/sh, which may/may not be bash.
Script when run on dash and encounters the line, yields:
exit: Illegal number: -1
checkbashisms report on script content:
possible bashism (exit|return with negative status code):
exit -1
Remove the bashism and use the more portable non-zero failure
status code 1.
Signed-off-by: Kim Phillips <kim.phillips@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20180629124652.8d0af7e2281fd3fd8262cacc@arm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/llvm-utils.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -265,16 +265,16 @@ static const char *kinc_fetch_script =
"#!/usr/bin/env sh\n"
"if ! test -d \"$KBUILD_DIR\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"TMPDIR=`mktemp -d`\n"
"if test -z \"$TMPDIR\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"cat << EOF > $TMPDIR/Makefile\n"
"obj-y := dummy.o\n"
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 169/217] perf script python: Fix dict reference counting
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (157 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 167/217] perf llvm-utils: Remove bashism from kernel include fetch script Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 170/217] nfit: fix unchecked dereference in acpi_nfit_ctl Greg Kroah-Hartman
` (44 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Janne Huttunen, Jiri Olsa,
Namhyung Kim, Alexander Shishkin, Andi Kleen, Jaroslav Skarvada,
Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Huttunen <janne.huttunen@nokia.com>
[ Upstream commit db0ba84c04ef2cf293aaada5ae97531127844d9d ]
The dictionaries are attached to the parameter tuple that steals the
references and takes care of releasing them when appropriate. The code
should not decrement the reference counts explicitly. E.g. if libpython
has been built with reference debugging enabled, the superfluous DECREFs
will trigger this error when running perf script:
Fatal Python error: Objects/tupleobject.c:238 object at
0x7f10f2041b40 has negative ref count -1
Aborted (core dumped)
If the reference debugging is not enabled, the superfluous DECREFs might
cause the dict objects to be silently released while they are still in
use. This may trigger various other assertions or just cause perf
crashes and/or weird and unexpected data changes in the stored Python
objects.
Signed-off-by: Janne Huttunen <janne.huttunen@nokia.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jaroslav Skarvada <jskarvad@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1531133990-17485-1-git-send-email-janne.huttunen@nokia.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/scripting-engines/trace-event-python.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -643,14 +643,11 @@ static void python_process_tracepoint(st
if (_PyTuple_Resize(&t, n) == -1)
Py_FatalError("error resizing Python tuple");
- if (!dict) {
+ if (!dict)
call_object(handler, t, handler_name);
- } else {
+ else
call_object(handler, t, default_handler_name);
- Py_DECREF(dict);
- }
- Py_XDECREF(all_entries_dict);
Py_DECREF(t);
}
@@ -970,7 +967,6 @@ static void python_process_general_event
call_object(handler, t, handler_name);
- Py_DECREF(dict);
Py_DECREF(t);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 170/217] nfit: fix unchecked dereference in acpi_nfit_ctl
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (158 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 169/217] perf script python: Fix dict reference counting Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 171/217] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path Greg Kroah-Hartman
` (43 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Jiang, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit ee6581ceba7f8314b81b2f2a81f1cf3f67c679e2 ]
Incremental patch to fix the unchecked dereference in acpi_nfit_ctl.
Reported by Dan Carpenter:
"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to
always return a value" from Jun 28, 2018, leads to the following
Smatch complaint:
drivers/acpi/nfit/core.c:578 acpi_nfit_ctl()
warn: variable dereferenced before check 'cmd_rc' (see line 411)
drivers/acpi/nfit/core.c
410
411 *cmd_rc = -EINVAL;
^^^^^^^^^^^^^^^^^^
Patch adds unchecked dereference.
Fixes: c1985cefd844 ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -224,7 +224,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
const guid_t *guid;
int rc, i;
- *cmd_rc = -EINVAL;
+ if (cmd_rc)
+ *cmd_rc = -EINVAL;
func = cmd;
if (cmd == ND_CMD_CALL) {
call_pkg = buf;
@@ -315,7 +316,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
* If we return an error (like elsewhere) then caller wouldn't
* be able to rely upon data returned to make calculation.
*/
- *cmd_rc = 0;
+ if (cmd_rc)
+ *cmd_rc = 0;
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 171/217] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (159 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 170/217] nfit: fix unchecked dereference in acpi_nfit_ctl Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 172/217] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot Greg Kroah-Hartman
` (42 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kamal Heib, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Heib <kamalheib1@gmail.com>
[ Upstream commit d63c46734c545ad0488761059004a65c46efdde3 ]
Fix memory leak in the error path of mlx5_ib_create_srq() by making sure
to free the allocated srq.
Fixes: c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct
desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
- if (desc_size == 0 || srq->msrq.max_gs > desc_size)
- return ERR_PTR(-EINVAL);
+ if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
+ err = -EINVAL;
+ goto err_srq;
+ }
desc_size = roundup_pow_of_two(desc_size);
desc_size = max_t(size_t, 32, desc_size);
- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
- return ERR_PTR(-EINVAL);
+ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
+ err = -EINVAL;
+ goto err_srq;
+ }
srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
sizeof(struct mlx5_wqe_data_seg);
srq->msrq.wqe_shift = ilog2(desc_size);
buf_size = srq->msrq.max * desc_size;
- if (buf_size < desc_size)
- return ERR_PTR(-EINVAL);
+ if (buf_size < desc_size) {
+ err = -EINVAL;
+ goto err_srq;
+ }
in.type = init_attr->srq_type;
if (pd->uobject)
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 172/217] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (160 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 171/217] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 173/217] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores Greg Kroah-Hartman
` (41 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, Steven Rostedt (VMware),
Russell King, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
[ Upstream commit b4c7e2bd2eb4764afe3af9409ff3b1b87116fa30 ]
Dynamic ftrace requires modifying the code segments that are usually
set to read-only. To do this, a per arch function is called both before
and after the ftrace modifications are performed. The "before" function
will set kernel code text to read-write to allow for ftrace to make the
modifications, and the "after" function will set the kernel code text
back to "read-only" to keep the kernel code text protected.
The issue happens when dynamic ftrace is tested at boot up. The test is
done before the kernel code text has been set to read-only. But the
"before" and "after" calls are still performed. The "after" call will
change the kernel code text to read-only prematurely, and other boot
code that expects this code to be read-write will fail.
The solution is to add a variable that is set when the kernel code text
is expected to be converted to read-only, and make the ftrace "before"
and "after" calls do nothing if that variable is not yet set. This is
similar to the x86 solution from commit 162396309745 ("ftrace, x86:
make kernel text writable only for conversions").
Link: http://lkml.kernel.org/r/20180620212906.24b7b66e@vmware.local.home
Reported-by: Stefan Agner <stefan@agner.ch>
Tested-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/init.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -745,19 +745,28 @@ static int __mark_rodata_ro(void *unused
return 0;
}
+static int kernel_set_to_readonly __read_mostly;
+
void mark_rodata_ro(void)
{
+ kernel_set_to_readonly = 1;
stop_machine(__mark_rodata_ro, NULL, NULL);
}
void set_kernel_text_rw(void)
{
+ if (!kernel_set_to_readonly)
+ return;
+
set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
current->active_mm);
}
void set_kernel_text_ro(void)
{
+ if (!kernel_set_to_readonly)
+ return;
+
set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
current->active_mm);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 173/217] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (161 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 172/217] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 174/217] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller Greg Kroah-Hartman
` (40 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Tony Lindgren, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 2f8b5b21830aea95989a6e67d8a971297272a086 ]
Call secure services to enable ACTLR[0] (Enable invalidates of BTB with
ICIALLU) when branch hardening is enabled for kernel.
On GP devices OMAP5/DRA7, there is no possibility to update secure
side since "secure world" is ROM and there are no override mechanisms
possible. On HS devices, appropriate PPA should do the workarounds as
well.
However, the configuration is only done for secondary core, since it is
expected that firmware/bootloader will have enabled the required
configuration for the primary boot core (note: bootloaders typically
will NOT enable secondary processors, since it has no need to do so).
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap-smp.c | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(voi
static inline void omap5_erratum_workaround_801819(void) { }
#endif
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+/*
+ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
+ * ICIALLU) to activate the workaround for secondary Core.
+ * NOTE: it is assumed that the primary core's configuration is done
+ * by the boot loader (kernel will detect a misconfiguration and complain
+ * if this is not done).
+ *
+ * In General Purpose(GP) devices, ACR bit settings can only be done
+ * by ROM code in "secure world" using the smc call and there is no
+ * option to update the "firmware" on such devices. This also works for
+ * High security(HS) devices, as a backup option in case the
+ * "update" is not done in the "security firmware".
+ */
+static void omap5_secondary_harden_predictor(void)
+{
+ u32 acr, acr_mask;
+
+ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
+
+ /*
+ * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
+ */
+ acr_mask = BIT(0);
+
+ /* Do we already have it done.. if yes, skip expensive smc */
+ if ((acr & acr_mask) == acr_mask)
+ return;
+
+ acr |= acr_mask;
+ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
+
+ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
+ __func__, smp_processor_id());
+}
+#else
+static inline void omap5_secondary_harden_predictor(void) { }
+#endif
+
static void omap4_secondary_init(unsigned int cpu)
{
/*
@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigne
set_cntfreq();
/* Configure ACR to disable streaming WA for 801819 */
omap5_erratum_workaround_801819();
+ /* Enable ACR to allow for ICUALLU workaround */
+ omap5_secondary_harden_predictor();
}
/*
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 174/217] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (162 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 173/217] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 175/217] ixgbe: Be more careful when modifying MAC filters Greg Kroah-Hartman
` (39 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Ford, Tony Lindgren, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <aford173@gmail.com>
[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ]
The AM3517 has a different OTG controller location than the OMAP3,
which is included from omap3.dtsi. This results in a hwmod error.
Since the AM3517 has a different OTG controller address, this patch
disabes one that is isn't available.
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am3517.dtsi | 5 +++++
1 file changed, 5 insertions(+)
--- a/arch/arm/boot/dts/am3517.dtsi
+++ b/arch/arm/boot/dts/am3517.dtsi
@@ -87,6 +87,11 @@
};
};
+/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
+&usb_otg_hs {
+ status = "disabled";
+};
+
&iva {
status = "disabled";
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 175/217] ixgbe: Be more careful when modifying MAC filters
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (163 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 174/217] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 176/217] tools: build: Use HOSTLDFLAGS with fixdep Greg Kroah-Hartman
` (38 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Shannon Nelson,
Andrew Bowers, Jeff Kirsher, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <alexander.h.duyck@intel.com>
[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ]
This change makes it so that we are much more explicit about the ordering
of updates to the receive address register (RAR) table. Prior to this patch
I believe we may have been updating the table while entries were still
active, or possibly allowing for reordering of things since we weren't
explicitly flushing writes to either the lower or upper portion of the
register prior to accessing the other half.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Reviewed-by: Shannon Nelson <shannon.nelson@oracle.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1895,7 +1895,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h
if (enable_addr != 0)
rar_high |= IXGBE_RAH_AV;
+ /* Record lower 32 bits of MAC address and then make
+ * sure that write is flushed to hardware before writing
+ * the upper 16 bits and setting the valid bit.
+ */
IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+ IXGBE_WRITE_FLUSH(hw);
IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
return 0;
@@ -1927,8 +1932,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe
rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+ /* Clear the address valid bit and upper 16 bits of the address
+ * before clearing the lower bits. This way we aren't updating
+ * a live filter.
+ */
IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+ IXGBE_WRITE_FLUSH(hw);
+ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
/* clear VMDq pool/queue selection for this RAR */
hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 176/217] tools: build: Use HOSTLDFLAGS with fixdep
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (164 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 175/217] ixgbe: Be more careful when modifying MAC filters Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 178/217] packet: reset network header if packet shorter than ll reserved space Greg Kroah-Hartman
` (37 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laura Abbott, Jiri Olsa,
Masahiro Yamada, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@redhat.com>
[ Upstream commit 8b247a92ebd0cda7dec49a6f771d9c4950f3d3ad ]
The final link of fixdep uses LDFLAGS but not the existing HOSTLDFLAGS.
Fix this.
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/build/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/build/Makefile
+++ b/tools/build/Makefile
@@ -43,7 +43,7 @@ $(OUTPUT)fixdep-in.o: FORCE
$(Q)$(MAKE) $(build)=fixdep
$(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o
- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $<
+ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $<
FORCE:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 178/217] packet: reset network header if packet shorter than ll reserved space
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (165 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 176/217] tools: build: Use HOSTLDFLAGS with fixdep Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 179/217] qlogic: check kstrtoul() for errors Greg Kroah-Hartman
` (36 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Willem de Bruijn, David S. Miller,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 993675a3100b16a4c80dfd70cbcde8ea7127b31d ]
If variable length link layer headers result in a packet shorter
than dev->hard_header_len, reset the network header offset. Else
skb->mac_len may exceed skb->len after skb_mac_reset_len.
packet_sendmsg_spkt already has similar logic.
Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2919,6 +2919,8 @@ static int packet_snd(struct socket *soc
goto out_free;
} else if (reserve) {
skb_reserve(skb, -reserve);
+ if (len < reserve)
+ skb_reset_network_header(skb);
}
/* Returns -EFAULT on error */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 179/217] qlogic: check kstrtoul() for errors
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (166 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 178/217] packet: reset network header if packet shorter than ll reserved space Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 180/217] tcp: remove DELAYED ACK events in DCTCP Greg Kroah-Hartman
` (35 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ]
We accidentally left out the error handling for kstrtoul().
Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
ret = kstrtoul(buf, 16, &data);
+ if (ret)
+ return ret;
switch (data) {
case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 180/217] tcp: remove DELAYED ACK events in DCTCP
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (167 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 179/217] qlogic: check kstrtoul() for errors Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 181/217] pinctrl: ingenic: Fix inverted direction for < JZ4770 Greg Kroah-Hartman
` (34 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yuchung Cheng, Eric Dumazet,
Neal Cardwell, Lawrence Brakmo, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <ycheng@google.com>
[ Upstream commit a69258f7aa2623e0930212f09c586fd06674ad79 ]
After fixing the way DCTCP tracking delayed ACKs, the delayed-ACK
related callbacks are no longer needed
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 2 --
net/ipv4/tcp_dctcp.c | 25 -------------------------
net/ipv4/tcp_output.c | 4 ----
3 files changed, 31 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -938,8 +938,6 @@ enum tcp_ca_event {
CA_EVENT_LOSS, /* loss timeout */
CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */
CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */
- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */
- CA_EVENT_NON_DELAYED_ACK,
};
/* Information about inbound ACK, passed to cong_ops->in_ack_event() */
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -55,7 +55,6 @@ struct dctcp {
u32 dctcp_alpha;
u32 next_seq;
u32 ce_state;
- u32 delayed_ack_reserved;
u32 loss_cwnd;
};
@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
- ca->delayed_ack_reserved = 0;
ca->loss_cwnd = 0;
ca->ce_state = 0;
@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk,
}
}
-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
-{
- struct dctcp *ca = inet_csk_ca(sk);
-
- switch (ev) {
- case CA_EVENT_DELAYED_ACK:
- if (!ca->delayed_ack_reserved)
- ca->delayed_ack_reserved = 1;
- break;
- case CA_EVENT_NON_DELAYED_ACK:
- if (ca->delayed_ack_reserved)
- ca->delayed_ack_reserved = 0;
- break;
- default:
- /* Don't care for the rest. */
- break;
- }
-}
-
static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
{
switch (ev) {
@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock
case CA_EVENT_ECN_NO_CE:
dctcp_ce_state_1_to_0(sk);
break;
- case CA_EVENT_DELAYED_ACK:
- case CA_EVENT_NON_DELAYED_ACK:
- dctcp_update_ack_reserved(sk, ev);
- break;
default:
/* Don't care for the rest. */
break;
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3513,8 +3513,6 @@ void tcp_send_delayed_ack(struct sock *s
int ato = icsk->icsk_ack.ato;
unsigned long timeout;
- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
-
if (ato > TCP_DELACK_MIN) {
const struct tcp_sock *tp = tcp_sk(sk);
int max_ato = HZ / 2;
@@ -3571,8 +3569,6 @@ void __tcp_send_ack(struct sock *sk, u32
if (sk->sk_state == TCP_CLOSE)
return;
- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
-
/* We are not putting this on the write queue, so
* tcp_transmit_skb() will set the ownership to this
* sock.
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 181/217] pinctrl: ingenic: Fix inverted direction for < JZ4770
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (168 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 180/217] tcp: remove DELAYED ACK events in DCTCP Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 182/217] pinctrl: nsp: off by ones in nsp_pinmux_enable() Greg Kroah-Hartman
` (33 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Linus Walleij, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit 0084a786ca8c84b443f67c4a697b4f2552761650 ]
The .gpio_set_direction() callback was setting inverted direction
for SoCs older than the JZ4770, this restores the correct behaviour.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-ingenic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direc
ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input);
} else {
ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false);
- ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input);
+ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input);
ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 182/217] pinctrl: nsp: off by ones in nsp_pinmux_enable()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (169 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 181/217] pinctrl: ingenic: Fix inverted direction for < JZ4770 Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 183/217] pinctrl: nsp: Fix potential NULL dereference Greg Kroah-Hartman
` (32 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ray Jui,
Linus Walleij, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit f90a21c898db58eaea14b8ad7e9af3b9e15e5f8a ]
The > comparisons should be >= or else we read beyond the end of the
pinctrl->functions[] array.
Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinc
const struct nsp_pin_function *func;
const struct nsp_pin_group *grp;
- if (grp_select > pinctrl->num_groups ||
- func_select > pinctrl->num_functions)
+ if (grp_select >= pinctrl->num_groups ||
+ func_select >= pinctrl->num_functions)
return -EINVAL;
func = &pinctrl->functions[func_select];
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 183/217] pinctrl: nsp: Fix potential NULL dereference
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (170 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 182/217] pinctrl: nsp: off by ones in nsp_pinmux_enable() Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 184/217] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() Greg Kroah-Hartman
` (31 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Yongjun, Ray Jui, Linus Walleij,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit c29e9da56bebb4c2c794e871b0dc0298bbf08142 ]
platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.
This is detected by Coccinelle semantic patch.
@@
expression pdev, res, n, t, e, e1, e2;
@@
res = platform_get_resource(pdev, t, n);
+ if (!res)
+ return -EINVAL;
... when != res == NULL
e = devm_ioremap_nocache(e1, res->start, e2);
Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platf
return PTR_ERR(pinctrl->base0);
res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+ if (!res)
+ return -EINVAL;
pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
resource_size(res));
if (!pinctrl->base1) {
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 184/217] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (171 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 183/217] pinctrl: nsp: Fix potential NULL dereference Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 185/217] hv/netvsc: fix handling of fallback to single queue mode Greg Kroah-Hartman
` (30 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ben Skeggs, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 7f073d011f93e92d4d225526b9ab6b8b0bbd6613 ]
The bo array has req->nr_buffers elements so the > should be >= so we
don't read beyond the end of the array.
Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_gem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -599,7 +599,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
struct nouveau_bo *nvbo;
uint32_t data;
- if (unlikely(r->bo_index > req->nr_buffers)) {
+ if (unlikely(r->bo_index >= req->nr_buffers)) {
NV_PRINTK(err, cli, "reloc bo index invalid\n");
ret = -EINVAL;
break;
@@ -609,7 +609,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
if (b->presumed.valid)
continue;
- if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
+ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
NV_PRINTK(err, cli, "reloc container bo index invalid\n");
ret = -EINVAL;
break;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 185/217] hv/netvsc: fix handling of fallback to single queue mode
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (172 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 184/217] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.14 186/217] net/ethernet/freescale/fman: fix cross-build error Greg Kroah-Hartman
` (29 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Stephen Hemminger,
David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <stephen@networkplumber.org>
[ Upstream commit 916c5e1413be058d1c1f6e502db350df890730ce ]
The netvsc device may need to fallback to running in single queue
mode if host side only wants to support single queue.
Recent change for handling mtu broke this in setup logic.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 3ffe64f1a641 ("hv_netvsc: split sub-channel setup into async and sync")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/hyperv/rndis_filter.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1299,6 +1299,7 @@ out:
/* setting up multiple channels failed */
net_device->max_chn = 1;
net_device->num_chn = 1;
+ return 0;
err_dev_remv:
rndis_filter_device_remove(dev, net_device);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 186/217] net/ethernet/freescale/fman: fix cross-build error
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (173 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 185/217] hv/netvsc: fix handling of fallback to single queue mode Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 187/217] ibmvnic: Fix error recovery on login failure Greg Kroah-Hartman
` (28 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Madalin Bucur, netdev,
linuxppc-dev, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c133459765fae249ba482f62e12f987aec4376f0 ]
CC [M] drivers/net/ethernet/freescale/fman/fman.o
In file included from ../drivers/net/ethernet/freescale/fman/fman.c:35:
../include/linux/fsl/guts.h: In function 'guts_set_dmacr':
../include/linux/fsl/guts.h:165:2: error: implicit declaration of function 'clrsetbits_be32' [-Werror=implicit-function-declaration]
clrsetbits_be32(&guts->dmacr, 3 << shift, device << shift);
^~~~~~~~~~~~~~~
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Madalin Bucur <madalin.bucur@nxp.com>
Cc: netdev@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/fsl/guts.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/fsl/guts.h
+++ b/include/linux/fsl/guts.h
@@ -16,6 +16,7 @@
#define __FSL_GUTS_H__
#include <linux/types.h>
+#include <linux/io.h>
/**
* Global Utility Registers.
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 187/217] ibmvnic: Fix error recovery on login failure
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (174 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.14 186/217] net/ethernet/freescale/fman: fix cross-build error Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 188/217] btrfs: scrub: Dont use inode page cache in scrub_handle_errored_block() Greg Kroah-Hartman
` (27 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Allen, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Allen <jallen@linux.ibm.com>
[ Upstream commit 3578a7ecb69920efc3885dbd610e98c00dbdf5db ]
Testing has uncovered a failure case that is not handled properly. In the
event that a login fails and we are not able to recover on the spot, we
return 0 from do_reset, preventing any error recovery code from being
triggered. Additionally, the state is set to "probed" meaning that when we
are able to trigger the error recovery, the driver always comes up in the
probed state. To handle the case properly, we need to return a failure code
here and set the adapter state to the state that we entered the reset in
indicating the state that we would like to come out of the recovery reset
in.
Signed-off-by: John Allen <jallen@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1463,8 +1463,8 @@ static int do_reset(struct ibmvnic_adapt
rc = ibmvnic_login(netdev);
if (rc) {
- adapter->state = VNIC_PROBED;
- return 0;
+ adapter->state = reset_state;
+ return rc;
}
rc = reset_tx_pools(adapter);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 188/217] btrfs: scrub: Dont use inode page cache in scrub_handle_errored_block()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (175 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 187/217] ibmvnic: Fix error recovery on login failure Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 189/217] octeon_mgmt: Fix MIX registers configuration on MTU setup Greg Kroah-Hartman
` (26 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qu Wenruo, David Sterba, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade ]
In commit ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device
replace") we removed the branch of copy_nocow_pages() to avoid
corruption for compressed nodatasum extents.
However above commit only solves the problem in scrub_extent(), if
during scrub_pages() we failed to read some pages,
sctx->no_io_error_seen will be non-zero and we go to fixup function
scrub_handle_errored_block().
In scrub_handle_errored_block(), for sctx without csum (no matter if
we're doing replace or scrub) we go to scrub_fixup_nodatasum() routine,
which does the similar thing with copy_nocow_pages(), but does it
without the extra check in copy_nocow_pages() routine.
So for test cases like btrfs/100, where we emulate read errors during
replace/scrub, we could corrupt compressed extent data again.
This patch will fix it just by avoiding any "optimization" for
nodatasum, just falls back to the normal fixup routine by try read from
any good copy.
This also solves WARN_ON() or dead lock caused by lame backref iteration
in scrub_fixup_nodatasum() routine.
The deadlock or WARN_ON() won't be triggered before commit ac0b4145d662
("btrfs: scrub: Don't use inode pages for device replace") since
copy_nocow_pages() have better locking and extra check for data extent,
and it's already doing the fixup work by try to read data from any good
copy, so it won't go scrub_fixup_nodatasum() anyway.
This patch disables the faulty code and will be removed completely in a
followup patch.
Fixes: ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device replace")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/scrub.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1166,11 +1166,6 @@ static int scrub_handle_errored_block(st
return ret;
}
- if (sctx->is_dev_replace && !is_metadata && !have_csum) {
- sblocks_for_recheck = NULL;
- goto nodatasum_case;
- }
-
/*
* read all mirrors one after the other. This includes to
* re-read the extent or metadata block that failed (that was
@@ -1283,13 +1278,19 @@ static int scrub_handle_errored_block(st
goto out;
}
- if (!is_metadata && !have_csum) {
+ /*
+ * NOTE: Even for nodatasum case, it's still possible that it's a
+ * compressed data extent, thus scrub_fixup_nodatasum(), which write
+ * inode page cache onto disk, could cause serious data corruption.
+ *
+ * So here we could only read from disk, and hope our recovery could
+ * reach disk before the newer write.
+ */
+ if (0 && !is_metadata && !have_csum) {
struct scrub_fixup_nodatasum *fixup_nodatasum;
WARN_ON(sctx->is_dev_replace);
-nodatasum_case:
-
/*
* !is_metadata and !have_csum, this means that the data
* might not be COWed, that it might be modified
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 189/217] octeon_mgmt: Fix MIX registers configuration on MTU setup
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (176 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 188/217] btrfs: scrub: Dont use inode page cache in scrub_handle_errored_block() Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 190/217] net: usb: rtl8150: demote allmulti message to dev_dbg() Greg Kroah-Hartman
` (25 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin, David S. Miller,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@nsn.com>
[ Upstream commit 4aac0b43474d18f6160302a3caa147d77fa3baa1 ]
octeon_mgmt driver doesn't drop RX frames that are 1-4 bytes bigger than
MTU set for the corresponding interface. The problem is in the
AGL_GMX_RX0/1_FRM_MAX register setting, which should not account for VLAN
tagging.
According to Octeon HW manual:
"For tagged frames, MAX increases by four bytes for each VLAN found up to a
maximum of two VLANs, or MAX + 8 bytes."
OCTEON_FRAME_HEADER_LEN "define" is fine for ring buffer management, but
should not be used for AGL_GMX_RX0/1_FRM_MAX.
The problem could be easily reproduced using "ping" command. If affected
system has default MTU 1500, other host (having MTU >= 1504) can
successfully "ping" the affected system with payload size 1473-1476,
resulting in IP packets of size 1501-1504 accepted by the mgmt driver.
Fixed system still accepts IP packets of 1500 bytes even with VLAN tagging,
because the limits are lifted in HW as expected, for every VLAN tag.
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(s
static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
{
struct octeon_mgmt *p = netdev_priv(netdev);
- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
+ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
netdev->mtu = new_mtu;
- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
+ /* HW lifts the limit if the frame is VLAN tagged
+ * (+4 bytes per each tag, up to two tags)
+ */
+ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
+ /* Set the hardware to truncate packets larger than the MTU. The jabber
+ * register must be set to a multiple of 8 bytes, so round up. JABBER is
+ * an unconditional limit, so we need to account for two possible VLAN
+ * tags.
+ */
cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
- (size_without_fcs + 7) & 0xfff8);
+ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 190/217] net: usb: rtl8150: demote allmulti message to dev_dbg()
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (177 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 189/217] octeon_mgmt: Fix MIX registers configuration on MTU setup Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 191/217] kvmclock: fix TSC calibration for nested guests Greg Kroah-Hartman
` (24 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Lechner, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <david@lechnology.com>
[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ]
This driver can spam the kernel log with multiple messages of:
net eth0: eth0: allmulti set
Usually 4 or 8 at a time (probably because of using ConnMan).
This message doesn't seem useful, so let's demote it from dev_info()
to dev_dbg().
Signed-off-by: David Lechner <david@lechnology.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/rtl8150.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct
(netdev->flags & IFF_ALLMULTI)) {
rx_creg &= 0xfffe;
rx_creg |= 0x0002;
- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
} else {
/* ~RX_MULTICAST, ~RX_PROMISCUOUS */
rx_creg &= 0x00fc;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 191/217] kvmclock: fix TSC calibration for nested guests
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (178 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 190/217] net: usb: rtl8150: demote allmulti message to dev_dbg() Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 192/217] PCI: versatile: Fix I/O space page leak Greg Kroah-Hartman
` (23 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra, Peng Hao,
Paolo Bonzini, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Hao <peng.hao2@zte.com.cn>
[ Upstream commit e10f7805032365cc11c739a97f226ebb48aee042 ]
Inside a nested guest, access to hardware can be slow enough that
tsc_read_refs always return ULLONG_MAX, causing tsc_refine_calibration_work
to be called periodically and the nested guest to spend a lot of time
reading the ACPI timer.
However, if the TSC frequency is available from the pvclock page,
we can just set X86_FEATURE_TSC_KNOWN_FREQ and avoid the recalibration.
'refine' operation.
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Peng Hao <peng.hao2@zte.com.cn>
[Commit message rewritten. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kvmclock.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -143,6 +143,7 @@ static unsigned long kvm_get_tsc_khz(voi
src = &hv_clock[cpu].pvti;
tsc_khz = pvclock_tsc_khz(src);
put_cpu();
+ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
return tsc_khz;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 192/217] PCI: versatile: Fix I/O space page leak
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (179 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 191/217] kvmclock: fix TSC calibration for nested guests Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 193/217] net: qca_spi: Avoid packet drop during initial sync Greg Kroah-Hartman
` (22 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Lorenzo Pieralisi,
Bjorn Helgaas, Linus Walleij, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ]
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
Hardware name: Renesas Condor board based on r8a77980 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : ioremap_page_range+0x370/0x3c8
lr : ioremap_page_range+0x40/0x3c8
sp : ffff000008da39e0
x29: ffff000008da39e0 x28: 00e8000000000f07
x27: ffff7dfffee00000 x26: 0140000000000000
x25: ffff7dfffef00000 x24: 00000000000fe100
x23: ffff80007b906000 x22: ffff000008ab8000
x21: ffff000008bb1d58 x20: ffff7dfffef00000
x19: ffff800009c30fb8 x18: 0000000000000001
x17: 00000000000152d0 x16: 00000000014012d0
x15: 0000000000000000 x14: 0720072007200720
x13: 0720072007200720 x12: 0720072007200720
x11: 0720072007300730 x10: 00000000000000ae
x9 : 0000000000000000 x8 : ffff7dffff000000
x7 : 0000000000000000 x6 : 0000000000000100
x5 : 0000000000000000 x4 : 000000007b906000
x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
x1 : 0000000040000000 x0 : 00e80000fe100f07
Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
Call trace:
ioremap_page_range+0x370/0x3c8
pci_remap_iospace+0x7c/0xac
pci_parse_request_of_pci_ranges+0x13c/0x190
rcar_pcie_probe+0x4c/0xb04
platform_drv_probe+0x50/0xbc
driver_probe_device+0x21c/0x308
__device_attach_driver+0x98/0xc8
bus_for_each_drv+0x54/0x94
__device_attach+0xc4/0x12c
device_initial_probe+0x10/0x18
bus_probe_device+0x90/0x98
deferred_probe_work_func+0xb0/0x150
process_one_work+0x12c/0x29c
worker_thread+0x200/0x3fc
kthread+0x108/0x134
ret_from_fork+0x10/0x18
Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.
The Versatile PCI controller driver has the same issue.
Replace pci_remap_iospace() with the devm_ managed version to fix the bug.
Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pci-versatile.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/host/pci-versatile.c
+++ b/drivers/pci/host/pci-versatile.c
@@ -89,7 +89,7 @@ static int versatile_pci_parse_request_o
switch (resource_type(res)) {
case IORESOURCE_IO:
- err = pci_remap_iospace(res, iobase);
+ err = devm_pci_remap_iospace(dev, res, iobase);
if (err) {
dev_warn(dev, "error %d: failed to map resource %pR\n",
err, res);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 193/217] net: qca_spi: Avoid packet drop during initial sync
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (180 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 192/217] PCI: versatile: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 194/217] net: qca_spi: Make sure the QCA7000 reset is triggered Greg Kroah-Hartman
` (21 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ]
As long as the synchronization with the QCA7000 isn't finished, we
cannot accept packets from the upper layers. So let the SPI thread
enable the TX queue after sync and avoid unwanted packet drop.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *de
return ret;
}
- netif_start_queue(qca->net_dev);
+ /* SPI thread takes care of TX queue */
return 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 194/217] net: qca_spi: Make sure the QCA7000 reset is triggered
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (181 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 193/217] net: qca_spi: Avoid packet drop during initial sync Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 195/217] net: qca_spi: Fix log level if probe fails Greg Kroah-Hartman
` (20 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ]
In case the SPI thread is not running, a simple reset of sync
state won't fix the transmit timeout. We also need to wake up the kernel
thread.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -761,6 +761,9 @@ qcaspi_netdev_tx_timeout(struct net_devi
qca->net_dev->stats.tx_errors++;
/* Trigger tx queue flush and QCA7000 reset */
qca->sync = QCASPI_SYNC_UNKNOWN;
+
+ if (qca->spi_thread)
+ wake_up_process(qca->spi_thread);
}
static int
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 195/217] net: qca_spi: Fix log level if probe fails
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (182 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 194/217] net: qca_spi: Make sure the QCA7000 reset is triggered Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 197/217] soc: imx: gpc: restrict register range for regmap access Greg Kroah-Hartman
` (19 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit 50973993260a6934f0a00da53d9b746cfbea89ab ]
In cases the probing fails the log level of the messages should
be an error.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -882,22 +882,22 @@ qca_spi_probe(struct spi_device *spi)
if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
(qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
- dev_info(&spi->dev, "Invalid clkspeed: %d\n",
- qcaspi_clkspeed);
+ dev_err(&spi->dev, "Invalid clkspeed: %d\n",
+ qcaspi_clkspeed);
return -EINVAL;
}
if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
(qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
- dev_info(&spi->dev, "Invalid burst len: %d\n",
- qcaspi_burst_len);
+ dev_err(&spi->dev, "Invalid burst len: %d\n",
+ qcaspi_burst_len);
return -EINVAL;
}
if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
(qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
- dev_info(&spi->dev, "Invalid pluggable: %d\n",
- qcaspi_pluggable);
+ dev_err(&spi->dev, "Invalid pluggable: %d\n",
+ qcaspi_pluggable);
return -EINVAL;
}
@@ -959,8 +959,8 @@ qca_spi_probe(struct spi_device *spi)
}
if (register_netdev(qcaspi_devs)) {
- dev_info(&spi->dev, "Unable to register net device %s\n",
- qcaspi_devs->name);
+ dev_err(&spi->dev, "Unable to register net device %s\n",
+ qcaspi_devs->name);
free_netdev(qcaspi_devs);
return -EFAULT;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 197/217] soc: imx: gpc: restrict register range for regmap access
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (183 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 195/217] net: qca_spi: Fix log level if probe fails Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 198/217] ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems Greg Kroah-Hartman
` (18 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anson Huang, Fabio Estevam,
Shawn Guo, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anson Huang <Anson.Huang@nxp.com>
[ Upstream commit de2d9b5284bcb5c159c5882ac69f6bfd4dec7c67 ]
GPC registers are NOT continuous, some registers are
reserved and accessing them from userspace will trigger
external abort, add regmap register access table to
avoid below abort:
root@imx6slevk:~# cat /sys/kernel/debug/regmap/20dc000.gpc/registers
[ 108.480477] Unhandled fault: imprecise external abort (0x1406) at 0xb6db5004
[ 108.487985] pgd = 42b54bfd
[ 108.490741] [b6db5004] *pgd=ba1b7831
[ 108.494386] Internal error: : 1406 [#1] SMP ARM
[ 108.498943] Modules linked in:
[ 108.502043] CPU: 0 PID: 389 Comm: cat Not tainted 4.18.0-rc1-00074-gc9f1f60-dirty #482
[ 108.509982] Hardware name: Freescale i.MX6 SoloLite (Device Tree)
[ 108.516123] PC is at regmap_mmio_read32le+0x20/0x24
[ 108.521031] LR is at regmap_mmio_read+0x40/0x60
[ 108.525586] pc : [<c059cf74>] lr : [<c059d1ac>] psr: 20060093
[ 108.531875] sp : eccf1d98 ip : eccf1da8 fp : eccf1da4
[ 108.537122] r10: ec2d3800 r9 : eccf1f60 r8 : ecfc0000
[ 108.542370] r7 : eccf1e2c r6 : eccf1e2c r5 : 00000028 r4 : ec338e00
[ 108.548920] r3 : 00000000 r2 : eccf1e2c r1 : f0980028 r0 : 00000000
[ 108.555474] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
[ 108.562720] Control: 10c5387d Table: acf4004a DAC: 00000051
[ 108.568491] Process cat (pid: 389, stack limit = 0xd4318a65)
[ 108.574174] Stack: (0xeccf1d98 to 0xeccf2000)
Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/imx/gpc.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -27,9 +27,16 @@
#define GPC_PGC_SW2ISO_SHIFT 0x8
#define GPC_PGC_SW_SHIFT 0x0
+#define GPC_PGC_PCI_PDN 0x200
+#define GPC_PGC_PCI_SR 0x20c
+
#define GPC_PGC_GPU_PDN 0x260
#define GPC_PGC_GPU_PUPSCR 0x264
#define GPC_PGC_GPU_PDNSCR 0x268
+#define GPC_PGC_GPU_SR 0x26c
+
+#define GPC_PGC_DISP_PDN 0x240
+#define GPC_PGC_DISP_SR 0x24c
#define GPU_VPU_PUP_REQ BIT(1)
#define GPU_VPU_PDN_REQ BIT(0)
@@ -303,10 +310,24 @@ static const struct of_device_id imx_gpc
{ }
};
+static const struct regmap_range yes_ranges[] = {
+ regmap_reg_range(GPC_CNTR, GPC_CNTR),
+ regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR),
+ regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR),
+ regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR),
+};
+
+static const struct regmap_access_table access_table = {
+ .yes_ranges = yes_ranges,
+ .n_yes_ranges = ARRAY_SIZE(yes_ranges),
+};
+
static const struct regmap_config imx_gpc_regmap_config = {
.reg_bits = 32,
.val_bits = 32,
.reg_stride = 4,
+ .rd_table = &access_table,
+ .wr_table = &access_table,
.max_register = 0x2ac,
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 198/217] ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (184 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 197/217] soc: imx: gpc: restrict register range for regmap access Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 200/217] nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD Greg Kroah-Hartman
` (17 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin H. Johnson, Rafael J. Wysocki,
Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Robin H. Johnson" <robbat2@gentoo.org>
[ Upstream commit 2c4d6baf1bc4f7729773ffcee9ba2a9781578633 ]
The ec_no_wakeup matcher added for Thinkpad X1 Carbon 6th gen systems
beyond matched only a single DMI model (20KGS3JF01), that didn't cover
my laptop (20KH002JUS). Change to match based on DMI product family to
cover all X1 6th gen systems.
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/ec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -2034,7 +2034,7 @@ static const struct dmi_system_id acpi_e
.ident = "Thinkpad X1 Carbon 6th",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
- DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
},
},
{ },
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 200/217] nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (185 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 198/217] ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 201/217] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
` (16 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roland Dreier, Keith Busch,
Christoph Hellwig, Sasha Levin
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <roland@purestorage.com>
[ Upstream commit 9b382768135ee3ff282f828c906574a8478e036b ]
The old code in nvme_user_cmd() passed the userspace virtual address
from nvme_passthru_cmd.metadata as the length of the metadata buffer
as well as the address to nvme_submit_user_cmd().
Fixes: 63263d60 ("nvme: Use metadata for passthrough commands")
Signed-off-by: Roland Dreier <roland@purestorage.com>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1016,7 +1016,7 @@ static int nvme_user_cmd(struct nvme_ctr
status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
(void __user *)(uintptr_t)cmd.addr, cmd.data_len,
- (void __user *)(uintptr_t)cmd.metadata, cmd.metadata,
+ (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len,
0, &cmd.result, timeout);
if (status >= 0) {
if (put_user(cmd.result, &ucmd->result))
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 201/217] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (186 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 200/217] nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 202/217] f2fs: return error during fill_super Greg Kroah-Hartman
` (15 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Paolo Bonzini,
David Hildenbrand, Sudip Mukherjee
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.
A comment warning against this bug is there, but the code is not doing what
the comment says. Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/eventfd.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct
if (events & POLLIN)
schedule_work(&irqfd->inject);
- /*
- * do not drop the file until the irqfd is fully initialized, otherwise
- * we might race against the POLLHUP
- */
- fdput(f);
#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
if (kvm_arch_has_irq_bypass()) {
irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct
#endif
srcu_read_unlock(&kvm->irq_srcu, idx);
+
+ /*
+ * do not drop the file until the irqfd is fully initialized, otherwise
+ * we might race against the POLLHUP
+ */
+ fdput(f);
return 0;
fail:
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 202/217] f2fs: return error during fill_super
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (187 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 201/217] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 203/217] f2fs: sanity check for total valid node blocks Greg Kroah-Hartman
` (14 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sudip Mukherjee
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit c39a1b348c4fe172729eff77c533dabc3c7cdaa7 upstream.
Let's avoid BUG_ON during fill_super, when on-disk was totall corrupted.
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/segment.c | 16 ++++++++++++----
fs/f2fs/segment.h | 22 ++++++++++++++++++----
2 files changed, 30 insertions(+), 8 deletions(-)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -3240,7 +3240,7 @@ static int build_curseg(struct f2fs_sb_i
return restore_curseg_summaries(sbi);
}
-static void build_sit_entries(struct f2fs_sb_info *sbi)
+static int build_sit_entries(struct f2fs_sb_info *sbi)
{
struct sit_info *sit_i = SIT_I(sbi);
struct curseg_info *curseg = CURSEG_I(sbi, CURSEG_COLD_DATA);
@@ -3250,6 +3250,7 @@ static void build_sit_entries(struct f2f
int sit_blk_cnt = SIT_BLK_CNT(sbi);
unsigned int i, start, end;
unsigned int readed, start_blk = 0;
+ int err = 0;
do {
readed = ra_meta_pages(sbi, start_blk, BIO_MAX_PAGES,
@@ -3268,7 +3269,9 @@ static void build_sit_entries(struct f2f
sit = sit_blk->entries[SIT_ENTRY_OFFSET(sit_i, start)];
f2fs_put_page(page, 1);
- check_block_count(sbi, start, &sit);
+ err = check_block_count(sbi, start, &sit);
+ if (err)
+ return err;
seg_info_from_raw_sit(se, &sit);
/* build discard map only one time */
@@ -3303,7 +3306,9 @@ static void build_sit_entries(struct f2f
old_valid_blocks = se->valid_blocks;
- check_block_count(sbi, start, &sit);
+ err = check_block_count(sbi, start, &sit);
+ if (err)
+ break;
seg_info_from_raw_sit(se, &sit);
if (f2fs_discard_en(sbi)) {
@@ -3323,6 +3328,7 @@ static void build_sit_entries(struct f2f
se->valid_blocks - old_valid_blocks;
}
up_read(&curseg->journal_rwsem);
+ return err;
}
static void init_free_segmap(struct f2fs_sb_info *sbi)
@@ -3492,7 +3498,9 @@ int build_segment_manager(struct f2fs_sb
return err;
/* reinit free segmap based on SIT */
- build_sit_entries(sbi);
+ err = build_sit_entries(sbi);
+ if (err)
+ return err;
init_free_segmap(sbi);
err = build_dirty_segmap(sbi);
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -625,7 +625,7 @@ static inline void verify_block_addr(str
/*
* Summary block is always treated as an invalid block
*/
-static inline void check_block_count(struct f2fs_sb_info *sbi,
+static inline int check_block_count(struct f2fs_sb_info *sbi,
int segno, struct f2fs_sit_entry *raw_sit)
{
#ifdef CONFIG_F2FS_CHECK_FS
@@ -647,11 +647,25 @@ static inline void check_block_count(str
cur_pos = next_pos;
is_valid = !is_valid;
} while (cur_pos < sbi->blocks_per_seg);
- BUG_ON(GET_SIT_VBLOCKS(raw_sit) != valid_blocks);
+
+ if (unlikely(GET_SIT_VBLOCKS(raw_sit) != valid_blocks)) {
+ f2fs_msg(sbi->sb, KERN_ERR,
+ "Mismatch valid blocks %d vs. %d",
+ GET_SIT_VBLOCKS(raw_sit), valid_blocks);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ return -EINVAL;
+ }
#endif
/* check segment usage, and check boundary of a given segment number */
- f2fs_bug_on(sbi, GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg
- || segno > TOTAL_SEGS(sbi) - 1);
+ if (unlikely(GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg
+ || segno > TOTAL_SEGS(sbi) - 1)) {
+ f2fs_msg(sbi->sb, KERN_ERR,
+ "Wrong valid blocks %d or segno %u",
+ GET_SIT_VBLOCKS(raw_sit), segno);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ return -EINVAL;
+ }
+ return 0;
}
static inline pgoff_t current_sit_addr(struct f2fs_sb_info *sbi,
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 203/217] f2fs: sanity check for total valid node blocks
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (188 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 202/217] f2fs: return error during fill_super Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 205/217] xfrm_user: prevent leaking 2 bytes of kernel memory Greg Kroah-Hartman
` (13 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+bf9253040425feb155ad, Chao Yu,
Jaegeuk Kim, Sudip Mukherjee
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit 8a29c1260e24e7c9c6ab138aa0017558d8b28208 upstream.
This patch enhances sanity check for SIT entries.
syzbot hit the following crash on upstream commit
83beed7b2b26f232d782127792dd0cd4362fdc41 (Fri Apr 20 17:56:32 2018 +0000)
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=bf9253040425feb155ad
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5692130282438656
Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5095924598571008
Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+bf9253040425feb155ad@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): Try to recover 1th superblock, ret: 0
F2FS-fs (loop0): Mounted with checkpoint version = d
F2FS-fs (loop0): Bitmap was wrongly cleared, blk:9740
------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:1884!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4508 Comm: syz-executor0 Not tainted 4.17.0-rc1+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882
RSP: 0018:ffff8801af526708 EFLAGS: 00010282
RAX: ffffed0035ea4cc0 RBX: ffff8801ad454f90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff82eeb87e RDI: ffffed0035ea4cb6
RBP: ffff8801af526760 R08: ffff8801ad4a2480 R09: ffffed003b5e4f90
R10: ffffed003b5e4f90 R11: ffff8801daf27c87 R12: ffff8801adb8d380
R13: 0000000000000001 R14: 0000000000000008 R15: 00000000ffffffff
FS: 00000000014af940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f06bc223000 CR3: 00000001adb02000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
allocate_data_block+0x66f/0x2050 fs/f2fs/segment.c:2663
do_write_page+0x105/0x1b0 fs/f2fs/segment.c:2727
write_node_page+0x129/0x350 fs/f2fs/segment.c:2770
__write_node_page+0x7da/0x1370 fs/f2fs/node.c:1398
sync_node_pages+0x18cf/0x1eb0 fs/f2fs/node.c:1652
block_operations+0x429/0xa60 fs/f2fs/checkpoint.c:1088
write_checkpoint+0x3ba/0x5380 fs/f2fs/checkpoint.c:1405
f2fs_sync_fs+0x2fb/0x6a0 fs/f2fs/super.c:1077
__sync_filesystem fs/sync.c:39 [inline]
sync_filesystem+0x265/0x310 fs/sync.c:67
generic_shutdown_super+0xd7/0x520 fs/super.c:429
kill_block_super+0xa4/0x100 fs/super.c:1191
kill_f2fs_super+0x9f/0xd0 fs/f2fs/super.c:3030
deactivate_locked_super+0x97/0x100 fs/super.c:316
deactivate_super+0x188/0x1b0 fs/super.c:347
cleanup_mnt+0xbf/0x160 fs/namespace.c:1174
__cleanup_mnt+0x16/0x20 fs/namespace.c:1181
task_work_run+0x1e4/0x290 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x2bd/0x310 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
do_syscall_64+0x6ac/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457d97
RSP: 002b:00007ffd46f9c8e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000457d97
RDX: 00000000014b09a3 RSI: 0000000000000002 RDI: 00007ffd46f9da50
RBP: 00007ffd46f9da50 R08: 0000000000000000 R09: 0000000000000009
R10: 0000000000000005 R11: 0000000000000246 R12: 00000000014b0940
R13: 0000000000000000 R14: 0000000000000002 R15: 000000000000658e
RIP: update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882 RSP: ffff8801af526708
---[ end trace f498328bb02610a2 ]---
Reported-and-tested-by: syzbot+bf9253040425feb155ad@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+7d6d31d3bc702f566ce3@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+0a725420475916460f12@syzkaller.appspotmail.com
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/segment.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -3251,6 +3251,7 @@ static int build_sit_entries(struct f2fs
unsigned int i, start, end;
unsigned int readed, start_blk = 0;
int err = 0;
+ block_t total_node_blocks = 0;
do {
readed = ra_meta_pages(sbi, start_blk, BIO_MAX_PAGES,
@@ -3273,6 +3274,8 @@ static int build_sit_entries(struct f2fs
if (err)
return err;
seg_info_from_raw_sit(se, &sit);
+ if (IS_NODESEG(se->type))
+ total_node_blocks += se->valid_blocks;
/* build discard map only one time */
if (f2fs_discard_en(sbi)) {
@@ -3305,11 +3308,15 @@ static int build_sit_entries(struct f2fs
sit = sit_in_journal(journal, i);
old_valid_blocks = se->valid_blocks;
+ if (IS_NODESEG(se->type))
+ total_node_blocks -= old_valid_blocks;
err = check_block_count(sbi, start, &sit);
if (err)
break;
seg_info_from_raw_sit(se, &sit);
+ if (IS_NODESEG(se->type))
+ total_node_blocks += se->valid_blocks;
if (f2fs_discard_en(sbi)) {
if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
@@ -3328,6 +3335,15 @@ static int build_sit_entries(struct f2fs
se->valid_blocks - old_valid_blocks;
}
up_read(&curseg->journal_rwsem);
+
+ if (!err && total_node_blocks != valid_node_count(sbi)) {
+ f2fs_msg(sbi->sb, KERN_ERR,
+ "SIT is corrupted node# %u vs %u",
+ total_node_blocks, valid_node_count(sbi));
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ err = -EINVAL;
+ }
+
return err;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 205/217] xfrm_user: prevent leaking 2 bytes of kernel memory
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (189 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 203/217] f2fs: sanity check for total valid node blocks Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 206/217] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state Greg Kroah-Hartman
` (12 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot,
Steffen Klassert, Herbert Xu
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 45c180bc29babbedd6b8c01b975780ef44d9d09c upstream.
struct xfrm_userpolicy_type has two holes, so we should not
use C99 style initializer.
KMSAN report:
BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:140 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571
CPU: 1 PID: 4520 Comm: syz-executor841 Not tainted 4.17.0+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:113
kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
kmsan_internal_check_memory+0x138/0x1f0 mm/kmsan/kmsan.c:1211
kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1253
copyout lib/iov_iter.c:140 [inline]
_copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571
copy_to_iter include/linux/uio.h:106 [inline]
skb_copy_datagram_iter+0x422/0xfa0 net/core/datagram.c:431
skb_copy_datagram_msg include/linux/skbuff.h:3268 [inline]
netlink_recvmsg+0x6f1/0x1900 net/netlink/af_netlink.c:1959
sock_recvmsg_nosec net/socket.c:802 [inline]
sock_recvmsg+0x1d6/0x230 net/socket.c:809
___sys_recvmsg+0x3fe/0x810 net/socket.c:2279
__sys_recvmmsg+0x58e/0xe30 net/socket.c:2391
do_sys_recvmmsg+0x2a6/0x3e0 net/socket.c:2472
__do_sys_recvmmsg net/socket.c:2485 [inline]
__se_sys_recvmmsg net/socket.c:2481 [inline]
__x64_sys_recvmmsg+0x15d/0x1c0 net/socket.c:2481
do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446ce9
RSP: 002b:00007fc307918db8 EFLAGS: 00000293 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00000000006dbc24 RCX: 0000000000446ce9
RDX: 000000000000000a RSI: 0000000020005040 RDI: 0000000000000003
RBP: 00000000006dbc20 R08: 0000000020004e40 R09: 0000000000000000
R10: 0000000040000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffc8d2df32f R14: 00007fc3079199c0 R15: 0000000000000001
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:527
__msan_memcpy+0x109/0x160 mm/kmsan/kmsan_instr.c:413
__nla_put lib/nlattr.c:569 [inline]
nla_put+0x276/0x340 lib/nlattr.c:627
copy_to_user_policy_type net/xfrm/xfrm_user.c:1678 [inline]
dump_one_policy+0xbe1/0x1090 net/xfrm/xfrm_user.c:1708
xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013
xfrm_dump_policy+0x1c0/0x2a0 net/xfrm/xfrm_user.c:1749
netlink_dump+0x9b5/0x1550 net/netlink/af_netlink.c:2226
__netlink_dump_start+0x1131/0x1270 net/netlink/af_netlink.c:2323
netlink_dump_start include/linux/netlink.h:214 [inline]
xfrm_user_rcv_msg+0x8a3/0x9b0 net/xfrm/xfrm_user.c:2577
netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448
xfrm_netlink_rcv+0xb2/0xf0 net/xfrm/xfrm_user.c:2598
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg net/socket.c:639 [inline]
___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
__sys_sendmsg net/socket.c:2155 [inline]
__do_sys_sendmsg net/socket.c:2164 [inline]
__se_sys_sendmsg net/socket.c:2162 [inline]
__x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Local variable description: ----upt.i@dump_one_policy
Variable was created at:
dump_one_policy+0x78/0x1090 net/xfrm/xfrm_user.c:1689
xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013
Byte 130 of 137 is uninitialized
Memory access starts at ffff88019550407f
Fixes: c0144beaeca42 ("[XFRM] netlink: Use nla_put()/NLA_PUT() variantes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1665,9 +1665,11 @@ static inline size_t userpolicy_type_att
#ifdef CONFIG_XFRM_SUB_POLICY
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
{
- struct xfrm_userpolicy_type upt = {
- .type = type,
- };
+ struct xfrm_userpolicy_type upt;
+
+ /* Sadly there are two holes in struct xfrm_userpolicy_type */
+ memset(&upt, 0, sizeof(upt));
+ upt.type = type;
return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 206/217] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (190 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 205/217] xfrm_user: prevent leaking 2 bytes of kernel memory Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 207/217] packet: refine ring v3 block size test to hold one frame Greg Kroah-Hartman
` (11 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+6f18401420df260e37ed,
Florian Westphal, Pablo Neira Ayuso
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 6613b6173dee098997229caf1f3b961c49da75e6 upstream.
When first DCCP packet is SYNC or SYNCACK, we insert a new conntrack
that has an un-initialized timeout value, i.e. such entry could be
reaped at any time.
Mark them as INVALID and only ignore SYNC/SYNCACK when connection had
an old state.
Reported-by: syzbot+6f18401420df260e37ed@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_proto_dccp.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
* We currently ignore Sync packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
[DCCP_PKT_SYNCACK] = {
/*
* We currently ignore SyncAck packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
},
[CT_DCCP_ROLE_SERVER] = {
@@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
* We currently ignore Sync packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
[DCCP_PKT_SYNCACK] = {
/*
* We currently ignore SyncAck packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
},
};
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 207/217] packet: refine ring v3 block size test to hold one frame
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (191 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 206/217] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 208/217] net/smc: no shutdown in state SMC_LISTEN Greg Kroah-Hartman
` (10 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Willem de Bruijn, David S. Miller
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
commit 4576cd469d980317c4edd9173f8b694aa71ea3a3 upstream.
TPACKET_V3 stores variable length frames in fixed length blocks.
Blocks must be able to store a block header, optional private space
and at least one minimum sized frame.
Frames, even for a zero snaplen packet, store metadata headers and
optional reserved space.
In the block size bounds check, ensure that the frame of the
chosen configuration fits. This includes sockaddr_ll and optional
tp_reserve.
Syzbot was able to construct a ring with insuffient room for the
sockaddr_ll in the header of a zero-length frame, triggering an
out-of-bounds write in dev_parse_header.
Convert the comparison to less than, as zero is a valid snap len.
This matches the test for minimum tp_frame_size immediately below.
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Fixes: eb73190f4fbe ("net/packet: refine check for priv area size")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4269,6 +4269,8 @@ static int packet_set_ring(struct sock *
}
if (req->tp_block_nr) {
+ unsigned int min_frame_size;
+
/* Sanity tests and some calculations */
err = -EBUSY;
if (unlikely(rb->pg_vec))
@@ -4291,12 +4293,12 @@ static int packet_set_ring(struct sock *
goto out;
if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
goto out;
+ min_frame_size = po->tp_hdrlen + po->tp_reserve;
if (po->tp_version >= TPACKET_V3 &&
- req->tp_block_size <=
- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
+ req->tp_block_size <
+ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
goto out;
- if (unlikely(req->tp_frame_size < po->tp_hdrlen +
- po->tp_reserve))
+ if (unlikely(req->tp_frame_size < min_frame_size))
goto out;
if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
goto out;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 208/217] net/smc: no shutdown in state SMC_LISTEN
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (192 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 207/217] packet: refine ring v3 block size test to hold one frame Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
` (9 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ursula Braun, David S. Miller
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <ubraun@linux.ibm.com>
commit caa21e19e08d7a1445116a93f7ab4e187ebbbadb upstream.
Invoking shutdown for a socket in state SMC_LISTEN does not make
sense. Nevertheless programs like syzbot fuzzing the kernel may
try to do this. For SMC this means a socket refcounting problem.
This patch makes sure a shutdown call for an SMC socket in state
SMC_LISTEN simply returns with -ENOTCONN.
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/af_smc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1180,8 +1180,7 @@ static int smc_shutdown(struct socket *s
lock_sock(sk);
rc = -ENOTCONN;
- if ((sk->sk_state != SMC_LISTEN) &&
- (sk->sk_state != SMC_ACTIVE) &&
+ if ((sk->sk_state != SMC_ACTIVE) &&
(sk->sk_state != SMC_PEERCLOSEWAIT1) &&
(sk->sk_state != SMC_PEERCLOSEWAIT2) &&
(sk->sk_state != SMC_APPCLOSEWAIT1) &&
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (193 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 208/217] net/smc: no shutdown in state SMC_LISTEN Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 10:57 ` Sergei Shtylyov
2018-08-23 7:55 ` [PATCH 4.14 211/217] PCI: hotplug: Dont leak pci_slot on registration failure Greg Kroah-Hartman
` (8 subsequent siblings)
203 siblings, 1 reply; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Lorenzo Pieralisi,
Bjorn Helgaas, Linus Walleij
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
Hardware name: Renesas Condor board based on r8a77980 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : ioremap_page_range+0x370/0x3c8
lr : ioremap_page_range+0x40/0x3c8
sp : ffff000008da39e0
x29: ffff000008da39e0 x28: 00e8000000000f07
x27: ffff7dfffee00000 x26: 0140000000000000
x25: ffff7dfffef00000 x24: 00000000000fe100
x23: ffff80007b906000 x22: ffff000008ab8000
x21: ffff000008bb1d58 x20: ffff7dfffef00000
x19: ffff800009c30fb8 x18: 0000000000000001
x17: 00000000000152d0 x16: 00000000014012d0
x15: 0000000000000000 x14: 0720072007200720
x13: 0720072007200720 x12: 0720072007200720
x11: 0720072007300730 x10: 00000000000000ae
x9 : 0000000000000000 x8 : ffff7dffff000000
x7 : 0000000000000000 x6 : 0000000000000100
x5 : 0000000000000000 x4 : 000000007b906000
x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
x1 : 0000000040000000 x0 : 00e80000fe100f07
Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
Call trace:
ioremap_page_range+0x370/0x3c8
pci_remap_iospace+0x7c/0xac
pci_parse_request_of_pci_ranges+0x13c/0x190
rcar_pcie_probe+0x4c/0xb04
platform_drv_probe+0x50/0xbc
driver_probe_device+0x21c/0x308
__device_attach_driver+0x98/0xc8
bus_for_each_drv+0x54/0x94
__device_attach+0xc4/0x12c
device_initial_probe+0x10/0x18
bus_probe_device+0x90/0x98
deferred_probe_work_func+0xb0/0x150
process_one_work+0x12c/0x29c
worker_thread+0x200/0x3fc
kthread+0x108/0x134
ret_from_fork+0x10/0x18
Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.
Introduce the devm_pci_remap_iospace() managed API and replace the
pci_remap_iospace() call with it to fix the bug.
Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: split commit/updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
[Backport just for the new api which other patches need - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
include/linux/pci.h | 2 ++
2 files changed, 40 insertions(+)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3446,6 +3446,44 @@ void pci_unmap_iospace(struct resource *
}
EXPORT_SYMBOL(pci_unmap_iospace);
+static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
+{
+ struct resource **res = ptr;
+
+ pci_unmap_iospace(*res);
+}
+
+/**
+ * devm_pci_remap_iospace - Managed pci_remap_iospace()
+ * @dev: Generic device to remap IO address for
+ * @res: Resource describing the I/O space
+ * @phys_addr: physical address of range to be mapped
+ *
+ * Managed pci_remap_iospace(). Map is automatically unmapped on driver
+ * detach.
+ */
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr)
+{
+ const struct resource **ptr;
+ int error;
+
+ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
+
+ error = pci_remap_iospace(res, phys_addr);
+ if (error) {
+ devres_free(ptr);
+ } else {
+ *ptr = res;
+ devres_add(dev, ptr);
+ }
+
+ return error;
+}
+EXPORT_SYMBOL(devm_pci_remap_iospace);
+
/**
* devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
* @dev: Generic device to remap IO address for
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1235,6 +1235,8 @@ int pci_register_io_range(phys_addr_t ad
unsigned long pci_address_to_pio(phys_addr_t addr);
phys_addr_t pci_pio_to_address(unsigned long pio);
int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr);
void pci_unmap_iospace(struct resource *res);
void __iomem *devm_pci_remap_cfgspace(struct device *dev,
resource_size_t offset,
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 7:55 ` [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 10:57 ` Sergei Shtylyov
2018-08-23 11:17 ` Greg Kroah-Hartman
0 siblings, 1 reply; 213+ messages in thread
From: Sergei Shtylyov @ 2018-08-23 10:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
> 4.14-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>
> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>
> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> driver was left disabled, the kernel crashed with this BUG:
>
> kernel BUG at lib/ioremap.c:72!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> Hardware name: Renesas Condor board based on r8a77980 (DT)
> Workqueue: events deferred_probe_work_func
> pstate: 80000005 (Nzcv daif -PAN -UAO)
> pc : ioremap_page_range+0x370/0x3c8
> lr : ioremap_page_range+0x40/0x3c8
> sp : ffff000008da39e0
> x29: ffff000008da39e0 x28: 00e8000000000f07
> x27: ffff7dfffee00000 x26: 0140000000000000
> x25: ffff7dfffef00000 x24: 00000000000fe100
> x23: ffff80007b906000 x22: ffff000008ab8000
> x21: ffff000008bb1d58 x20: ffff7dfffef00000
> x19: ffff800009c30fb8 x18: 0000000000000001
> x17: 00000000000152d0 x16: 00000000014012d0
> x15: 0000000000000000 x14: 0720072007200720
> x13: 0720072007200720 x12: 0720072007200720
> x11: 0720072007300730 x10: 00000000000000ae
> x9 : 0000000000000000 x8 : ffff7dffff000000
> x7 : 0000000000000000 x6 : 0000000000000100
> x5 : 0000000000000000 x4 : 000000007b906000
> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> x1 : 0000000040000000 x0 : 00e80000fe100f07
> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> Call trace:
> ioremap_page_range+0x370/0x3c8
> pci_remap_iospace+0x7c/0xac
> pci_parse_request_of_pci_ranges+0x13c/0x190
> rcar_pcie_probe+0x4c/0xb04
> platform_drv_probe+0x50/0xbc
> driver_probe_device+0x21c/0x308
> __device_attach_driver+0x98/0xc8
> bus_for_each_drv+0x54/0x94
> __device_attach+0xc4/0x12c
> device_initial_probe+0x10/0x18
> bus_probe_device+0x90/0x98
> deferred_probe_work_func+0xb0/0x150
> process_one_work+0x12c/0x29c
> worker_thread+0x200/0x3fc
> kthread+0x108/0x134
> ret_from_fork+0x10/0x18
> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>
> It turned out that pci_remap_iospace() wasn't undone when the driver's
> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> the probe was retried, finally causing the BUG due to trying to remap
> already remapped pages.
>
> Introduce the devm_pci_remap_iospace() managed API and replace the
> pci_remap_iospace() call with it to fix the bug.
>
> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> [Backport just for the new api which other patches need - gregkh]
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> include/linux/pci.h | 2 ++
> 2 files changed, 40 insertions(+)
You missed a chnage to drivers/pci/host/pci-host-common.c (and
also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
then)...
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 10:57 ` Sergei Shtylyov
@ 2018-08-23 11:17 ` Greg Kroah-Hartman
2018-08-23 11:56 ` Greg Kroah-Hartman
0 siblings, 1 reply; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 11:17 UTC (permalink / raw)
To: Sergei Shtylyov
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
> On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
>
> > 4.14-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> >
> > commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
> >
> > When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> > driver was left disabled, the kernel crashed with this BUG:
> >
> > kernel BUG at lib/ioremap.c:72!
> > Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> > Modules linked in:
> > CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> > Hardware name: Renesas Condor board based on r8a77980 (DT)
> > Workqueue: events deferred_probe_work_func
> > pstate: 80000005 (Nzcv daif -PAN -UAO)
> > pc : ioremap_page_range+0x370/0x3c8
> > lr : ioremap_page_range+0x40/0x3c8
> > sp : ffff000008da39e0
> > x29: ffff000008da39e0 x28: 00e8000000000f07
> > x27: ffff7dfffee00000 x26: 0140000000000000
> > x25: ffff7dfffef00000 x24: 00000000000fe100
> > x23: ffff80007b906000 x22: ffff000008ab8000
> > x21: ffff000008bb1d58 x20: ffff7dfffef00000
> > x19: ffff800009c30fb8 x18: 0000000000000001
> > x17: 00000000000152d0 x16: 00000000014012d0
> > x15: 0000000000000000 x14: 0720072007200720
> > x13: 0720072007200720 x12: 0720072007200720
> > x11: 0720072007300730 x10: 00000000000000ae
> > x9 : 0000000000000000 x8 : ffff7dffff000000
> > x7 : 0000000000000000 x6 : 0000000000000100
> > x5 : 0000000000000000 x4 : 000000007b906000
> > x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> > x1 : 0000000040000000 x0 : 00e80000fe100f07
> > Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> > Call trace:
> > ioremap_page_range+0x370/0x3c8
> > pci_remap_iospace+0x7c/0xac
> > pci_parse_request_of_pci_ranges+0x13c/0x190
> > rcar_pcie_probe+0x4c/0xb04
> > platform_drv_probe+0x50/0xbc
> > driver_probe_device+0x21c/0x308
> > __device_attach_driver+0x98/0xc8
> > bus_for_each_drv+0x54/0x94
> > __device_attach+0xc4/0x12c
> > device_initial_probe+0x10/0x18
> > bus_probe_device+0x90/0x98
> > deferred_probe_work_func+0xb0/0x150
> > process_one_work+0x12c/0x29c
> > worker_thread+0x200/0x3fc
> > kthread+0x108/0x134
> > ret_from_fork+0x10/0x18
> > Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
> >
> > It turned out that pci_remap_iospace() wasn't undone when the driver's
> > probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> > the probe was retried, finally causing the BUG due to trying to remap
> > already remapped pages.
> >
> > Introduce the devm_pci_remap_iospace() managed API and replace the
> > pci_remap_iospace() call with it to fix the bug.
> >
> > Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> > Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> > [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> > Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> > Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> > Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> > [Backport just for the new api which other patches need - gregkh]
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >
> > ---
> > drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> > include/linux/pci.h | 2 ++
> > 2 files changed, 40 insertions(+)
>
> You missed a chnage to drivers/pci/host/pci-host-common.c (and
> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
> then)...
Yes I totally messed this up, let me fix it...
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 11:17 ` Greg Kroah-Hartman
@ 2018-08-23 11:56 ` Greg Kroah-Hartman
2018-08-23 15:20 ` Sergei Shtylyov
0 siblings, 1 reply; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 11:56 UTC (permalink / raw)
To: Sergei Shtylyov
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On Thu, Aug 23, 2018 at 01:17:28PM +0200, Greg Kroah-Hartman wrote:
> On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
> > On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
> >
> > > 4.14-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> > >
> > > commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
> > >
> > > When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> > > driver was left disabled, the kernel crashed with this BUG:
> > >
> > > kernel BUG at lib/ioremap.c:72!
> > > Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> > > Modules linked in:
> > > CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> > > Hardware name: Renesas Condor board based on r8a77980 (DT)
> > > Workqueue: events deferred_probe_work_func
> > > pstate: 80000005 (Nzcv daif -PAN -UAO)
> > > pc : ioremap_page_range+0x370/0x3c8
> > > lr : ioremap_page_range+0x40/0x3c8
> > > sp : ffff000008da39e0
> > > x29: ffff000008da39e0 x28: 00e8000000000f07
> > > x27: ffff7dfffee00000 x26: 0140000000000000
> > > x25: ffff7dfffef00000 x24: 00000000000fe100
> > > x23: ffff80007b906000 x22: ffff000008ab8000
> > > x21: ffff000008bb1d58 x20: ffff7dfffef00000
> > > x19: ffff800009c30fb8 x18: 0000000000000001
> > > x17: 00000000000152d0 x16: 00000000014012d0
> > > x15: 0000000000000000 x14: 0720072007200720
> > > x13: 0720072007200720 x12: 0720072007200720
> > > x11: 0720072007300730 x10: 00000000000000ae
> > > x9 : 0000000000000000 x8 : ffff7dffff000000
> > > x7 : 0000000000000000 x6 : 0000000000000100
> > > x5 : 0000000000000000 x4 : 000000007b906000
> > > x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> > > x1 : 0000000040000000 x0 : 00e80000fe100f07
> > > Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> > > Call trace:
> > > ioremap_page_range+0x370/0x3c8
> > > pci_remap_iospace+0x7c/0xac
> > > pci_parse_request_of_pci_ranges+0x13c/0x190
> > > rcar_pcie_probe+0x4c/0xb04
> > > platform_drv_probe+0x50/0xbc
> > > driver_probe_device+0x21c/0x308
> > > __device_attach_driver+0x98/0xc8
> > > bus_for_each_drv+0x54/0x94
> > > __device_attach+0xc4/0x12c
> > > device_initial_probe+0x10/0x18
> > > bus_probe_device+0x90/0x98
> > > deferred_probe_work_func+0xb0/0x150
> > > process_one_work+0x12c/0x29c
> > > worker_thread+0x200/0x3fc
> > > kthread+0x108/0x134
> > > ret_from_fork+0x10/0x18
> > > Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
> > >
> > > It turned out that pci_remap_iospace() wasn't undone when the driver's
> > > probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> > > the probe was retried, finally causing the BUG due to trying to remap
> > > already remapped pages.
> > >
> > > Introduce the devm_pci_remap_iospace() managed API and replace the
> > > pci_remap_iospace() call with it to fix the bug.
> > >
> > > Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> > > Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> > > [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> > > Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> > > Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> > > Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> > > [Backport just for the new api which other patches need - gregkh]
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > >
> > > ---
> > > drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> > > include/linux/pci.h | 2 ++
> > > 2 files changed, 40 insertions(+)
> >
> > You missed a chnage to drivers/pci/host/pci-host-common.c (and
> > also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
> > then)...
>
> Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
it should now be resolved, but verifying this would be nice :)
thanks,
greg k-h
------------------------
From a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 Mon Sep 17 00:00:00 2001
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Wed, 18 Jul 2018 15:40:26 -0500
Subject: PCI: OF: Fix I/O space page leak
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
Hardware name: Renesas Condor board based on r8a77980 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : ioremap_page_range+0x370/0x3c8
lr : ioremap_page_range+0x40/0x3c8
sp : ffff000008da39e0
x29: ffff000008da39e0 x28: 00e8000000000f07
x27: ffff7dfffee00000 x26: 0140000000000000
x25: ffff7dfffef00000 x24: 00000000000fe100
x23: ffff80007b906000 x22: ffff000008ab8000
x21: ffff000008bb1d58 x20: ffff7dfffef00000
x19: ffff800009c30fb8 x18: 0000000000000001
x17: 00000000000152d0 x16: 00000000014012d0
x15: 0000000000000000 x14: 0720072007200720
x13: 0720072007200720 x12: 0720072007200720
x11: 0720072007300730 x10: 00000000000000ae
x9 : 0000000000000000 x8 : ffff7dffff000000
x7 : 0000000000000000 x6 : 0000000000000100
x5 : 0000000000000000 x4 : 000000007b906000
x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
x1 : 0000000040000000 x0 : 00e80000fe100f07
Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
Call trace:
ioremap_page_range+0x370/0x3c8
pci_remap_iospace+0x7c/0xac
pci_parse_request_of_pci_ranges+0x13c/0x190
rcar_pcie_probe+0x4c/0xb04
platform_drv_probe+0x50/0xbc
driver_probe_device+0x21c/0x308
__device_attach_driver+0x98/0xc8
bus_for_each_drv+0x54/0x94
__device_attach+0xc4/0x12c
device_initial_probe+0x10/0x18
bus_probe_device+0x90/0x98
deferred_probe_work_func+0xb0/0x150
process_one_work+0x12c/0x29c
worker_thread+0x200/0x3fc
kthread+0x108/0x134
ret_from_fork+0x10/0x18
Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.
Introduce the devm_pci_remap_iospace() managed API and replace the
pci_remap_iospace() call with it to fix the bug.
Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: split commit/updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- a/drivers/pci/host/pci-host-common.c
+++ b/drivers/pci/host/pci-host-common.c
@@ -612,7 +612,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev,
switch (resource_type(res)) {
case IORESOURCE_IO:
- err = pci_remap_iospace(res, iobase);
+ err = devm_pci_remap_iospace(dev, res, iobase);
if (err) {
dev_warn(dev, "error %d: failed to map resource %pR\n",
err, res);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 97acba712e4e..316496e99da9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3579,6 +3579,44 @@ void pci_unmap_iospace(struct resource *res)
}
EXPORT_SYMBOL(pci_unmap_iospace);
+static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
+{
+ struct resource **res = ptr;
+
+ pci_unmap_iospace(*res);
+}
+
+/**
+ * devm_pci_remap_iospace - Managed pci_remap_iospace()
+ * @dev: Generic device to remap IO address for
+ * @res: Resource describing the I/O space
+ * @phys_addr: physical address of range to be mapped
+ *
+ * Managed pci_remap_iospace(). Map is automatically unmapped on driver
+ * detach.
+ */
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr)
+{
+ const struct resource **ptr;
+ int error;
+
+ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
+
+ error = pci_remap_iospace(res, phys_addr);
+ if (error) {
+ devres_free(ptr);
+ } else {
+ *ptr = res;
+ devres_add(dev, ptr);
+ }
+
+ return error;
+}
+EXPORT_SYMBOL(devm_pci_remap_iospace);
+
/**
* devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
* @dev: Generic device to remap IO address for
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 340029b2fb38..abd5d5e17aee 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1240,6 +1240,8 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
unsigned long pci_address_to_pio(phys_addr_t addr);
phys_addr_t pci_pio_to_address(unsigned long pio);
int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr);
void pci_unmap_iospace(struct resource *res);
void __iomem *devm_pci_remap_cfgspace(struct device *dev,
resource_size_t offset,
^ permalink raw reply related [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 11:56 ` Greg Kroah-Hartman
@ 2018-08-23 15:20 ` Sergei Shtylyov
2018-08-23 15:27 ` Greg Kroah-Hartman
0 siblings, 1 reply; 213+ messages in thread
From: Sergei Shtylyov @ 2018-08-23 15:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On 08/23/2018 02:56 PM, Greg Kroah-Hartman wrote:
> On Thu, Aug 23, 2018 at 01:17:28PM +0200, Greg Kroah-Hartman wrote:
>> On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
>>> On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
>>>
>>>> 4.14-stable review patch. If anyone has any objections, please let me know.
>>>>
>>>> ------------------
>>>>
>>>> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>>
>>>> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>>>>
>>>> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
>>>> driver was left disabled, the kernel crashed with this BUG:
>>>>
>>>> kernel BUG at lib/ioremap.c:72!
>>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
>>>> Modules linked in:
>>>> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
>>>> Hardware name: Renesas Condor board based on r8a77980 (DT)
>>>> Workqueue: events deferred_probe_work_func
>>>> pstate: 80000005 (Nzcv daif -PAN -UAO)
>>>> pc : ioremap_page_range+0x370/0x3c8
>>>> lr : ioremap_page_range+0x40/0x3c8
>>>> sp : ffff000008da39e0
>>>> x29: ffff000008da39e0 x28: 00e8000000000f07
>>>> x27: ffff7dfffee00000 x26: 0140000000000000
>>>> x25: ffff7dfffef00000 x24: 00000000000fe100
>>>> x23: ffff80007b906000 x22: ffff000008ab8000
>>>> x21: ffff000008bb1d58 x20: ffff7dfffef00000
>>>> x19: ffff800009c30fb8 x18: 0000000000000001
>>>> x17: 00000000000152d0 x16: 00000000014012d0
>>>> x15: 0000000000000000 x14: 0720072007200720
>>>> x13: 0720072007200720 x12: 0720072007200720
>>>> x11: 0720072007300730 x10: 00000000000000ae
>>>> x9 : 0000000000000000 x8 : ffff7dffff000000
>>>> x7 : 0000000000000000 x6 : 0000000000000100
>>>> x5 : 0000000000000000 x4 : 000000007b906000
>>>> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
>>>> x1 : 0000000040000000 x0 : 00e80000fe100f07
>>>> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
>>>> Call trace:
>>>> ioremap_page_range+0x370/0x3c8
>>>> pci_remap_iospace+0x7c/0xac
>>>> pci_parse_request_of_pci_ranges+0x13c/0x190
>>>> rcar_pcie_probe+0x4c/0xb04
>>>> platform_drv_probe+0x50/0xbc
>>>> driver_probe_device+0x21c/0x308
>>>> __device_attach_driver+0x98/0xc8
>>>> bus_for_each_drv+0x54/0x94
>>>> __device_attach+0xc4/0x12c
>>>> device_initial_probe+0x10/0x18
>>>> bus_probe_device+0x90/0x98
>>>> deferred_probe_work_func+0xb0/0x150
>>>> process_one_work+0x12c/0x29c
>>>> worker_thread+0x200/0x3fc
>>>> kthread+0x108/0x134
>>>> ret_from_fork+0x10/0x18
>>>> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>>>>
>>>> It turned out that pci_remap_iospace() wasn't undone when the driver's
>>>> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
>>>> the probe was retried, finally causing the BUG due to trying to remap
>>>> already remapped pages.
>>>>
>>>> Introduce the devm_pci_remap_iospace() managed API and replace the
>>>> pci_remap_iospace() call with it to fix the bug.
>>>>
>>>> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
>>>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
>>>> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
>>>> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>>> [Backport just for the new api which other patches need - gregkh]
>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>>>
>>>> ---
>>>> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
>>>> include/linux/pci.h | 2 ++
>>>> 2 files changed, 40 insertions(+)
>>>
>>> You missed a chnage to drivers/pci/host/pci-host-common.c (and
>>> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
s/mode/code/, of course. :-)
>>> then)...
>>
>> Yes I totally messed this up, let me fix it...
>
> Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
> it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(
> thanks,
>
> greg k-h
>
> ------------------------
>
> From a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 Mon Sep 17 00:00:00 2001
> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> Date: Wed, 18 Jul 2018 15:40:26 -0500
> Subject: PCI: OF: Fix I/O space page leak
>
> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>
> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>
> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> driver was left disabled, the kernel crashed with this BUG:
>
> kernel BUG at lib/ioremap.c:72!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> Hardware name: Renesas Condor board based on r8a77980 (DT)
> Workqueue: events deferred_probe_work_func
> pstate: 80000005 (Nzcv daif -PAN -UAO)
> pc : ioremap_page_range+0x370/0x3c8
> lr : ioremap_page_range+0x40/0x3c8
> sp : ffff000008da39e0
> x29: ffff000008da39e0 x28: 00e8000000000f07
> x27: ffff7dfffee00000 x26: 0140000000000000
> x25: ffff7dfffef00000 x24: 00000000000fe100
> x23: ffff80007b906000 x22: ffff000008ab8000
> x21: ffff000008bb1d58 x20: ffff7dfffef00000
> x19: ffff800009c30fb8 x18: 0000000000000001
> x17: 00000000000152d0 x16: 00000000014012d0
> x15: 0000000000000000 x14: 0720072007200720
> x13: 0720072007200720 x12: 0720072007200720
> x11: 0720072007300730 x10: 00000000000000ae
> x9 : 0000000000000000 x8 : ffff7dffff000000
> x7 : 0000000000000000 x6 : 0000000000000100
> x5 : 0000000000000000 x4 : 000000007b906000
> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> x1 : 0000000040000000 x0 : 00e80000fe100f07
> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> Call trace:
> ioremap_page_range+0x370/0x3c8
> pci_remap_iospace+0x7c/0xac
> pci_parse_request_of_pci_ranges+0x13c/0x190
> rcar_pcie_probe+0x4c/0xb04
> platform_drv_probe+0x50/0xbc
> driver_probe_device+0x21c/0x308
> __device_attach_driver+0x98/0xc8
> bus_for_each_drv+0x54/0x94
> __device_attach+0xc4/0x12c
> device_initial_probe+0x10/0x18
> bus_probe_device+0x90/0x98
> deferred_probe_work_func+0xb0/0x150
> process_one_work+0x12c/0x29c
> worker_thread+0x200/0x3fc
> kthread+0x108/0x134
> ret_from_fork+0x10/0x18
> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>
> It turned out that pci_remap_iospace() wasn't undone when the driver's
> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> the probe was retried, finally causing the BUG due to trying to remap
> already remapped pages.
>
> Introduce the devm_pci_remap_iospace() managed API and replace the
> pci_remap_iospace() call with it to fix the bug.
>
> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 15:20 ` Sergei Shtylyov
@ 2018-08-23 15:27 ` Greg Kroah-Hartman
2018-08-23 15:33 ` Sergei Shtylyov
0 siblings, 1 reply; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 15:27 UTC (permalink / raw)
To: Sergei Shtylyov
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On Thu, Aug 23, 2018 at 06:20:31PM +0300, Sergei Shtylyov wrote:
> On 08/23/2018 02:56 PM, Greg Kroah-Hartman wrote:
> > On Thu, Aug 23, 2018 at 01:17:28PM +0200, Greg Kroah-Hartman wrote:
> >> On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
> >>> On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
> >>>
> >>>> 4.14-stable review patch. If anyone has any objections, please let me know.
> >>>>
> >>>> ------------------
> >>>>
> >>>> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> >>>>
> >>>> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
> >>>>
> >>>> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> >>>> driver was left disabled, the kernel crashed with this BUG:
> >>>>
> >>>> kernel BUG at lib/ioremap.c:72!
> >>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> >>>> Modules linked in:
> >>>> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> >>>> Hardware name: Renesas Condor board based on r8a77980 (DT)
> >>>> Workqueue: events deferred_probe_work_func
> >>>> pstate: 80000005 (Nzcv daif -PAN -UAO)
> >>>> pc : ioremap_page_range+0x370/0x3c8
> >>>> lr : ioremap_page_range+0x40/0x3c8
> >>>> sp : ffff000008da39e0
> >>>> x29: ffff000008da39e0 x28: 00e8000000000f07
> >>>> x27: ffff7dfffee00000 x26: 0140000000000000
> >>>> x25: ffff7dfffef00000 x24: 00000000000fe100
> >>>> x23: ffff80007b906000 x22: ffff000008ab8000
> >>>> x21: ffff000008bb1d58 x20: ffff7dfffef00000
> >>>> x19: ffff800009c30fb8 x18: 0000000000000001
> >>>> x17: 00000000000152d0 x16: 00000000014012d0
> >>>> x15: 0000000000000000 x14: 0720072007200720
> >>>> x13: 0720072007200720 x12: 0720072007200720
> >>>> x11: 0720072007300730 x10: 00000000000000ae
> >>>> x9 : 0000000000000000 x8 : ffff7dffff000000
> >>>> x7 : 0000000000000000 x6 : 0000000000000100
> >>>> x5 : 0000000000000000 x4 : 000000007b906000
> >>>> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> >>>> x1 : 0000000040000000 x0 : 00e80000fe100f07
> >>>> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> >>>> Call trace:
> >>>> ioremap_page_range+0x370/0x3c8
> >>>> pci_remap_iospace+0x7c/0xac
> >>>> pci_parse_request_of_pci_ranges+0x13c/0x190
> >>>> rcar_pcie_probe+0x4c/0xb04
> >>>> platform_drv_probe+0x50/0xbc
> >>>> driver_probe_device+0x21c/0x308
> >>>> __device_attach_driver+0x98/0xc8
> >>>> bus_for_each_drv+0x54/0x94
> >>>> __device_attach+0xc4/0x12c
> >>>> device_initial_probe+0x10/0x18
> >>>> bus_probe_device+0x90/0x98
> >>>> deferred_probe_work_func+0xb0/0x150
> >>>> process_one_work+0x12c/0x29c
> >>>> worker_thread+0x200/0x3fc
> >>>> kthread+0x108/0x134
> >>>> ret_from_fork+0x10/0x18
> >>>> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
> >>>>
> >>>> It turned out that pci_remap_iospace() wasn't undone when the driver's
> >>>> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> >>>> the probe was retried, finally causing the BUG due to trying to remap
> >>>> already remapped pages.
> >>>>
> >>>> Introduce the devm_pci_remap_iospace() managed API and replace the
> >>>> pci_remap_iospace() call with it to fix the bug.
> >>>>
> >>>> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> >>>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> >>>> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> >>>> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> >>>> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> >>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> >>>> [Backport just for the new api which other patches need - gregkh]
> >>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >>>>
> >>>> ---
> >>>> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> >>>> include/linux/pci.h | 2 ++
> >>>> 2 files changed, 40 insertions(+)
> >>>
> >>> You missed a chnage to drivers/pci/host/pci-host-common.c (and
> >>> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
>
> s/mode/code/, of course. :-)
>
> >>> then)...
> >>
> >> Yes I totally messed this up, let me fix it...
> >
> > Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
> > it should now be resolved, but verifying this would be nice :)
>
> Unfortunately, it doesn't fix anything on R-Car where this bug was originally
> encountered and the fix was tested... and you leave no way for it to be fixed. :-(
Really? Why not? What is missing here?
greg k-h
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 15:27 ` Greg Kroah-Hartman
@ 2018-08-23 15:33 ` Sergei Shtylyov
2018-08-23 15:41 ` Greg Kroah-Hartman
0 siblings, 1 reply; 213+ messages in thread
From: Sergei Shtylyov @ 2018-08-23 15:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On 08/23/2018 06:27 PM, Greg Kroah-Hartman wrote:
> On Thu, Aug 23, 2018 at 06:20:31PM +0300, Sergei Shtylyov wrote:
>> On 08/23/2018 02:56 PM, Greg Kroah-Hartman wrote:
>>> On Thu, Aug 23, 2018 at 01:17:28PM +0200, Greg Kroah-Hartman wrote:
>>>> On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
>>>>> On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
>>>>>
>>>>>> 4.14-stable review patch. If anyone has any objections, please let me know.
>>>>>>
>>>>>> ------------------
>>>>>>
>>>>>> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>>>>
>>>>>> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>>>>>>
>>>>>> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
>>>>>> driver was left disabled, the kernel crashed with this BUG:
>>>>>>
>>>>>> kernel BUG at lib/ioremap.c:72!
>>>>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
>>>>>> Modules linked in:
>>>>>> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
>>>>>> Hardware name: Renesas Condor board based on r8a77980 (DT)
>>>>>> Workqueue: events deferred_probe_work_func
>>>>>> pstate: 80000005 (Nzcv daif -PAN -UAO)
>>>>>> pc : ioremap_page_range+0x370/0x3c8
>>>>>> lr : ioremap_page_range+0x40/0x3c8
>>>>>> sp : ffff000008da39e0
>>>>>> x29: ffff000008da39e0 x28: 00e8000000000f07
>>>>>> x27: ffff7dfffee00000 x26: 0140000000000000
>>>>>> x25: ffff7dfffef00000 x24: 00000000000fe100
>>>>>> x23: ffff80007b906000 x22: ffff000008ab8000
>>>>>> x21: ffff000008bb1d58 x20: ffff7dfffef00000
>>>>>> x19: ffff800009c30fb8 x18: 0000000000000001
>>>>>> x17: 00000000000152d0 x16: 00000000014012d0
>>>>>> x15: 0000000000000000 x14: 0720072007200720
>>>>>> x13: 0720072007200720 x12: 0720072007200720
>>>>>> x11: 0720072007300730 x10: 00000000000000ae
>>>>>> x9 : 0000000000000000 x8 : ffff7dffff000000
>>>>>> x7 : 0000000000000000 x6 : 0000000000000100
>>>>>> x5 : 0000000000000000 x4 : 000000007b906000
>>>>>> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
>>>>>> x1 : 0000000040000000 x0 : 00e80000fe100f07
>>>>>> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
>>>>>> Call trace:
>>>>>> ioremap_page_range+0x370/0x3c8
>>>>>> pci_remap_iospace+0x7c/0xac
>>>>>> pci_parse_request_of_pci_ranges+0x13c/0x190
>>>>>> rcar_pcie_probe+0x4c/0xb04
>>>>>> platform_drv_probe+0x50/0xbc
>>>>>> driver_probe_device+0x21c/0x308
>>>>>> __device_attach_driver+0x98/0xc8
>>>>>> bus_for_each_drv+0x54/0x94
>>>>>> __device_attach+0xc4/0x12c
>>>>>> device_initial_probe+0x10/0x18
>>>>>> bus_probe_device+0x90/0x98
>>>>>> deferred_probe_work_func+0xb0/0x150
>>>>>> process_one_work+0x12c/0x29c
>>>>>> worker_thread+0x200/0x3fc
>>>>>> kthread+0x108/0x134
>>>>>> ret_from_fork+0x10/0x18
>>>>>> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>>>>>>
>>>>>> It turned out that pci_remap_iospace() wasn't undone when the driver's
>>>>>> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
>>>>>> the probe was retried, finally causing the BUG due to trying to remap
>>>>>> already remapped pages.
>>>>>>
>>>>>> Introduce the devm_pci_remap_iospace() managed API and replace the
>>>>>> pci_remap_iospace() call with it to fix the bug.
>>>>>>
>>>>>> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
>>>>>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>>>> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
>>>>>> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
>>>>>> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
>>>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>>>>> [Backport just for the new api which other patches need - gregkh]
>>>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>>>>>
>>>>>> ---
>>>>>> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
>>>>>> include/linux/pci.h | 2 ++
>>>>>> 2 files changed, 40 insertions(+)
>>>>>
>>>>> You missed a chnage to drivers/pci/host/pci-host-common.c (and
>>>>> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
>>
>> s/mode/code/, of course. :-)
>>
>>>>> then)...
>>>>
>>>> Yes I totally messed this up, let me fix it...
>>>
>>> Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
>>> it should now be resolved, but verifying this would be nice :)
>>
>> Unfortunately, it doesn't fix anything on R-Car where this bug was originally
>> encountered and the fix was tested... and you leave no way for it to be fixed. :-(
>
> Really? Why not? What is missing here?
You just need to fix drivers/pci/host/pcie-rcar.c in this same patch -- because
this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started
using the common "PCI-resource-walker" function factored out from pci-host-common.c
somewhere around 4.17, IIRC...
> greg k-h
MBR, Sergei
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 15:33 ` Sergei Shtylyov
@ 2018-08-23 15:41 ` Greg Kroah-Hartman
2018-08-23 19:54 ` Sergei Shtylyov
0 siblings, 1 reply; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 15:41 UTC (permalink / raw)
To: Sergei Shtylyov
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On Thu, Aug 23, 2018 at 06:33:47PM +0300, Sergei Shtylyov wrote:
> On 08/23/2018 06:27 PM, Greg Kroah-Hartman wrote:
> > On Thu, Aug 23, 2018 at 06:20:31PM +0300, Sergei Shtylyov wrote:
> >> On 08/23/2018 02:56 PM, Greg Kroah-Hartman wrote:
> >>> On Thu, Aug 23, 2018 at 01:17:28PM +0200, Greg Kroah-Hartman wrote:
> >>>> On Thu, Aug 23, 2018 at 01:57:35PM +0300, Sergei Shtylyov wrote:
> >>>>> On 08/23/2018 10:55 AM, Greg Kroah-Hartman wrote:
> >>>>>
> >>>>>> 4.14-stable review patch. If anyone has any objections, please let me know.
> >>>>>>
> >>>>>> ------------------
> >>>>>>
> >>>>>> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> >>>>>>
> >>>>>> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
> >>>>>>
> >>>>>> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> >>>>>> driver was left disabled, the kernel crashed with this BUG:
> >>>>>>
> >>>>>> kernel BUG at lib/ioremap.c:72!
> >>>>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> >>>>>> Modules linked in:
> >>>>>> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> >>>>>> Hardware name: Renesas Condor board based on r8a77980 (DT)
> >>>>>> Workqueue: events deferred_probe_work_func
> >>>>>> pstate: 80000005 (Nzcv daif -PAN -UAO)
> >>>>>> pc : ioremap_page_range+0x370/0x3c8
> >>>>>> lr : ioremap_page_range+0x40/0x3c8
> >>>>>> sp : ffff000008da39e0
> >>>>>> x29: ffff000008da39e0 x28: 00e8000000000f07
> >>>>>> x27: ffff7dfffee00000 x26: 0140000000000000
> >>>>>> x25: ffff7dfffef00000 x24: 00000000000fe100
> >>>>>> x23: ffff80007b906000 x22: ffff000008ab8000
> >>>>>> x21: ffff000008bb1d58 x20: ffff7dfffef00000
> >>>>>> x19: ffff800009c30fb8 x18: 0000000000000001
> >>>>>> x17: 00000000000152d0 x16: 00000000014012d0
> >>>>>> x15: 0000000000000000 x14: 0720072007200720
> >>>>>> x13: 0720072007200720 x12: 0720072007200720
> >>>>>> x11: 0720072007300730 x10: 00000000000000ae
> >>>>>> x9 : 0000000000000000 x8 : ffff7dffff000000
> >>>>>> x7 : 0000000000000000 x6 : 0000000000000100
> >>>>>> x5 : 0000000000000000 x4 : 000000007b906000
> >>>>>> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> >>>>>> x1 : 0000000040000000 x0 : 00e80000fe100f07
> >>>>>> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> >>>>>> Call trace:
> >>>>>> ioremap_page_range+0x370/0x3c8
> >>>>>> pci_remap_iospace+0x7c/0xac
> >>>>>> pci_parse_request_of_pci_ranges+0x13c/0x190
> >>>>>> rcar_pcie_probe+0x4c/0xb04
> >>>>>> platform_drv_probe+0x50/0xbc
> >>>>>> driver_probe_device+0x21c/0x308
> >>>>>> __device_attach_driver+0x98/0xc8
> >>>>>> bus_for_each_drv+0x54/0x94
> >>>>>> __device_attach+0xc4/0x12c
> >>>>>> device_initial_probe+0x10/0x18
> >>>>>> bus_probe_device+0x90/0x98
> >>>>>> deferred_probe_work_func+0xb0/0x150
> >>>>>> process_one_work+0x12c/0x29c
> >>>>>> worker_thread+0x200/0x3fc
> >>>>>> kthread+0x108/0x134
> >>>>>> ret_from_fork+0x10/0x18
> >>>>>> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
> >>>>>>
> >>>>>> It turned out that pci_remap_iospace() wasn't undone when the driver's
> >>>>>> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> >>>>>> the probe was retried, finally causing the BUG due to trying to remap
> >>>>>> already remapped pages.
> >>>>>>
> >>>>>> Introduce the devm_pci_remap_iospace() managed API and replace the
> >>>>>> pci_remap_iospace() call with it to fix the bug.
> >>>>>>
> >>>>>> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> >>>>>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> >>>>>> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> >>>>>> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> >>>>>> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> >>>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> >>>>>> [Backport just for the new api which other patches need - gregkh]
> >>>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >>>>>>
> >>>>>> ---
> >>>>>> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> >>>>>> include/linux/pci.h | 2 ++
> >>>>>> 2 files changed, 40 insertions(+)
> >>>>>
> >>>>> You missed a chnage to drivers/pci/host/pci-host-common.c (and
> >>>>> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
> >>
> >> s/mode/code/, of course. :-)
> >>
> >>>>> then)...
> >>>>
> >>>> Yes I totally messed this up, let me fix it...
> >>>
> >>> Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
> >>> it should now be resolved, but verifying this would be nice :)
> >>
> >> Unfortunately, it doesn't fix anything on R-Car where this bug was originally
> >> encountered and the fix was tested... and you leave no way for it to be fixed. :-(
> >
> > Really? Why not? What is missing here?
>
> You just need to fix drivers/pci/host/pcie-rcar.c in this same patch -- because
> this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started
> using the common "PCI-resource-walker" function factored out from pci-host-common.c
> somewhere around 4.17, IIRC...
Ok, can you send me a patch that does that please? Otherwise I really
don't know how to exactly "fix" that at the moment.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
2018-08-23 15:41 ` Greg Kroah-Hartman
@ 2018-08-23 19:54 ` Sergei Shtylyov
0 siblings, 0 replies; 213+ messages in thread
From: Sergei Shtylyov @ 2018-08-23 19:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On 08/23/2018 06:41 PM, Greg Kroah-Hartman wrote:
>>>>>>>> 4.14-stable review patch. If anyone has any objections, please let me know.
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>>
>>>>>>>> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>>>>>>
>>>>>>>> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>>>>>>>>
>>>>>>>> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
>>>>>>>> driver was left disabled, the kernel crashed with this BUG:
>>>>>>>>
>>>>>>>> kernel BUG at lib/ioremap.c:72!
>>>>>>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
>>>>>>>> Modules linked in:
>>>>>>>> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
>>>>>>>> Hardware name: Renesas Condor board based on r8a77980 (DT)
>>>>>>>> Workqueue: events deferred_probe_work_func
>>>>>>>> pstate: 80000005 (Nzcv daif -PAN -UAO)
>>>>>>>> pc : ioremap_page_range+0x370/0x3c8
>>>>>>>> lr : ioremap_page_range+0x40/0x3c8
>>>>>>>> sp : ffff000008da39e0
>>>>>>>> x29: ffff000008da39e0 x28: 00e8000000000f07
>>>>>>>> x27: ffff7dfffee00000 x26: 0140000000000000
>>>>>>>> x25: ffff7dfffef00000 x24: 00000000000fe100
>>>>>>>> x23: ffff80007b906000 x22: ffff000008ab8000
>>>>>>>> x21: ffff000008bb1d58 x20: ffff7dfffef00000
>>>>>>>> x19: ffff800009c30fb8 x18: 0000000000000001
>>>>>>>> x17: 00000000000152d0 x16: 00000000014012d0
>>>>>>>> x15: 0000000000000000 x14: 0720072007200720
>>>>>>>> x13: 0720072007200720 x12: 0720072007200720
>>>>>>>> x11: 0720072007300730 x10: 00000000000000ae
>>>>>>>> x9 : 0000000000000000 x8 : ffff7dffff000000
>>>>>>>> x7 : 0000000000000000 x6 : 0000000000000100
>>>>>>>> x5 : 0000000000000000 x4 : 000000007b906000
>>>>>>>> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
>>>>>>>> x1 : 0000000040000000 x0 : 00e80000fe100f07
>>>>>>>> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
>>>>>>>> Call trace:
>>>>>>>> ioremap_page_range+0x370/0x3c8
>>>>>>>> pci_remap_iospace+0x7c/0xac
>>>>>>>> pci_parse_request_of_pci_ranges+0x13c/0x190
>>>>>>>> rcar_pcie_probe+0x4c/0xb04
>>>>>>>> platform_drv_probe+0x50/0xbc
>>>>>>>> driver_probe_device+0x21c/0x308
>>>>>>>> __device_attach_driver+0x98/0xc8
>>>>>>>> bus_for_each_drv+0x54/0x94
>>>>>>>> __device_attach+0xc4/0x12c
>>>>>>>> device_initial_probe+0x10/0x18
>>>>>>>> bus_probe_device+0x90/0x98
>>>>>>>> deferred_probe_work_func+0xb0/0x150
>>>>>>>> process_one_work+0x12c/0x29c
>>>>>>>> worker_thread+0x200/0x3fc
>>>>>>>> kthread+0x108/0x134
>>>>>>>> ret_from_fork+0x10/0x18
>>>>>>>> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>>>>>>>>
>>>>>>>> It turned out that pci_remap_iospace() wasn't undone when the driver's
>>>>>>>> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
>>>>>>>> the probe was retried, finally causing the BUG due to trying to remap
>>>>>>>> already remapped pages.
>>>>>>>>
>>>>>>>> Introduce the devm_pci_remap_iospace() managed API and replace the
>>>>>>>> pci_remap_iospace() call with it to fix the bug.
>>>>>>>>
>>>>>>>> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
>>>>>>>> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>>>>>>>> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
>>>>>>>> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
>>>>>>>> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
>>>>>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>>>>>>> [Backport just for the new api which other patches need - gregkh]
>>>>>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>>>>>>>
>>>>>>>> ---
>>>>>>>> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
>>>>>>>> include/linux/pci.h | 2 ++
>>>>>>>> 2 files changed, 40 insertions(+)
>>>>>>>
>>>>>>> You missed a chnage to drivers/pci/host/pci-host-common.c (and
>>>>>>> also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back
>>>>
>>>> s/mode/code/, of course. :-)
>>>>
>>>>>>> then)...
>>>>>>
>>>>>> Yes I totally messed this up, let me fix it...
>>>>>
>>>>> Ok, below is the patch that I replaced the 4.14 and 4.9 versions with,
>>>>> it should now be resolved, but verifying this would be nice :)
>>>>
>>>> Unfortunately, it doesn't fix anything on R-Car where this bug was originally
>>>> encountered and the fix was tested... and you leave no way for it to be fixed. :-(
>>>
>>> Really? Why not? What is missing here?
>>
>> You just need to fix drivers/pci/host/pcie-rcar.c in this same patch -- because
>> this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started
>> using the common "PCI-resource-walker" function factored out from pci-host-common.c
>> somewhere around 4.17, IIRC...
>
> Ok, can you send me a patch that does that please? Otherwise I really
> don't know how to exactly "fix" that at the moment.
I'd told you I could do it. :-) Sending...
> thanks,
>
> greg k-h
MBR, Sergei
^ permalink raw reply [flat|nested] 213+ messages in thread
* [PATCH 4.14 211/217] PCI: hotplug: Dont leak pci_slot on registration failure
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (194 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 212/217] PCI: Skip MPS logic for Virtual Functions (VFs) Greg Kroah-Hartman
` (7 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas,
Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 4ce6435820d1f1cc2c2788e232735eb244bcc8a3 upstream.
If addition of sysfs files fails on registration of a hotplug slot, the
struct pci_slot as well as the entry in the slot_list is leaked. The
issue has been present since the hotplug core was introduced in 2002:
https://git.kernel.org/tglx/history/c/a8a2069f432c
Perhaps the idea was that even though sysfs addition fails, the slot
should still be usable. But that's not how drivers use the interface,
they abort probe if a non-zero value is returned.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.4.15+
Cc: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pci_hotplug_core.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -452,8 +452,17 @@ int __pci_hp_register(struct hotplug_slo
list_add(&slot->slot_list, &pci_hotplug_slot_list);
result = fs_add_slot(pci_slot);
+ if (result)
+ goto err_list_del;
+
kobject_uevent(&pci_slot->kobj, KOBJ_ADD);
dbg("Added slot %s to the list\n", name);
+ goto out;
+
+err_list_del:
+ list_del(&slot->slot_list);
+ pci_slot->hotplug = NULL;
+ pci_destroy_slot(pci_slot);
out:
mutex_unlock(&pci_hp_mutex);
return result;
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 212/217] PCI: Skip MPS logic for Virtual Functions (VFs)
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (195 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 211/217] PCI: hotplug: Dont leak pci_slot on registration failure Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 213/217] PCI: pciehp: Fix use-after-free on unplug Greg Kroah-Hartman
` (6 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Myron Stowe, Bjorn Helgaas,
Keith Busch, Sinan Kaya, Dongdong Liu, Jon Mason
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myron Stowe <myron.stowe@redhat.com>
commit 3dbe97efe8bf450b183d6dee2305cbc032e6b8a4 upstream.
PCIe r4.0, sec 9.3.5.4, "Device Control Register", shows both
Max_Payload_Size (MPS) and Max_Read_request_Size (MRRS) to be 'RsvdP' for
VFs. Just prior to the table it states:
"PF and VF functionality is defined in Section 7.5.3.4 except where
noted in Table 9-16. For VF fields marked 'RsvdP', the PF setting
applies to the VF."
All of which implies that with respect to Max_Payload_Size Supported
(MPSS), MPS, and MRRS values, we should not be paying any attention to the
VF's fields, but rather only to the PF's. Only looking at the PF's fields
also logically makes sense as it's the sole physical interface to the PCIe
bus.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=200527
Fixes: 27d868b5e6cf ("PCI: Set MPS to match upstream bridge")
Signed-off-by: Myron Stowe <myron.stowe@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # 4.3+
Cc: Keith Busch <keith.busch@intel.com>
Cc: Sinan Kaya <okaya@kernel.org>
Cc: Dongdong Liu <liudongdong3@huawei.com>
Cc: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/probe.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1560,6 +1560,10 @@ static void pci_configure_mps(struct pci
if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
return;
+ /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */
+ if (dev->is_virtfn)
+ return;
+
mps = pcie_get_mps(dev);
p_mps = pcie_get_mps(bridge);
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 213/217] PCI: pciehp: Fix use-after-free on unplug
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (196 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 212/217] PCI: Skip MPS logic for Virtual Functions (VFs) Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 214/217] PCI: pciehp: Fix unprotected list iteration in IRQ handler Greg Kroah-Hartman
` (5 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 281e878eab191cce4259abbbf1a0322e3adae02c upstream.
When pciehp is unbound (e.g. on unplug of a Thunderbolt device), the
hotplug_slot struct is deregistered and thus freed before freeing the
IRQ. The IRQ handler and the work items it schedules print the slot
name referenced from the freed structure in various informational and
debug log messages, each time resulting in a quadruple dereference of
freed pointers (hotplug_slot -> pci_slot -> kobject -> name).
At best the slot name is logged as "(null)", at worst kernel memory is
exposed in logs or the driver crashes:
pciehp 0000:10:00.0:pcie204: Slot((null)): Card not present
An attacker may provoke the bug by unplugging multiple devices on a
Thunderbolt daisy chain at once. Unplugging can also be simulated by
powering down slots via sysfs. The bug is particularly easy to trigger
in poll mode.
It has been present since the driver's introduction in 2004:
https://git.kernel.org/tglx/history/c/c16b4b14d980
Fix by rearranging teardown such that the IRQ is freed first. Run the
work items queued by the IRQ handler to completion before freeing the
hotplug_slot struct by draining the work queue from the ->release_slot
callback which is invoked by pci_hp_deregister().
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.6.4
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pciehp.h | 1 +
drivers/pci/hotplug/pciehp_core.c | 7 +++++++
drivers/pci/hotplug/pciehp_hpc.c | 5 ++---
3 files changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -132,6 +132,7 @@ int pciehp_unconfigure_device(struct slo
void pciehp_queue_pushbutton_work(struct work_struct *work);
struct controller *pcie_init(struct pcie_device *dev);
int pcie_init_notification(struct controller *ctrl);
+void pcie_shutdown_notification(struct controller *ctrl);
int pciehp_enable_slot(struct slot *p_slot);
int pciehp_disable_slot(struct slot *p_slot);
void pcie_reenable_notification(struct controller *ctrl);
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -76,6 +76,12 @@ static int reset_slot(struct hotplug_slo
*/
static void release_slot(struct hotplug_slot *hotplug_slot)
{
+ struct slot *slot = hotplug_slot->private;
+
+ /* queued work needs hotplug_slot name */
+ cancel_delayed_work(&slot->work);
+ drain_workqueue(slot->wq);
+
kfree(hotplug_slot->ops);
kfree(hotplug_slot->info);
kfree(hotplug_slot);
@@ -278,6 +284,7 @@ static void pciehp_remove(struct pcie_de
{
struct controller *ctrl = get_service_data(dev);
+ pcie_shutdown_notification(ctrl);
cleanup_slot(ctrl);
pciehp_release_ctrl(ctrl);
}
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -789,7 +789,7 @@ int pcie_init_notification(struct contro
return 0;
}
-static void pcie_shutdown_notification(struct controller *ctrl)
+void pcie_shutdown_notification(struct controller *ctrl)
{
if (ctrl->notification_enabled) {
pcie_disable_notification(ctrl);
@@ -824,7 +824,7 @@ abort:
static void pcie_cleanup_slot(struct controller *ctrl)
{
struct slot *slot = ctrl->slot;
- cancel_delayed_work(&slot->work);
+
destroy_workqueue(slot->wq);
kfree(slot);
}
@@ -912,7 +912,6 @@ abort:
void pciehp_release_ctrl(struct controller *ctrl)
{
- pcie_shutdown_notification(ctrl);
pcie_cleanup_slot(ctrl);
kfree(ctrl);
}
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 214/217] PCI: pciehp: Fix unprotected list iteration in IRQ handler
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (197 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 213/217] PCI: pciehp: Fix use-after-free on unplug Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 215/217] i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes Greg Kroah-Hartman
` (4 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 1204e35bedf4e5015cda559ed8c84789a6dae24e upstream.
Commit b440bde74f04 ("PCI: Add pci_ignore_hotplug() to ignore hotplug
events for a device") iterates over the devices on a hotplug port's
subordinate bus in pciehp's IRQ handler without acquiring pci_bus_sem.
It is thus possible for a user to cause a crash by concurrently
manipulating the device list, e.g. by disabling slot power via sysfs
on a different CPU or by initiating a remove/rescan via sysfs.
This can't be fixed by acquiring pci_bus_sem because it may sleep.
The simplest fix is to avoid the list iteration altogether and just
check the ignore_hotplug flag on the port itself. This works because
pci_ignore_hotplug() sets the flag both on the device as well as on its
parent bridge.
We do lose the ability to print the name of the device blocking hotplug
in the debug message, but that's probably bearable.
Fixes: b440bde74f04 ("PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pciehp_hpc.c | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -562,8 +562,6 @@ static irqreturn_t pciehp_isr(int irq, v
{
struct controller *ctrl = (struct controller *)dev_id;
struct pci_dev *pdev = ctrl_dev(ctrl);
- struct pci_bus *subordinate = pdev->subordinate;
- struct pci_dev *dev;
struct slot *slot = ctrl->slot;
u16 status, events;
u8 present;
@@ -611,14 +609,9 @@ static irqreturn_t pciehp_isr(int irq, v
wake_up(&ctrl->queue);
}
- if (subordinate) {
- list_for_each_entry(dev, &subordinate->devices, bus_list) {
- if (dev->ignore_hotplug) {
- ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n",
- events, pci_name(dev));
- return IRQ_HANDLED;
- }
- }
+ if (pdev->ignore_hotplug) {
+ ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events);
+ return IRQ_HANDLED;
}
/* Check Attention Button Pressed */
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 215/217] i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (198 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 214/217] PCI: pciehp: Fix unprotected list iteration in IRQ handler Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 7:55 ` [PATCH 4.14 217/217] reiserfs: fix broken xattr handling (heap corruption, bad retval) Greg Kroah-Hartman
` (3 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Mika Westerberg, Wolfram Sang
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit c463a158cb6c5d9a85b7d894cd4f8116e8bd6be0 upstream.
acpi_gsb_i2c_write_bytes() returns i2c_transfer()'s return value, which
is the number of transfers executed on success, so 1.
The ACPI code expects us to store 0 in gsb->status for success, not 1.
Specifically this breaks the following code in the Thinkpad 8 DSDT:
ECWR = I2CW = ECWR /* \_SB_.I2C1.BAT0.ECWR */
If ((ECST == Zero))
{
ECRD = I2CR /* \_SB_.I2C1.I2CR */
}
Before this commit we set ECST to 1, causing the read to never happen
breaking battery monitoring on the Thinkpad 8.
This commit makes acpi_gsb_i2c_write_bytes() return 0 when i2c_transfer()
returns 1, so the single write transfer completed successfully, and
makes it return -EIO on for other (unexpected) return values >= 0.
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-acpi.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -475,11 +475,16 @@ static int acpi_gsb_i2c_write_bytes(stru
msgs[0].buf = buffer;
ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
- if (ret < 0)
- dev_err(&client->adapter->dev, "i2c write failed\n");
kfree(buffer);
- return ret;
+
+ if (ret < 0) {
+ dev_err(&client->adapter->dev, "i2c write failed: %d\n", ret);
+ return ret;
+ }
+
+ /* 1 transfer must have completed successfully */
+ return (ret == 1) ? 0 : -EIO;
}
static acpi_status
^ permalink raw reply [flat|nested] 213+ messages in thread* [PATCH 4.14 217/217] reiserfs: fix broken xattr handling (heap corruption, bad retval)
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (199 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 215/217] i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes Greg Kroah-Hartman
@ 2018-08-23 7:55 ` Greg Kroah-Hartman
2018-08-23 19:17 ` [PATCH 4.14 000/217] 4.14.67-stable review Shuah Khan
` (2 subsequent siblings)
203 siblings, 0 replies; 213+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Jeff Mahoney,
Eric Biggers, Al Viro, Andrew Morton, Linus Torvalds
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit a13f085d111e90469faf2d9965eb39b11c114d7e upstream.
This fixes the following issues:
- When a buffer size is supplied to reiserfs_listxattr() such that each
individual name fits, but the concatenation of all names doesn't fit,
reiserfs_listxattr() overflows the supplied buffer. This leads to a
kernel heap overflow (verified using KASAN) followed by an out-of-bounds
usercopy and is therefore a security bug.
- When a buffer size is supplied to reiserfs_listxattr() such that a
name doesn't fit, -ERANGE should be returned. But reiserfs instead just
truncates the list of names; I have verified that if the only xattr on a
file has a longer name than the supplied buffer length, listxattr()
incorrectly returns zero.
With my patch applied, -ERANGE is returned in both cases and the memory
corruption doesn't happen anymore.
Credit for making me clean this code up a bit goes to Al Viro, who pointed
out that the ->actor calling convention is suboptimal and should be
changed.
Link: http://lkml.kernel.org/r/20180802151539.5373-1-jannh@google.com
Fixes: 48b32a3553a5 ("reiserfs: use generic xattr handlers")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/reiserfs/xattr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_c
return 0;
size = namelen + 1;
if (b->buf) {
- if (size > b->size)
+ if (b->pos + size > b->size) {
+ b->pos = -ERANGE;
return -ERANGE;
+ }
memcpy(b->buf + b->pos, name, namelen);
b->buf[b->pos + namelen] = 0;
}
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 000/217] 4.14.67-stable review
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (200 preceding siblings ...)
2018-08-23 7:55 ` [PATCH 4.14 217/217] reiserfs: fix broken xattr handling (heap corruption, bad retval) Greg Kroah-Hartman
@ 2018-08-23 19:17 ` Shuah Khan
2018-08-23 20:11 ` Guenter Roeck
2018-08-24 5:19 ` Naresh Kamboju
203 siblings, 0 replies; 213+ messages in thread
From: Shuah Khan @ 2018-08-23 19:17 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 08/23/2018 01:51 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.14.67 release.
> There are 217 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:54:25 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.67-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 000/217] 4.14.67-stable review
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (201 preceding siblings ...)
2018-08-23 19:17 ` [PATCH 4.14 000/217] 4.14.67-stable review Shuah Khan
@ 2018-08-23 20:11 ` Guenter Roeck
2018-08-24 5:19 ` Naresh Kamboju
203 siblings, 0 replies; 213+ messages in thread
From: Guenter Roeck @ 2018-08-23 20:11 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Thu, Aug 23, 2018 at 09:51:53AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.14.67 release.
> There are 217 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:54:25 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 148 pass: 148 fail: 0
Qemu test results:
total: 299 pass: 299 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 213+ messages in thread* Re: [PATCH 4.14 000/217] 4.14.67-stable review
2018-08-23 7:51 [PATCH 4.14 000/217] 4.14.67-stable review Greg Kroah-Hartman
` (202 preceding siblings ...)
2018-08-23 20:11 ` Guenter Roeck
@ 2018-08-24 5:19 ` Naresh Kamboju
203 siblings, 0 replies; 213+ messages in thread
From: Naresh Kamboju @ 2018-08-24 5:19 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable
On 23 August 2018 at 13:21, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 4.14.67 release.
> There are 217 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:54:25 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.67-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.14.67-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: c896707b8c8af7d51ca8575c395d03418984c94c
git describe: v4.14.66-218-gc896707b8c8a
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.66-218-gc896707b8c8a
No regressions (compared to build v4.14.65)
Ran 12451 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- juno-r2 - arm64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 213+ messages in thread