linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 4.20 000/352] 4.20.8-stable review
@ 2019-02-11 14:13 Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 001/352] drm/bufs: Fix Spectre v1 vulnerability Greg Kroah-Hartman
                   ` (354 more replies)
  0 siblings, 355 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.20.8 release.
There are 352 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.20.8-rc1

Trond Myklebust <trondmy@gmail.com>
    nfsd: Fix error return values for nfsd4_clone_file_range()

Huacai Chen <chenhc@lemote.com>
    cacheinfo: Keep the old value if of_property_read_u32 fails

Chris Brandt <chris.brandt@renesas.com>
    serial: sh-sci: Do not free irqs that have already been freed

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    serial: 8250_pci: Make PCI class test non fatal

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    serial: fix race between flush_to_ldisc and tty_open

Gustavo A. R. Silva <gustavo@embeddedor.com>
    perf tests evsel-tp-sched: Fix bitwise operator

Mark Rutland <mark.rutland@arm.com>
    perf/core: Don't WARN() for impossible ring-buffer sizes

Tony Luck <tony.luck@intel.com>
    x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()

Peter Zijlstra <peterz@infradead.org>
    perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/uncore: Add Node ID mask

Josh Poimboeuf <jpoimboe@redhat.com>
    cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM

Peter Shier <pshier@google.com>
    KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)

Jann Horn <jannh@google.com>
    kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)

James Bottomley <James.Bottomley@HansenPartnership.com>
    scsi: aic94xx: fix module loading

Vaibhav Jain <vaibhav@linux.ibm.com>
    scsi: cxlflash: Prevent deadlock when adapter probe fails

Damien Le Moal <damien.lemoal@wdc.com>
    scsi: sd_zbc: Fix zone information messages

Johan Hovold <johan@kernel.org>
    staging: speakup: fix tty-operation NULL derefs

Paul Elder <paul.elder@ideasonboard.com>
    usb: gadget: musb: fix short isoc packets with inventra dma

Gustavo A. R. Silva <gustavo@embeddedor.com>
    usb: gadget: udc: net2272: Fix bitwise and boolean operations

Tejas Joglekar <tejas.joglekar@synopsys.com>
    usb: dwc3: gadget: Handle 0 xfer length for OUT EP

Bin Liu <b-liu@ti.com>
    usb: phy: am335x: fix race condition in _probe

Jernej Skrabec <jernej.skrabec@siol.net>
    arm64: dts: allwinner: a64: Fix USB OTG regulator

Marc Zyngier <marc.zyngier@arm.com>
    irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID

Thomas Gleixner <tglx@linutronix.de>
    futex: Handle early deadlock return correctly

Leonid Iziumtsev <leonid.iziumtsev@gmail.com>
    dmaengine: imx-dma: fix wrong callback invoke

Lukas Wunner <lukas@wunner.de>
    dmaengine: bcm2835: Fix abort of transactions

Lukas Wunner <lukas@wunner.de>
    dmaengine: bcm2835: Fix interrupt race on RT

Vladis Dronov <vdronov@redhat.com>
    HID: debug: fix the ring buffer implementation

Miklos Szeredi <mszeredi@redhat.com>
    cuse: fix ioctl

Miklos Szeredi <mszeredi@redhat.com>
    fuse: handle zero sized retrieve correctly

Miklos Szeredi <mszeredi@redhat.com>
    fuse: decrement NR_WRITEBACK_TEMP on the right page

Jann Horn <jannh@google.com>
    fuse: call pipe_buf_release() under pipe lock

Jeremy Soller <jeremy@system76.com>
    ALSA: hda/realtek - Headset microphone support for System76 darp5

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek - Use a common helper for hp pin reference

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Fix lose hp_pins for disable auto mute

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Serialize codec registrations

Udo Eberhardt <udo.eberhardt@thesycon.de>
    ALSA: usb-audio: Add support for new T+A USB DAC

Charles Keepax <ckeepax@opensource.cirrus.com>
    ALSA: compress: Fix stop handling on compressed capture streams

Brian Foster <bfoster@redhat.com>
    xfs: eof trim writeback mapping as soon as it is cached

Cong Wang <xiyou.wangcong@gmail.com>
    net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames

Guy Shattah <sguy@mellanox.com>
    net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows

Arun Parameswaran <arun.parameswaran@broadcom.com>
    net: dsa: b53: Fix for failure when irq is not defined in dt

Petr Machata <petrm@mellanox.com>
    net: cls_flower: Remove filter from mask before freeing it

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Disable interrupts when allocating CP rings or NQs.

Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    virtio_net: Account for tx bytes and packets on sending xdp_frames

Dan Carpenter <dan.carpenter@oracle.com>
    skge: potential memory corruption in skge_get_regs()

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    sctp: walk the list of asoc safely

Xin Long <lucien.xin@gmail.com>
    sctp: check and update stream->out_curr when allocating stream_out

Eric Dumazet <edumazet@google.com>
    rxrpc: bad unlock balance in rxrpc_recvmsg

Russell King <rmk+kernel@armlinux.org.uk>
    Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x"

Eric Dumazet <edumazet@google.com>
    rds: fix refcount bug in rds_sock_addref

Florian Fainelli <f.fainelli@gmail.com>
    net: systemport: Fix WoL with password after deep sleep

Rundong Ge <rdong.ge@gmail.com>
    net: dsa: slave: Don't propagate flag changes on down slave interfaces

Andrew Lunn <andrew@lunn.ch>
    net: dsa: mv88e6xxx: Fix counting of ATU violations

Dan Carpenter <dan.carpenter@oracle.com>
    net: dsa: Fix NULL checking in dsa_slave_set_eee()

Marc Zyngier <marc.zyngier@arm.com>
    net: dsa: Fix lockdep false positive splat

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    net: dp83640: expire old TX-skb

Bart Van Assche <bvanassche@acm.org>
    lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically

Govindarajulu Varadarajan <gvaradar@cisco.com>
    enic: fix checksum validation for IPv6

Eric Dumazet <edumazet@google.com>
    dccp: fool proof ccid_hc_[rt]x_parse_options()

Eduardo Valentin <edubezval@gmail.com>
    thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Don't wake pending tasks until disconnect is done

Du Changbin <changbin.du@gmail.com>
    scripts/gdb: fix lx-version string output

Anders Roxell <anders.roxell@linaro.org>
    kernel/kcov.c: mark write_comp_data() as notrace

Oleg Nesterov <oleg@redhat.com>
    exec: load_script: don't blindly truncate shebang string

Davidlohr Bueso <dave@stgolabs.net>
    fs/epoll: drop ovflist branch prediction

Liu, Chuansheng <chuansheng.liu@intel.com>
    kernel/hung_task.c: force console verbose before panic

Cheng Lin <cheng.lin130@zte.com.cn>
    proc/sysctl: fix return error for proc_doulongvec_minmax()

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    kernel/hung_task.c: break RCU locks based on jiffies

Benjamin Gordon <bmgordon@google.com>
    fs/proc/base.c: use ns_capable instead of capable for timerslack_ns

Dave Martin <Dave.Martin@arm.com>
    arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition

Aditya Pakki <pakki001@umn.edu>
    HID: lenovo: Add checks to fix of_led_classdev_register

Bjorn Andersson <bjorn.andersson@linaro.org>
    thermal: generic-adc: Fix adc to temp interpolation

Finn Thain <fthain@telegraphics.com.au>
    block/swim3: Fix regression on PowerBook G3

Richard Zhu <hongxing.zhu@nxp.com>
    PCI: imx: Enable MSI from downstream components

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    thermal: tsens: qcom: do not create duplicate regmap debugfs entries

Douglas Anderson <dianders@chromium.org>
    kdb: Don't back trace on a cpu that didn't round up

Matthias Brugger <mbrugger@suse.com>
    thermal: bcm2835: enable hwmon explicitly

Finn Thain <fthain@telegraphics.com.au>
    block/swim3: Fix -EBUSY error when re-opening device after unmount

Scott Wood <oss@buserror.net>
    fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()

Wenwen Wang <wang6495@umn.edu>
    gdrom: fix a memory leak bug

Jia-Ju Bai <baijiaju1990@gmail.com>
    isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()

Minchan Kim <minchan@kernel.org>
    zram: fix lockdep warning of free block handling

Waiman Long <longman@redhat.com>
    mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init

Larry Chen <lchen@suse.com>
    ocfs2: improve ocfs2 Makefile

Junxiao Bi <junxiao.bi@oracle.com>
    ocfs2: don't clear bh uptodate for block read

Randy Dunlap <rdunlap@infradead.org>
    arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning

Marc Zyngier <marc.zyngier@arm.com>
    scripts/decode_stacktrace: only strip base path when a prefix of the path

Jiri Olsa <jolsa@kernel.org>
    perf python: Do not force closing original perf descriptor in evlist.get_pollfd()

Ondrej Mosnacek <omosnace@redhat.com>
    cgroup: fix parsing empty mount option string

Sahitya Tummala <stummala@codeaurora.org>
    f2fs: fix sbi->extent_list corruption issue

Kangjie Lu <kjlu@umn.edu>
    niu: fix missing checks of niu_pci_eeprom_read

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Avoid marking pages with "changed protection"

Sahitya Tummala <stummala@codeaurora.org>
    f2fs: fix use-after-free issue when accessing sbi->stat_info

Ronnie Sahlberg <lsahlber@redhat.com>
    cifs: check ntwrk_buf_start for NULL before dereferencing it

Stefan Roese <sr@denx.de>
    MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8

Nathan Chancellor <natechancellor@gmail.com>
    crypto: ux500 - Use proper enum in hash_set_dma_transfer

Nathan Chancellor <natechancellor@gmail.com>
    crypto: ux500 - Use proper enum in cryp_set_dma_transfer

Michael Ellerman <mpe@ellerman.id.au>
    seq_buf: Make seq_buf_puts() null-terminate the buffer

Kangjie Lu <kjlu@umn.edu>
    hwmon: (lm80) fix a missing check of bus read in lm80 probe

Kangjie Lu <kjlu@umn.edu>
    hwmon: (lm80) fix a missing check of the status of SMBus read

Stanislav Fomichev <sdf@google.com>
    perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz

Chris Perl <cperl@janestreet.com>
    NFS: nfs_compare_mount_options always compare auth flavors.

Jim Mattson <jmattson@google.com>
    kvm: Change offset in kvm_write_guest_offset_cached to unsigned

Vitaly Kuznetsov <vkuznets@redhat.com>
    selftests: kvm: report failed stage when exit reason is unexpected

Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
    powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.

Vitaly Kuznetsov <vkuznets@redhat.com>
    KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins

John Fastabend <john.fastabend@gmail.com>
    bpf: sk_msg, fix socket data_ready events

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/mm: Fix reporting of kernel execute faults on the 8xx

John Fastabend <john.fastabend@gmail.com>
    bpf: sk_msg, zap ingress queue on psock down

Noralf Trønnes <noralf@tronnes.org>
    fbdev: fbcon: Fix unregister crash when more than one framebuffer

Lenny Szubowicz <lszubowi@redhat.com>
    ACPI/APEI: Clear GHES block_status before panic()

Kai-Heng Feng <kai.heng.feng@canonical.com>
    igb: Fix an issue that PME is not enabled during runtime suspend

Young Xiao <YangX92@hotmail.com>
    ice: Do not enable NAPI on q_vectors that have no rings

Konstantin Khorenko <khorenko@virtuozzo.com>
    i40e: define proper net_device::neigh_priv_len

Peter Rosin <peda@axentia.se>
    fbdev: fbmem: behave better with small rotated displays and many CPUs

Guoqing Jiang <gqjiang@suse.com>
    md: fix raid10 hang issue caused by barrier

Alexey Khoroshilov <khoroshilov@ispras.ru>
    video: clps711x-fb: release disp device node in probe()

Wenjing Liu <Wenjing.Liu@amd.com>
    drm/amd/display: validate extended dongle caps

Zhi Chen <zhichen@codeaurora.org>
    ath10k: fix tx_stats memory leak

Karthikeyan Periyasamy <periyasa@codeaurora.org>
    ath10k: fix kernel panic due to use after free

Nathan Chancellor <natechancellor@gmail.com>
    drbd: Avoid Clang warning about pointless switch statment

Lars Ellenberg <lars.ellenberg@linbit.com>
    drbd: skip spurious timeout (ping-timeo) when failing promote

Lars Ellenberg <lars.ellenberg@linbit.com>
    drbd: disconnect, if the wrong UUIDs are attached on a connected peer

Roland Kammerer <roland.kammerer@linbit.com>
    drbd: narrow rcu_read_lock in drbd_sync_handshake

Miroslav Lichvar <mlichvar@redhat.com>
    mlx5: update timecounter at least twice per counter overflow

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand

Naftali Goldstein <naftali.goldstein@intel.com>
    iwlwifi: mvm: fix setting HE ppe FW config

Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
    powerpc/perf: Fix thresholding counter data for unknown type

Jian Shen <shenjian15@huawei.com>
    net: hns3: don't restore rules when flow director is disabled

Peng Li <lipeng321@huawei.com>
    net: hns3: fix the descriptor index when get rss type

Jian Shen <shenjian15@huawei.com>
    net: hns3: add max vector number check for pf

Jia-Ju Bai <baijiaju1990@gmail.com>
    cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()

Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
    scsi: smartpqi: increase fw status register read timeout

Dave Carroll <david.carroll@microsemi.com>
    scsi: smartpqi: correct volume status

Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
    scsi: smartpqi: correct host serial num for ssa

Ido Schimmel <idosch@mellanox.com>
    mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG

YueHaibing <yuehaibing@huawei.com>
    xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi

Johannes Berg <johannes.berg@intel.com>
    mac80211: fix radiotap vendor presence bitmap handling

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/uaccess: fix warning/error with access_ok()

Eric Yang <Eric.Yang2@amd.com>
    drm/amd/display: fix YCbCr420 blank color

Chen-Yu Tsai <wens@csie.org>
    Bluetooth: hci_bcm: Handle deferred probing for the clock supply

Dale Zhao <dale.zhao@amd.com>
    drm/amd/display: Wait edp HPD to high in detect_sink

Paul Hsieh <paul.hsieh@amd.com>
    drm/amd/display: Add retry to read ddc_clock pin

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data()

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix error handling int the hns3_get_vector_ring_chain

Dennis Zhou <dennis@kernel.org>
    percpu: convert spin_lock_irq to spin_lock_irqsave.

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf tools: Cast off_t to s64 to avoid warning on bionic libc

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf header: Fix up argument to ctime()

Bin Liu <b-liu@ti.com>
    usb: musb: dsps: fix runtime pm for peripheral mode

Bin Liu <b-liu@ti.com>
    usb: musb: dsps: fix otg state machine

Mark Rutland <mark.rutland@arm.com>
    arm64: KVM: Skip MMIO insn after emulation

Nicholas Mc Guire <hofrat@osadl.org>
    livepatch: check kzalloc return values

Ilan Peer <ilan.peer@intel.com>
    mac80211: Properly handle SKB with radiotap only

Nicholas Mc Guire <hofrat@osadl.org>
    pinctrl: rza1: Handle devm_kasprintf() failure cases

Doug Smythies <doug.smythies@gmail.com>
    tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file

Michael Mueller <mimu@linux.ibm.com>
    KVM: s390: unregister debug feature on failing arch init

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings.

Fabrizio Castro <fabrizio.castro@bp.renesas.com>
    i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E)

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf probe: Fix unchecked usage of strncpy()

Ethan Lien <ethanlien@synology.com>
    btrfs: use tagged writepage to mitigate livelock of snapshot

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf header: Fix unchecked usage of strncpy()

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf dso: Fix unchecked usage of strncpy()

Adrian Hunter <adrian.hunter@intel.com>
    perf test: Fix perf_event_attr test failure

Stephane Eranian <eranian@google.com>
    perf stat: Fix CSV mode column output for non-cgroup events

Beomho Seo <beomho.seo@samsung.com>
    tty: serial: samsung: Properly set flags in autoCTS mode

Geert Uytterhoeven <geert+renesas@glider.be>
    serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure

Geert Uytterhoeven <geert+renesas@glider.be>
    serial: sh-sci: Fix locking in sci_submit_rx()

David Sterba <dsterba@suse.com>
    btrfs: reada: reorder dev-replace locks before radix tree preload

Anand Jain <anand.jain@oracle.com>
    btrfs: harden agaist duplicate fsid on scanned devices

Fabrizio Castro <fabrizio.castro@bp.renesas.com>
    usb: renesas_usbhs: add support for RZ/G2E

Linus Walleij <linus.walleij@linaro.org>
    mmc: jz4740: Get CD/WP GPIOs from descriptors

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-xenon: Fix timeout checks

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-omap: Fix timeout checks

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-of-esdhc: Fix timeout checks

Kai-Heng Feng <kai.heng.feng@canonical.com>
    memstick: Prevent memstick host from getting runtime suspended during card detection

Nicholas Mc Guire <hofrat@osadl.org>
    mmc: meson-mx-sdio: check devm_kasprintf for failure

Michal Suchanek <msuchanek@suse.de>
    mmc: bcm2835: reset host on timeout

Phil Elwell <phil@raspberrypi.org>
    mmc: bcm2835: Recover from MMC_SEND_EXT_CSD

Suraj Jitindar Singh <sjitindarsingh@gmail.com>
    KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines

Quentin Monnet <quentin.monnet@netronome.com>
    tools: bpftool: fix -Wmissing declaration warnings

David Ahern <dsahern@gmail.com>
    ipv6: Fix handling of LLA with VRF and sockets bound to VRF

Chao Yu <yuchao0@huawei.com>
    f2fs: fix to reorder set_page_dirty and wait_on_page_writeback

Jeffrey Hugo <jhugo@codeaurora.org>
    clk: qcom: Leave mmss noc on for 8998

Tom Murphy <murphyt7@tcd.ie>
    fix dma-buf/udmabuf selftest

Arnd Bergmann <arnd@arndb.de>
    ARM: mmp: fix timer_init calls

Fabio Estevam <festevam@gmail.com>
    ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M

Arnd Bergmann <arnd@arndb.de>
    ARM: pxa: avoid section mismatch warning

Stanislav Fomichev <sdf@google.com>
    selftests/bpf: use __bpf_constant_htons in test_prog.c

Joey Zhang <joey.zhang@microchip.com>
    switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite

Jan Kara <jack@suse.cz>
    udf: Fix BUG on corrupted inode

Nir Dotan <nird@mellanox.com>
    mlxsw: spectrum_acl: Limit priority value

Icenowy Zheng <icenowy@aosc.io>
    phy: sun4i-usb: add support for missing USB PHY index

Geert Uytterhoeven <geert@linux-m68k.org>
    lightnvm: Fix uninitialized return value in nvm_get_chunk_meta()

Adamski, Krzysztof (Nokia - PL/Wroclaw) <krzysztof.adamski@nokia.com>
    i2c-axxia: check for error conditions first

Hua Su <suhua.tanke@gmail.com>
    lightnvm: pblk: add lock protection to list operations

Hans Holmberg <hans.holmberg@cnexlabs.com>
    lightnvm: pblk: fix resubmission of overwritten write err lbas

Sean Paul <seanpaul@chromium.org>
    drm/msm: dpu: Only check flush register against pending flushes

Abhinav Kumar <abhinavk@codeaurora.org>
    drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver

Zhizhou Zhang <zhizhouzhang@asrmicro.com>
    tee: optee: avoid possible double list_del()

Viresh Kumar <viresh.kumar@linaro.org>
    OPP: Use opp_table->regulators to verify no regulator case

Yangtao Li <tiny.windzz@gmail.com>
    cpuidle: big.LITTLE: fix refcount leak

Vadim Pasternak <vadimp@mellanox.com>
    platform/x86: mlx-platform: Fix tachometer registers

Anson Huang <anson.huang@nxp.com>
    clk: imx6sl: ensure MMDC CH0 handshake is bypassed

Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    sata_rcar: fix deferred probing

Will Deacon <will.deacon@arm.com>
    iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer

Vivek Gautam <vivek.gautam@codeaurora.org>
    iommu/arm-smmu: Add support for qcom,smmu-v2 variant

Zhen Lei <thunder.leizhen@huawei.com>
    iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads

Tejas Joglekar <tejas.joglekar@synopsys.com>
    usb: dwc3: gadget: Disable CSP for stream OUT ep

Andrey Smirnov <andrew.smirnov@gmail.com>
    ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1

Wolfram Sang <wsa+renesas@sang-engineering.com>
    watchdog: renesas_wdt: don't set divider while watchdog is running

Dan Carpenter <dan.carpenter@oracle.com>
    tracing: Have trace_stack nr_entries compare not be so subtle

Linus Walleij <linus.walleij@linaro.org>
    ARM: dts: Fix up the D-Link DIR-685 MTD partition info

Carlo Caione <ccaione@baylibre.com>
    arm64: dts: meson: Fix IRQ trigger type for macirq

Philipp Zabel <p.zabel@pengutronix.de>
    media: coda: fix H.264 deblocking filter controls

Jiong Wang <jiong.wang@netronome.com>
    mips: bpf: fix encoding bug for mm_srlv32_op

Russell King - ARM Linux <linux@armlinux.org.uk>
    ARM: dts: Fix OMAP4430 SDP Ethernet startup

Janusz Krzysztofik <jmkrzyszt@gmail.com>
    ARM: OMAP1: ams-delta: Fix audio permanently muted

Tomasz Figa <tfiga@chromium.org>
    media: v4l2-device: Link subdevices to their parent devices if available

Yu Zhao <yuzhao@google.com>
    iommu/amd: Fix amd_iommu=force_isolation

Nicholas Mc Guire <hofrat@osadl.org>
    pinctrl: sx150x: handle failure case of devm_kstrdup

Nicholas Mc Guire <hofrat@osadl.org>
    gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack

Nicholas Mc Guire <hofrat@osadl.org>
    gpio: mt7621: report failure of devm_kasprintf()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: dwc3: trace: add missing break statement to make compiler happy

Kaike Wan <kaike.wan@intel.com>
    IB/hfi1: Unreserve a reserved request when it is completed

Peter Rajnoha <prajnoha@redhat.com>
    kobject: return error code if writing /sys/.../uevent fails

Alexander Duyck <alexander.h.duyck@linux.intel.com>
    driver core: Move async_synchronize_full call

Oskari Lemmela <oskari@lemmela.net>
    arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios

Hoang Le <hoang.h.le@dektech.com.au>
    tipc: fix node keep alive interval calculation

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2)

Nicholas Mc Guire <hofrat@osadl.org>
    pinctrl: nuvoton: check for devm_kasprintf() failure

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    mac80211: fix deauth TX when we disconnect

Luca Ceresoli <luca@lucaceresoli.net>
    media: imx274: select REGMAP_I2C

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks

Chunfeng Yun <chunfeng.yun@mediatek.com>
    usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)

Bart Van Assche <bvanassche@acm.org>
    timekeeping: Use proper seqcount initializer

Mathias Nyman <mathias.nyman@linux.intel.com>
    usb: hub: delay hub autosuspend if USB3 port is still link training

Marek Szyprowski <m.szyprowski@samsung.com>
    usb: dwc2: Disable power down feature on Samsung SoCs

Eric Long <eric.long@spreadtrum.com>
    dmaengine: sprd: Support DMA link-list cyclic callback

Anurag Kumar Vulisha <anurag.kumar.vulisha@xilinx.com>
    usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()

Max Filippov <jcmvbkbc@gmail.com>
    xtensa: xtfpga.dtsi: fix dtc warnings about SPI

Zoran Markovic <zmarkovic@sierrawireless.com>
    smack: fix access permissions for keyring

Ville Syrjälä <ville.syrjala@linux.intel.com>
    platform/x86: Fix config space access for intel_atomisp2_pm

Alexey Khoroshilov <khoroshilov@ispras.ru>
    media: DaVinci-VPBE: fix error handling in vpbe_initialize()

Arnd Bergmann <arnd@arndb.de>
    media: i2c: TDA1997x: select CONFIG_HDMI

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    x86/fpu: Add might_fault() to user_insn()

Randy Dunlap <rdunlap@infradead.org>
    spi: fix spi-at91-usart.c build errors when PINCTRL is not set

Rob Herring <robh@kernel.org>
    ARM: dts: aspeed: add missing memory unit-address

Lubomir Rintel <lkundrak@v3.sk>
    ARM: mmp/mmp2: dt: enable the clock

Lubomir Rintel <lkundrak@v3.sk>
    ARM: dts: mmp2: fix TWSI2

Eric Anholt <eric@anholt.net>
    drm/v3d: Fix prime imports of buffers from other drivers.

Mark Rutland <mark.rutland@arm.com>
    arm64: ftrace: don't adjust the LR value

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    mt76x0: dfs: fix IBI_R11 configuration on non-radar channels

Harald Freudenberger <freude@linux.ibm.com>
    s390/zcrypt: improve special ap message cmd handling

Arend van Spriel <arend.vanspriel@broadcom.com>
    firmware/efi: Add NULL pointer checks in efivars API functions

Thara Gopinath <thara.gopinath@linaro.org>
    thermal: Fix locking in cooling device sysfs update cur_state

Wei Wang <wvw@google.com>
    Thermal: do not clear passive state during system sleep

Will Deacon <will.deacon@arm.com>
    arm64: io: Ensure value passed to __iormb() is held in a 64-bit register

Nicholas Mc Guire <hofrat@osadl.org>
    perf: arm_spe: handle devm_kasprintf() failure

Sean Paul <seanpaul@chromium.org>
    drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()

J. Bruce Fields <bfields@redhat.com>
    nfsd4: fix crash on writing v4_end_grace before nfsd startup

Yangtao Li <tiny.windzz@gmail.com>
    soc: bcm: brcmstb: Don't leak device tree node reference

Young Xiao <YangX92@hotmail.com>
    sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN

YueHaibing <yuehaibing@huawei.com>
    net: aquantia: return 'err' if set MPI_DEINIT state fails

Will Deacon <will.deacon@arm.com>
    arm64: io: Ensure calls to delay routines are ordered against prior readX()

Simon Horman <horms+renesas@verge.net.au>
    i2c: sh_mobile: add support for r8a77990 (R-Car E3)

Tiezhu Yang <kernelpatch@126.com>
    f2fs: fix wrong return value of f2fs_acl_create

Sheng Yong <shengyong1@huawei.com>
    f2fs: fix race between write_checkpoint and write_begin

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: avoid build warn of fall_through

Yunlei He <heyunlei@huawei.com>
    f2fs: move dir data flush to write checkpoint process

Yunlong Song <yunlong.song@huawei.com>
    f2fs: avoid GC causing encrypted file corrupted

Michael Straube <straube.linux@gmail.com>
    staging: pi433: fix potential null dereference

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ACPI: SPCR: Consider baud rate 0 as preconfigured state

Hans Verkuil <hverkuil-cisco@xs4all.nl>
    media: adv*/tc358743/ths8200: fill in min width/height/pixelclock

Hans de Goede <hdegoede@redhat.com>
    iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    iio: adc: meson-saradc: fix internal clock names

Nicholas Mc Guire <hofrat@osadl.org>
    iio: adc: meson-saradc: check for devm_kasprintf failure

Mathieu Malaterre <malat@debian.org>
    powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly

Nathan Chancellor <natechancellor@gmail.com>
    dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll

YueHaibing <yuehaibing@huawei.com>
    ptp: Fix pass zero to ERR_PTR() in ptp_clock_register

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: meson8b: fix the width of the cpu_scale_div clock

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel

Chen-Yu Tsai <wens@csie.org>
    ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Fix external clock error checks

Parav Pandit <parav@mellanox.com>
    RDMA/core: Sync unregistration with netlink commands

Hans Verkuil <hverkuil-cisco@xs4all.nl>
    media: vivid: fill in media_device bus_info

Babu Moger <Babu.Moger@amd.com>
    x86/resctrl: Fixup the user-visible strings

Gao Xiang <gaoxiang25@huawei.com>
    staging: erofs: fix race when the managed cache is enabled

Gao Xiang <gaoxiang25@huawei.com>
    staging: erofs: fix the definition of DBG_BUGON

Alexey Khoroshilov <khoroshilov@ispras.ru>
    media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()

Akinobu Mita <akinobu.mita@gmail.com>
    media: video-i2c: avoid accessing released memory area when removing driver

Sean Young <sean@mess.org>
    media: rc: ensure close() is called on rc_unregister_device

Yangtao Li <tiny.windzz@gmail.com>
    soc/tegra: Don't leak device tree node reference

Arnd Bergmann <arnd@arndb.de>
    scsi: cxgb4i: fix thermal configuration dependencies

Pu Wen <puwen@hygon.cn>
    perf tools: Add Hygon Dhyana support

Sami Tolvanen <samitolvanen@google.com>
    modpost: validate symbol names also in find_elf_symbol

Saeed Mahameed <saeedm@mellanox.com>
    net/mlx5: EQ, Use the right place to store/read IRQ affinity hint

Stanislav Fomichev <sdf@google.com>
    bpf: libbpf: retry map creation without the name

Yogesh Mohan Marimuthu <yogesh.mohanmarimuthu@amd.com>
    drm/amd/display: calculate stream->phy_pix_clk before clock mapping

Murton Liu <murton.liu@amd.com>
    drm/amd/display: fix gamma not being applied correctly

Nathan Chancellor <natechancellor@gmail.com>
    ARM: OMAP2+: hwmod: Fix some section annotations

Damian Kos <dkos@cadence.com>
    drm/rockchip: fix for mailbox read size

Ben Dooks <ben.dooks@codethink.co.uk>
    usbnet: smsc95xx: fix rx packet alignment

Renato Lui Geh <renatogeh@gmail.com>
    staging: iio: ad7780: update voltage on read

Xiang Chen <chenxiang66@hisilicon.com>
    scsi: hisi_sas: change the time of SAS SSP connection

Alan Brady <alan.brady@intel.com>
    i40e: prevent overlapping tx_timeout recover

Mitch Williams <mitch.a.williams@intel.com>
    i40e: suppress bogus error message

Brian Norris <briannorris@chromium.org>
    platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup

Arnd Bergmann <arnd@arndb.de>
    vbox: fix link error with 'gcc -Og'

Anatolij Gustschin <agust@denx.de>
    fpga: altera-cvp: fix 'bad IO access' on x86_64

Dexuan Cui <decui@microsoft.com>
    Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1

Andreas Puhm <puhm@oregano.at>
    fpga: altera-cvp: Fix registration for CvP incapable devices

Matheus Tavares <matheus.bernardino@usp.br>
    staging:iio:ad2s90: Make probe handle spi_setup failure

Naftali Goldstein <naftali.goldstein@intel.com>
    iwlwifi: fw: do not set sgi bits for HE connection

Ioana Ciornei <ioana.ciornei@nxp.com>
    dpaa2-ptp: defer probe when portal allocation failed

Paul Burton <paul.burton@mips.com>
    MIPS: Boston: Disable EG20T prefetch

Miroslav Lichvar <mlichvar@redhat.com>
    ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl

Andy Duan <fugang.duan@nxp.com>
    serial: fsl_lpuart: clear parity enable bit when disable parity

Boris Brezillon <boris.brezillon@bootlin.com>
    drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE

Eric Biggers <ebiggers@google.com>
    crypto: aes_ti - disable interrupts while accessing S-box

Julian Wiedmann <jwi@linux.ibm.com>
    s390/qeth: utilize virtual MAC for Layer2 OSD devices

David Ahern <dsahern@gmail.com>
    bpftool: Improve handling of ENOENT on map dumps

Frank Rowand <frank.rowand@sony.com>
    powerpc/pseries: add of_node_put() in dlpar_detach_node()

Colin Ian King <colin.king@canonical.com>
    x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)

Bob Peterson <rpeterso@redhat.com>
    dlm: Don't swamp the CPU with callbacks queued during recovery

Yi Wang <wang.yi59@zte.com.cn>
    clk: boston: fix possible memory leak in clk_boston_setup()

Yufen Wang <wangyufen@huawei.com>
    ARM: 8808/1: kexec:offline panic_smp_self_stop CPU

James Smart <jsmart2021@gmail.com>
    scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event

Suganath Prabu <suganath-prabu.subramani@broadcom.com>
    scsi: mpt3sas: Call sas_remove_host before removing the target devices

James Smart <jsmart2021@gmail.com>
    scsi: lpfc: Correct LCB RJT handling

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    ath9k: dynack: use authentication messages for 'late' ack

Brian Norris <briannorris@chromium.org>
    ath10k: assign 'n_cipher_suites' for WCN3990

Lior David <liord@codeaurora.org>
    wil6210: fix memory leak in wil_find_tx_bcast_2

Alexei Avshalom Lazar <ailizaro@codeaurora.org>
    wil6210: fix reset flow for Talyn-mb

Nickhu <nickhu@andestech.com>
    nds32: Fix gcc 8.0 compiler option incompatible.

Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
    drm/amd/display: Fix potential nullptr error

Steve Longerbeam <slongerbeam@gmail.com>
    gpu: ipu-v3: image-convert: Prevent race between run and unprepare

Long Li <longli@microsoft.com>
    genirq/affinity: Spread IRQs to all available NUMA nodes

Dan Carpenter <dan.carpenter@oracle.com>
    ath10k: fixup extended per sta tx statistics

Jernej Skrabec <jernej.skrabec@siol.net>
    drm/sun4i: Initialize registers in tcon-top driver

Muchun Song <smuchun@gmail.com>
    gpiolib: Fix possible use after free on label

Arnd Bergmann <arnd@arndb.de>
    ASoC: Intel: mrfld: fix uninitialized variable access

Jernej Skrabec <jernej.skrabec@siol.net>
    clk: sunxi-ng: h6: Set video PLLs limits

Lukas Wunner <lukas@wunner.de>
    pinctrl: bcm2835: Use raw spinlock for RT compatibility

Deepak Sharma <deepak.sharma@amd.com>
    drm/vgem: Fix vgem_init to get drm device available.

Slawomir Stepien <sst@poczta.fm>
    staging: iio: adc: ad7280a: handle error from __ad7280_read32()

Eric Anholt <eric@anholt.net>
    drm/v3d: Fix a use-after-free race accessing the scheduler's fences.

Gustavo A. R. Silva <gustavo@embeddedor.com>
    drm/bufs: Fix Spectre v1 vulnerability


-------------

Diffstat:

 Makefile                                           |   4 +-
 .../boot/dts/aspeed-bmc-arm-centriq2400-rep.dts    |   2 +-
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts     |   2 +-
 arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts       |   3 +-
 arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts  |   2 +-
 arch/arm/boot/dts/gemini-dlink-dir-685.dts         |  16 +--
 arch/arm/boot/dts/imx51-zii-rdu1.dts               |  17 ++-
 arch/arm/boot/dts/mmp2.dtsi                        |   9 +-
 arch/arm/boot/dts/omap4-sdp.dts                    |   1 +
 arch/arm/kernel/smp.c                              |  15 +++
 arch/arm/mach-mmp/common.h                         |   2 +-
 arch/arm/mach-mmp/mmp2.c                           |   2 +-
 arch/arm/mach-mmp/pxa168.c                         |   2 +-
 arch/arm/mach-mmp/pxa910.c                         |   2 +-
 arch/arm/mach-mmp/time.c                           |  32 +++--
 arch/arm/mach-omap1/board-ams-delta.c              |   6 +-
 arch/arm/mach-omap2/omap_hwmod.c                   |   6 +-
 arch/arm/mach-pxa/cm-x300.c                        |   2 +-
 arch/arm/mach-pxa/littleton.c                      |   2 +-
 arch/arm/mach-pxa/zeus.c                           |   2 +-
 .../boot/dts/allwinner/sun50i-a64-orangepi-win.dts |   1 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gx.dtsi          |   2 +-
 .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts |   1 -
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi  |   1 -
 arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts  |  20 +--
 arch/arm64/include/asm/io.h                        |  32 +++--
 arch/arm64/include/uapi/asm/ptrace.h               |   2 +-
 arch/arm64/kernel/entry-ftrace.S                   |   1 -
 arch/mips/boot/dts/img/boston.dts                  |   6 +
 arch/mips/include/asm/mach-jz4740/jz4740_mmc.h     |   2 -
 arch/mips/include/uapi/asm/inst.h                  |   2 +-
 arch/mips/jz4740/board-qi_lb60.c                   |  12 +-
 arch/mips/ralink/Kconfig                           |   1 +
 arch/nds32/mm/Makefile                             |   6 +-
 arch/powerpc/include/asm/fadump.h                  |   2 +-
 arch/powerpc/include/asm/uaccess.h                 |   2 +-
 arch/powerpc/kernel/fadump.c                       |  10 +-
 arch/powerpc/kernel/vmlinux.lds.S                  |   4 +
 arch/powerpc/kvm/powerpc.c                         |   5 +-
 arch/powerpc/mm/fault.c                            |   4 +-
 arch/powerpc/perf/isa207-common.c                  |   7 +-
 arch/powerpc/platforms/powernv/pci-ioda-tce.c      |   2 +-
 arch/powerpc/platforms/pseries/dlpar.c             |   2 +
 arch/powerpc/platforms/pseries/hotplug-memory.c    |   7 +-
 arch/s390/include/uapi/asm/zcrypt.h                |   4 +-
 arch/s390/kvm/kvm-s390.c                           |  17 ++-
 arch/sh/boards/mach-kfr2r09/setup.c                |   1 -
 arch/um/include/asm/pgtable.h                      |   9 +-
 arch/x86/events/intel/core.c                       |  16 ++-
 arch/x86/events/intel/uncore_snbep.c               |   4 +-
 arch/x86/include/asm/fpu/internal.h                |   3 +
 arch/x86/kernel/cpu/bugs.c                         |   2 +-
 arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c        |  22 ++--
 arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c        |  34 +++---
 arch/x86/kernel/cpu/intel_rdt_rdtgroup.c           |  36 +++---
 arch/x86/kernel/cpu/mcheck/mce.c                   |   1 +
 arch/x86/kvm/svm.c                                 |   7 ++
 arch/x86/kvm/vmx.c                                 |   4 +-
 arch/x86/kvm/x86.c                                 |   7 ++
 arch/x86/pci/broadcom_bus.c                        |   4 +-
 arch/xtensa/boot/dts/xtfpga.dtsi                   |   2 +-
 crypto/Kconfig                                     |   3 +-
 crypto/aes_ti.c                                    |  18 +++
 drivers/acpi/apei/ghes.c                           |   2 +
 drivers/acpi/spcr.c                                |  11 ++
 drivers/ata/sata_rcar.c                            |   4 +-
 drivers/base/bus.c                                 |  12 +-
 drivers/base/cacheinfo.c                           |   6 +-
 drivers/base/core.c                                |   8 +-
 drivers/base/dd.c                                  |   6 +-
 drivers/block/drbd/drbd_nl.c                       |  15 +--
 drivers/block/drbd/drbd_receiver.c                 |  13 +-
 drivers/block/sunvdc.c                             |   5 +
 drivers/block/swim3.c                              |  13 +-
 drivers/block/zram/zram_drv.c                      |  38 +++---
 drivers/block/zram/zram_drv.h                      |   2 +-
 drivers/bluetooth/hci_bcm.c                        |   4 +
 drivers/cdrom/gdrom.c                              |   1 +
 drivers/clk/imgtec/clk-boston.c                    |  11 +-
 drivers/clk/imx/clk-imx6sl.c                       |   6 +
 drivers/clk/meson/meson8b.c                        |  16 ++-
 drivers/clk/qcom/gcc-msm8998.c                     |   6 +
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c               |   4 +
 drivers/clk/sunxi-ng/ccu-sun8i-a33.c               |   6 +-
 drivers/cpuidle/cpuidle-big_little.c               |   7 +-
 drivers/crypto/ux500/cryp/cryp_core.c              |   4 +-
 drivers/crypto/ux500/hash/hash_core.c              |   2 +-
 drivers/dma/bcm2835-dma.c                          |  70 ++++-------
 drivers/dma/imx-dma.c                              |   8 +-
 drivers/dma/sprd-dma.c                             |  25 ++--
 drivers/dma/xilinx/zynqmp_dma.c                    |   2 +-
 drivers/firmware/efi/vars.c                        |  99 +++++++++++----
 drivers/fpga/altera-cvp.c                          |  15 ++-
 drivers/gpio/gpio-mt7621.c                         |  10 +-
 drivers/gpio/gpiolib.c                             |  25 +++-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   6 +
 drivers/gpu/drm/amd/display/dc/core/dc_link.c      |  26 +++-
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c   |   3 +-
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |   2 +
 .../amd/display/dc/dce110/dce110_hw_sequencer.c    |  11 +-
 .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c  |  12 +-
 .../drm/amd/powerplay/smumgr/polaris10_smumgr.c    |  17 ++-
 drivers/gpu/drm/drm_atomic_helper.c                |   8 +-
 drivers/gpu/drm/drm_bufs.c                         |   3 +
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c   |   2 +-
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c         |   8 +-
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c             |  14 ++-
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |   2 +-
 drivers/gpu/drm/sun4i/sun8i_tcon_top.c             |   7 ++
 drivers/gpu/drm/v3d/v3d_bo.c                       |   1 +
 drivers/gpu/drm/v3d/v3d_drv.h                      |   5 +
 drivers/gpu/drm/v3d/v3d_gem.c                      |   8 +-
 drivers/gpu/drm/vc4/vc4_plane.c                    |  12 +-
 drivers/gpu/drm/vgem/vgem_drv.c                    |  16 +--
 drivers/gpu/ipu-v3/ipu-image-convert.c             |  10 +-
 drivers/hid/hid-debug.c                            | 120 ++++++++----------
 drivers/hid/hid-lenovo.c                           |  10 +-
 drivers/hwmon/lm80.c                               |  26 ++--
 drivers/i2c/busses/i2c-axxia.c                     |  32 ++---
 drivers/i2c/busses/i2c-sh_mobile.c                 |   2 +
 drivers/iio/accel/kxcjk-1013.c                     |   1 +
 drivers/iio/adc/meson_saradc.c                     |  14 ++-
 drivers/infiniband/core/core_priv.h                |   1 +
 drivers/infiniband/core/device.c                   |  26 +++-
 drivers/infiniband/core/nldev.c                    |  20 +--
 drivers/infiniband/hw/hfi1/rc.c                    |   2 +
 drivers/iommu/amd_iommu.c                          |   9 +-
 drivers/iommu/arm-smmu-v3.c                        |  14 ++-
 drivers/iommu/arm-smmu.c                           |   3 +
 drivers/irqchip/irq-gic-v3-its.c                   |  32 ++++-
 drivers/isdn/hisax/hfc_pci.c                       |   2 +
 drivers/lightnvm/core.c                            |   2 +-
 drivers/lightnvm/pblk-core.c                       |  13 +-
 drivers/lightnvm/pblk-write.c                      |   8 +-
 drivers/md/raid10.c                                |   4 +
 drivers/media/i2c/Kconfig                          |   2 +
 drivers/media/i2c/ad9389b.c                        |   2 +-
 drivers/media/i2c/adv7511.c                        |   2 +-
 drivers/media/i2c/adv7604.c                        |   4 +-
 drivers/media/i2c/adv7842.c                        |   4 +-
 drivers/media/i2c/tc358743.c                       |   2 +-
 drivers/media/i2c/ths8200.c                        |   2 +-
 drivers/media/i2c/video-i2c.c                      |  11 +-
 drivers/media/platform/coda/coda-bit.c             |  19 ++-
 drivers/media/platform/coda/coda-common.c          |  15 ++-
 drivers/media/platform/coda/coda.h                 |   6 +-
 drivers/media/platform/coda/coda_regs.h            |   2 +-
 drivers/media/platform/davinci/vpbe.c              |   7 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c  |  10 +-
 drivers/media/platform/vivid/vivid-core.c          |   2 +
 drivers/media/rc/rc-main.c                         |   2 +
 drivers/media/v4l2-core/v4l2-device.c              |   1 +
 drivers/memstick/core/memstick.c                   |   3 +
 drivers/mmc/host/bcm2835.c                         |  12 ++
 drivers/mmc/host/jz4740_mmc.c                      |  20 +--
 drivers/mmc/host/meson-mx-sdio.c                   |   6 +
 drivers/mmc/host/sdhci-of-esdhc.c                  |  16 ++-
 drivers/mmc/host/sdhci-omap.c                      |  16 ++-
 drivers/mmc/host/sdhci-xenon-phy.c                 |  10 +-
 drivers/mmc/host/sdhci-xenon.c                     |  10 +-
 drivers/net/dsa/b53/b53_srab.c                     |   3 -
 drivers/net/dsa/mv88e6xxx/global1_atu.c            |  21 ++--
 .../aquantia/atlantic/hw_atl/hw_atl_utils.c        |   2 +
 drivers/net/ethernet/broadcom/bcmsysport.c         |  25 ++--
 drivers/net/ethernet/broadcom/bcmsysport.h         |   2 +
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  27 +++--
 drivers/net/ethernet/cisco/enic/enic_main.c        |   3 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c   |   5 +-
 drivers/net/ethernet/freescale/fman/fman_memac.c   |   2 +-
 drivers/net/ethernet/freescale/fman/fman_tgec.c    |   2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |  30 +++--
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |   4 +
 drivers/net/ethernet/intel/i40e/i40e.h             |   1 +
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   8 ++
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |   3 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  16 ++-
 drivers/net/ethernet/intel/igb/igb_main.c          |   8 +-
 drivers/net/ethernet/marvell/skge.c                |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |  13 ++
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |   9 +-
 .../net/ethernet/mellanox/mlx5/core/lib/clock.c    |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |  14 ++-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |  23 ++++
 .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c    |   5 +-
 .../ethernet/mellanox/mlxsw/spectrum_switchdev.c   |  27 +----
 drivers/net/ethernet/sun/niu.c                     |  10 +-
 drivers/net/phy/dp83640.c                          |  13 +-
 drivers/net/phy/marvell.c                          |  12 --
 drivers/net/usb/smsc95xx.c                         |   1 +
 drivers/net/virtio_net.c                           |  20 ++-
 drivers/net/wireless/ath/ath10k/core.c             |   1 +
 drivers/net/wireless/ath/ath10k/mac.c              |  28 +++--
 drivers/net/wireless/ath/ath9k/dynack.c            |   3 +-
 drivers/net/wireless/ath/wil6210/main.c            |  11 +-
 drivers/net/wireless/ath/wil6210/txrx.c            |   2 +
 drivers/net/wireless/intel/iwlwifi/fw/api/mac.h    |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c     |   4 +
 .../net/wireless/mediatek/mt76/mt76x2/pci_dfs.c    |   8 +-
 drivers/net/wireless/st/cw1200/scan.c              |  13 +-
 drivers/nvme/host/lightnvm.c                       |   3 +-
 drivers/opp/core.c                                 |  11 +-
 drivers/pci/controller/dwc/pci-imx6.c              |  10 ++
 drivers/pci/switch/switchtec.c                     |   3 +
 drivers/perf/arm_spe_pmu.c                         |   5 +
 drivers/phy/allwinner/phy-sun4i-usb.c              |   7 ++
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |  16 +--
 drivers/pinctrl/meson/pinctrl-meson8.c             |   3 +
 drivers/pinctrl/meson/pinctrl-meson8b.c            |  13 +-
 drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c          |   3 +
 drivers/pinctrl/pinctrl-rza1.c                     |   5 +
 drivers/pinctrl/pinctrl-sx150x.c                   |  11 +-
 drivers/platform/chrome/cros_ec_proto.c            |  18 ++-
 drivers/platform/x86/intel_atomisp2_pm.c           |  68 ++++++++---
 drivers/platform/x86/mlx-platform.c                |  12 +-
 drivers/ptp/ptp_chardev.c                          |   5 +-
 drivers/ptp/ptp_clock.c                            |   5 +-
 drivers/s390/crypto/zcrypt_error.h                 |   2 +
 drivers/s390/net/qeth_core.h                       |   1 -
 drivers/s390/net/qeth_core_main.c                  |  12 +-
 drivers/s390/net/qeth_core_mpc.h                   |  25 ++--
 drivers/s390/net/qeth_l2_main.c                    |  10 +-
 drivers/scsi/aic94xx/aic94xx_init.c                |   8 +-
 drivers/scsi/cxgbi/cxgb4i/Kconfig                  |   4 +-
 drivers/scsi/cxlflash/main.c                       |   2 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |   2 +-
 drivers/scsi/lpfc/lpfc_els.c                       |  52 ++++----
 drivers/scsi/lpfc/lpfc_nportdisc.c                 |   5 +
 drivers/scsi/mpt3sas/mpt3sas_scsih.c               |   2 +-
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   7 +-
 drivers/scsi/sd_zbc.c                              |  12 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |   6 +
 drivers/scsi/smartpqi/smartpqi_sis.c               |   2 +-
 drivers/soc/bcm/brcmstb/common.c                   |   6 +-
 drivers/soc/tegra/common.c                         |   6 +-
 drivers/spi/spi-at91-usart.c                       |   1 +
 drivers/staging/erofs/internal.h                   |   3 +-
 drivers/staging/erofs/utils.c                      | 134 +++++++++++++++------
 drivers/staging/iio/adc/ad7280a.c                  |  17 ++-
 drivers/staging/iio/adc/ad7780.c                   |   6 +-
 drivers/staging/iio/resolver/ad2s90.c              |   7 +-
 drivers/staging/pi433/pi433_if.c                   |   4 +
 drivers/staging/speakup/spk_ttyio.c                |   6 +-
 drivers/tee/optee/supp.c                           |  13 +-
 drivers/thermal/broadcom/bcm2835_thermal.c         |  11 ++
 drivers/thermal/qcom/tsens-common.c                |  12 +-
 drivers/thermal/thermal-generic-adc.c              |  12 +-
 drivers/thermal/thermal_core.c                     |  12 +-
 drivers/thermal/thermal_hwmon.h                    |   4 +-
 drivers/thermal/thermal_sysfs.c                    |  11 +-
 drivers/tty/serial/8250/8250_pci.c                 |   9 +-
 drivers/tty/serial/fsl_lpuart.c                    |   4 +
 drivers/tty/serial/samsung.c                       |   3 +
 drivers/tty/serial/serial_core.c                   |   6 +
 drivers/tty/serial/sh-sci.c                        |  32 +++--
 drivers/usb/core/hub.c                             |  10 ++
 drivers/usb/dwc2/params.c                          |  10 +-
 drivers/usb/dwc3/gadget.c                          |  16 ++-
 drivers/usb/dwc3/trace.h                           |   2 +
 drivers/usb/gadget/udc/net2272.c                   |   2 +-
 drivers/usb/mtu3/mtu3_core.c                       |   4 +-
 drivers/usb/mtu3/mtu3_gadget_ep0.c                 |   8 +-
 drivers/usb/musb/musb_dsps.c                       |  21 +++-
 drivers/usb/musb/musb_gadget.c                     |  13 +-
 drivers/usb/musb/musbhsdma.c                       |  21 ++--
 drivers/usb/phy/phy-am335x.c                       |   5 +-
 drivers/usb/renesas_usbhs/common.c                 |   4 +
 drivers/video/fbdev/clps711x-fb.c                  |   5 +-
 drivers/video/fbdev/core/fbcon.c                   |   2 +-
 drivers/video/fbdev/core/fbmem.c                   |   8 +-
 drivers/virt/vboxguest/vboxguest_core.c            |   2 +-
 drivers/watchdog/renesas_wdt.c                     |   9 +-
 fs/binfmt_script.c                                 |  10 +-
 fs/btrfs/btrfs_inode.h                             |   1 +
 fs/btrfs/ctree.h                                   |   2 +-
 fs/btrfs/extent_io.c                               |  17 ++-
 fs/btrfs/inode.c                                   |  11 +-
 fs/btrfs/ioctl.c                                   |   2 +-
 fs/btrfs/reada.c                                   |  12 +-
 fs/btrfs/volumes.c                                 |  29 +++++
 fs/cifs/readdir.c                                  |   9 +-
 fs/dlm/ast.c                                       |  10 ++
 fs/eventpoll.c                                     |   2 +-
 fs/f2fs/acl.c                                      |  14 ++-
 fs/f2fs/checkpoint.c                               |   7 +-
 fs/f2fs/data.c                                     |  12 +-
 fs/f2fs/f2fs.h                                     |  12 +-
 fs/f2fs/file.c                                     |   3 +
 fs/f2fs/gc.c                                       |  15 ++-
 fs/f2fs/node.c                                     |   5 +-
 fs/f2fs/segment.c                                  |   3 +-
 fs/f2fs/shrinker.c                                 |   2 +-
 fs/f2fs/super.c                                    |  27 +++--
 fs/fuse/dev.c                                      |   4 +-
 fs/fuse/file.c                                     |   2 +-
 fs/fuse/inode.c                                    |   2 +-
 fs/nfs/super.c                                     |   3 +-
 fs/nfsd/nfsctl.c                                   |   2 +
 fs/nfsd/vfs.c                                      |   6 +-
 fs/ocfs2/Makefile                                  |   2 +-
 fs/ocfs2/buffer_head_io.c                          |   2 -
 fs/ocfs2/dlm/Makefile                              |   2 +-
 fs/ocfs2/dlmfs/Makefile                            |   2 +-
 fs/proc/base.c                                     |  12 +-
 fs/udf/inode.c                                     |   6 +
 fs/xfs/xfs_aops.c                                  |   2 +
 include/linux/cpu.h                                |   2 -
 include/linux/genl_magic_struct.h                  |   5 +-
 include/linux/gpio/consumer.h                      |   6 +-
 include/linux/hid-debug.h                          |   9 +-
 include/linux/kvm_host.h                           |   3 +-
 include/linux/mlx5/driver.h                        |   2 +-
 include/linux/skmsg.h                              |   8 ++
 include/rdma/ib_verbs.h                            |   8 +-
 include/sound/compress_driver.h                    |   6 +-
 include/sound/hda_codec.h                          |   1 +
 kernel/cgroup/cgroup.c                             |   2 +-
 kernel/cpu.c                                       |  33 +----
 kernel/debug/debug_core.c                          |   4 +
 kernel/debug/kdb/kdb_bt.c                          |  11 +-
 kernel/debug/kdb/kdb_debugger.c                    |   7 --
 kernel/events/ring_buffer.c                        |   3 +
 kernel/futex.c                                     |  28 +++--
 kernel/hung_task.c                                 |  20 ++-
 kernel/irq/affinity.c                              |   5 +-
 kernel/kcov.c                                      |   2 +-
 kernel/locking/rtmutex.c                           |  37 +++++-
 kernel/module.c                                    |   6 +-
 kernel/sched/fair.c                                |   1 +
 kernel/smp.c                                       |   2 -
 kernel/sysctl.c                                    |   2 +
 kernel/time/timekeeping.c                          |   4 +-
 kernel/trace/trace_stack.c                         |   2 +-
 lib/seq_buf.c                                      |   6 +-
 lib/test_rhashtable.c                              |  23 ++--
 mm/page_alloc.c                                    |  37 ++++--
 mm/percpu-km.c                                     |   5 +-
 net/core/skmsg.c                                   |   7 +-
 net/dccp/ccid.h                                    |   4 +-
 net/dsa/master.c                                   |   4 +
 net/dsa/slave.c                                    |  17 +--
 net/ipv4/tcp_bpf.c                                 |   2 +-
 net/ipv6/tcp_ipv6.c                                |   3 +-
 net/ipv6/xfrm6_tunnel.c                            |   3 +
 net/mac80211/rx.c                                  |  31 +++--
 net/mac80211/util.c                                |  49 +++++---
 net/rds/bind.c                                     |   6 +-
 net/rxrpc/recvmsg.c                                |   3 +-
 net/sched/cls_flower.c                             |   6 +-
 net/sctp/socket.c                                  |   4 +-
 net/sctp/stream.c                                  |  20 +++
 net/sunrpc/xprtrdma/backchannel.c                  |  13 +-
 net/sunrpc/xprtrdma/svc_rdma_backchannel.c         |   8 +-
 net/sunrpc/xprtrdma/transport.c                    |  17 +--
 net/sunrpc/xprtrdma/verbs.c                        |   1 -
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   1 +
 net/tipc/node.c                                    |   6 +
 samples/livepatch/livepatch-shadow-fix1.c          |   5 +
 samples/livepatch/livepatch-shadow-mod.c           |   4 +
 scripts/decode_stacktrace.sh                       |   2 +-
 scripts/gdb/linux/proc.py                          |   2 +-
 scripts/mod/modpost.c                              |  50 ++++----
 security/smack/smack_lsm.c                         |  12 +-
 sound/pci/hda/hda_bind.c                           |   3 +-
 sound/pci/hda/hda_intel.c                          |   2 +
 sound/pci/hda/patch_realtek.c                      |  62 +++++-----
 sound/soc/fsl/Kconfig                              |   2 +-
 sound/soc/intel/atom/sst/sst_loader.c              |   8 +-
 sound/soc/sunxi/sun50i-codec-analog.c              |   2 +
 sound/usb/quirks.c                                 |   1 +
 tools/bpf/bpftool/common.c                         |   4 +-
 tools/bpf/bpftool/json_writer.c                    |   6 +-
 tools/bpf/bpftool/map.c                            |  18 ++-
 tools/bpf/bpftool/prog.c                           |   4 +-
 tools/bpf/bpftool/xlated_dumper.c                  |   7 +-
 tools/build/Makefile.feature                       |   4 +-
 tools/build/feature/Makefile                       |  10 +-
 tools/hv/hv_kvp_daemon.c                           |  15 ++-
 tools/lib/bpf/bpf.c                                |  11 +-
 tools/perf/Makefile.config                         |  44 +++----
 tools/perf/arch/x86/util/kvm-stat.c                |   2 +-
 tools/perf/tests/attr.py                           |   2 +-
 tools/perf/tests/evsel-tp-sched.c                  |   2 +-
 tools/perf/util/dso.c                              |   2 +-
 tools/perf/util/header.c                           |   6 +-
 tools/perf/util/probe-file.c                       |   2 +-
 tools/perf/util/python.c                           |   3 +-
 tools/perf/util/s390-cpumsf.c                      |   2 +-
 tools/perf/util/stat-display.c                     |  16 ++-
 .../x86/intel_pstate_tracer/intel_pstate_tracer.py |   4 +-
 tools/testing/selftests/Makefile                   |   1 +
 tools/testing/selftests/bpf/test_progs.c           |   8 +-
 tools/testing/selftests/drivers/dma-buf/Makefile   |   2 +
 tools/testing/selftests/drivers/dma-buf/udmabuf.c  |  11 +-
 tools/testing/selftests/kvm/x86_64/evmcs_test.c    |   4 +-
 tools/testing/selftests/kvm/x86_64/state_test.c    |   4 +-
 virt/kvm/arm/mmio.c                                |  11 +-
 virt/kvm/kvm_main.c                                |   6 +-
 400 files changed, 2627 insertions(+), 1313 deletions(-)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 001/352] drm/bufs: Fix Spectre v1 vulnerability
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 002/352] drm/v3d: Fix a use-after-free race accessing the schedulers fences Greg Kroah-Hartman
                   ` (353 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Daniel Vetter,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a37805098900a6e73a55b3a43b7d3bcd987bb3f4 ]

idx can be indirectly controlled by user-space, hence leading to a
potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/gpu/drm/drm_bufs.c:1420 drm_legacy_freebufs() warn: potential
spectre issue 'dma->buflist' [r] (local cap)

Fix this by sanitizing idx before using it to index dma->buflist

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181016095549.GA23586@embeddedor.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_bufs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 7412acaf3cde..d7d10cabb9bb 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -36,6 +36,8 @@
 #include <drm/drmP.h>
 #include "drm_legacy.h"
 
+#include <linux/nospec.h>
+
 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
 						  struct drm_local_map *map)
 {
@@ -1417,6 +1419,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data,
 				  idx, dma->buf_count - 1);
 			return -EINVAL;
 		}
+		idx = array_index_nospec(idx, dma->buf_count);
 		buf = dma->buflist[idx];
 		if (buf->file_priv != file_priv) {
 			DRM_ERROR("Process %d freeing buffer not owned\n",
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 002/352] drm/v3d: Fix a use-after-free race accessing the schedulers fences.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 001/352] drm/bufs: Fix Spectre v1 vulnerability Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 003/352] staging: iio: adc: ad7280a: handle error from __ad7280_read32() Greg Kroah-Hartman
                   ` (352 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Anholt, Boris Brezillon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 34c2c4f632f232ed2fdb66d4e42cc72d322273fe ]

Once we push the job, the scheduler could run it and free it.  So, if
we want to reference their fences, we need to grab them before then.
I haven't seen this happen in many days of conformance test runtime,
but let's still close the race.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
Link: https://patchwork.freedesktop.org/patch/254119/
Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++
 drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index e6fed696ad86..cbe5be0c47eb 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -198,6 +198,11 @@ struct v3d_exec_info {
 	 */
 	struct dma_fence *bin_done_fence;
 
+	/* Fence for when the scheduler considers the render to be
+	 * done, for when the BOs reservations should be complete.
+	 */
+	struct dma_fence *render_done_fence;
+
 	struct kref refcount;
 
 	/* This is the array of BOs that were looked up at the start of exec. */
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 70c54774400b..2814c72cb090 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d)
 static void
 v3d_attach_object_fences(struct v3d_exec_info *exec)
 {
-	struct dma_fence *out_fence = &exec->render.base.s_fence->finished;
+	struct dma_fence *out_fence = exec->render_done_fence;
 	struct v3d_bo *bo;
 	int i;
 
@@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref)
 	dma_fence_put(exec->render.done_fence);
 
 	dma_fence_put(exec->bin_done_fence);
+	dma_fence_put(exec->render_done_fence);
 
 	for (i = 0; i < exec->bo_count; i++)
 		drm_gem_object_put_unlocked(&exec->bo[i]->base);
@@ -572,6 +573,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail_unreserve;
 
+	exec->render_done_fence =
+		dma_fence_get(&exec->render.base.s_fence->finished);
+
 	kref_get(&exec->refcount); /* put by scheduler job completion */
 	drm_sched_entity_push_job(&exec->render.base,
 				  &v3d_priv->sched_entity[V3D_RENDER]);
@@ -585,7 +589,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
 	if (sync_out) {
 		drm_syncobj_replace_fence(sync_out, 0,
-					  &exec->render.base.s_fence->finished);
+					  exec->render_done_fence);
 		drm_syncobj_put(sync_out);
 	}
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 003/352] staging: iio: adc: ad7280a: handle error from __ad7280_read32()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 001/352] drm/bufs: Fix Spectre v1 vulnerability Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 002/352] drm/v3d: Fix a use-after-free race accessing the schedulers fences Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available Greg Kroah-Hartman
                   ` (351 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Slawomir Stepien, Jonathan Cameron,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0559ef7fde67bc6c83c6eb6329dbd6649528263e ]

Inside __ad7280_read32(), the spi_sync_transfer() can fail with negative
error code. This change will ensure that this error is being passed up
in the call stack, so it can be handled.

Signed-off-by: Slawomir Stepien <sst@poczta.fm>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/iio/adc/ad7280a.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
index 58420dcb406d..cbeb52485a31 100644
--- a/drivers/staging/iio/adc/ad7280a.c
+++ b/drivers/staging/iio/adc/ad7280a.c
@@ -256,7 +256,9 @@ static int ad7280_read(struct ad7280_state *st, unsigned int devaddr,
 	if (ret)
 		return ret;
 
-	__ad7280_read32(st, &tmp);
+	ret = __ad7280_read32(st, &tmp);
+	if (ret)
+		return ret;
 
 	if (ad7280_check_crc(st, tmp))
 		return -EIO;
@@ -294,7 +296,9 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned int devaddr,
 
 	ad7280_delay(st);
 
-	__ad7280_read32(st, &tmp);
+	ret = __ad7280_read32(st, &tmp);
+	if (ret)
+		return ret;
 
 	if (ad7280_check_crc(st, tmp))
 		return -EIO;
@@ -327,7 +331,9 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned int cnt,
 	ad7280_delay(st);
 
 	for (i = 0; i < cnt; i++) {
-		__ad7280_read32(st, &tmp);
+		ret = __ad7280_read32(st, &tmp);
+		if (ret)
+			return ret;
 
 		if (ad7280_check_crc(st, tmp))
 			return -EIO;
@@ -370,7 +376,10 @@ static int ad7280_chain_setup(struct ad7280_state *st)
 		return ret;
 
 	for (n = 0; n <= AD7280A_MAX_CHAIN; n++) {
-		__ad7280_read32(st, &val);
+		ret = __ad7280_read32(st, &val);
+		if (ret)
+			return ret;
+
 		if (val == 0)
 			return n - 1;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 003/352] staging: iio: adc: ad7280a: handle error from __ad7280_read32() Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-14 13:58   ` Emil Velikov
  2019-02-11 14:13 ` [PATCH 4.20 005/352] pinctrl: bcm2835: Use raw spinlock for RT compatibility Greg Kroah-Hartman
                   ` (350 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Deepak Sharma,
	Sean Paul, Emil Velikov, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ]

Modify vgem_init to take platform dev as parent in drm_dev_init.
This will make drm device available at "/sys/devices/platform/vgem"
in x86 chromebook.

v2: rebase, address checkpatch typo and line over 80 characters

Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Deepak Sharma <deepak.sharma@amd.com>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vgem/vgem_drv.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index ec6af8b920da..f1f7ab9dcdbf 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -471,31 +471,31 @@ static int __init vgem_init(void)
 	if (!vgem_device)
 		return -ENOMEM;
 
-	ret = drm_dev_init(&vgem_device->drm, &vgem_driver, NULL);
-	if (ret)
-		goto out_free;
-
 	vgem_device->platform =
 		platform_device_register_simple("vgem", -1, NULL, 0);
 	if (IS_ERR(vgem_device->platform)) {
 		ret = PTR_ERR(vgem_device->platform);
-		goto out_fini;
+		goto out_free;
 	}
 
 	dma_coerce_mask_and_coherent(&vgem_device->platform->dev,
 				     DMA_BIT_MASK(64));
+	ret = drm_dev_init(&vgem_device->drm, &vgem_driver,
+			   &vgem_device->platform->dev);
+	if (ret)
+		goto out_unregister;
 
 	/* Final step: expose the device/driver to userspace */
 	ret  = drm_dev_register(&vgem_device->drm, 0);
 	if (ret)
-		goto out_unregister;
+		goto out_fini;
 
 	return 0;
 
-out_unregister:
-	platform_device_unregister(vgem_device->platform);
 out_fini:
 	drm_dev_fini(&vgem_device->drm);
+out_unregister:
+	platform_device_unregister(vgem_device->platform);
 out_free:
 	kfree(vgem_device);
 	return ret;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 005/352] pinctrl: bcm2835: Use raw spinlock for RT compatibility
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 006/352] clk: sunxi-ng: h6: Set video PLLs limits Greg Kroah-Hartman
                   ` (349 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathias Duckeck, Lukas Wunner,
	Julia Cartwright, Linus Walleij, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 3c7b30f704b6f5e53eed6bf89cf2c8d1b38b02c0 ]

The BCM2835 pinctrl driver acquires a spinlock in its ->irq_enable,
->irq_disable and ->irq_set_type callbacks.  Spinlocks become sleeping
locks with CONFIG_PREEMPT_RT_FULL=y, therefore invocation of one of the
callbacks in atomic context may cause a hard lockup if at least two GPIO
pins in the same bank are used as interrupts.  The issue doesn't occur
with just a single interrupt pin per bank because the lock is never
contended.  I'm experiencing such lockups with GPIO 8 and 28 used as
level-triggered interrupts, i.e. with ->irq_disable being invoked on
reception of every IRQ.

The critical section protected by the spinlock is very small (one bitop
and one RMW of an MMIO register), hence converting to a raw spinlock
seems a better trade-off than converting the driver to threaded IRQ
handling (which would increase latency to handle an interrupt).

Cc: Mathias Duckeck <m.duckeck@kunbus.de>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Julia Cartwright <julia@ni.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index fa530913a2c8..08925d24180b 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -90,7 +90,7 @@ struct bcm2835_pinctrl {
 	struct gpio_chip gpio_chip;
 	struct pinctrl_gpio_range gpio_range;
 
-	spinlock_t irq_lock[BCM2835_NUM_BANKS];
+	raw_spinlock_t irq_lock[BCM2835_NUM_BANKS];
 };
 
 /* pins are just named GPIO0..GPIO53 */
@@ -461,10 +461,10 @@ static void bcm2835_gpio_irq_enable(struct irq_data *data)
 	unsigned bank = GPIO_REG_OFFSET(gpio);
 	unsigned long flags;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 	set_bit(offset, &pc->enabled_irq_map[bank]);
 	bcm2835_gpio_irq_config(pc, gpio, true);
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
 
 static void bcm2835_gpio_irq_disable(struct irq_data *data)
@@ -476,12 +476,12 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data)
 	unsigned bank = GPIO_REG_OFFSET(gpio);
 	unsigned long flags;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 	bcm2835_gpio_irq_config(pc, gpio, false);
 	/* Clear events that were latched prior to clearing event sources */
 	bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
 	clear_bit(offset, &pc->enabled_irq_map[bank]);
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
 
 static int __bcm2835_gpio_irq_set_type_disabled(struct bcm2835_pinctrl *pc,
@@ -584,7 +584,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
 	unsigned long flags;
 	int ret;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 
 	if (test_bit(offset, &pc->enabled_irq_map[bank]))
 		ret = __bcm2835_gpio_irq_set_type_enabled(pc, gpio, type);
@@ -596,7 +596,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
 	else
 		irq_set_handler_locked(data, handle_level_irq);
 
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 
 	return ret;
 }
@@ -1047,7 +1047,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
 		for_each_set_bit(offset, &events, 32)
 			bcm2835_gpio_wr(pc, GPEDS0 + i * 4, BIT(offset));
 
-		spin_lock_init(&pc->irq_lock[i]);
+		raw_spin_lock_init(&pc->irq_lock[i]);
 	}
 
 	err = gpiochip_add_data(&pc->gpio_chip, pc);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 006/352] clk: sunxi-ng: h6: Set video PLLs limits
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 005/352] pinctrl: bcm2835: Use raw spinlock for RT compatibility Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 007/352] ASoC: Intel: mrfld: fix uninitialized variable access Greg Kroah-Hartman
                   ` (348 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ed4433419d45bf8b58aef34c4450a27e1c8699e8 ]

Video PLL factors can be set in a way that final PLL rate is outside
stable range. H6 user manual specifically says that N factor should not
be below 12. While it doesn't says anything about maximum stable rate, it
is clear that PLL doesn't work at 6.096 GHz (254 * 24 MHz).

Set minimum allowed PLL video rate to 288 MHz (12 * 24 MHz) and maximum
to 2.4 GHz, which is maximum in BSP driver.

Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
index 2193e1495086..19ff09f610e4 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
@@ -120,6 +120,8 @@ static struct ccu_nm pll_video0_clk = {
 	.n		= _SUNXI_CCU_MULT_MIN(8, 8, 12),
 	.m		= _SUNXI_CCU_DIV(1, 1), /* input divider */
 	.fixed_post_div	= 4,
+	.min_rate	= 288000000,
+	.max_rate	= 2400000000UL,
 	.common		= {
 		.reg		= 0x040,
 		.features	= CCU_FEATURE_FIXED_POSTDIV,
@@ -136,6 +138,8 @@ static struct ccu_nm pll_video1_clk = {
 	.n		= _SUNXI_CCU_MULT_MIN(8, 8, 12),
 	.m		= _SUNXI_CCU_DIV(1, 1), /* input divider */
 	.fixed_post_div	= 4,
+	.min_rate	= 288000000,
+	.max_rate	= 2400000000UL,
 	.common		= {
 		.reg		= 0x048,
 		.features	= CCU_FEATURE_FIXED_POSTDIV,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 007/352] ASoC: Intel: mrfld: fix uninitialized variable access
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 006/352] clk: sunxi-ng: h6: Set video PLLs limits Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 008/352] gpiolib: Fix possible use after free on label Greg Kroah-Hartman
                   ` (347 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Pierre-Louis Bossart,
	Mark Brown, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1539c7f23f256120f89f8b9ec53160790bce9ed2 ]

Randconfig testing revealed a very old bug, with gcc-8:

sound/soc/intel/atom/sst/sst_loader.c: In function 'sst_load_fw':
sound/soc/intel/atom/sst/sst_loader.c:357:5: error: 'fw' may be used uninitialized in this function [-Werror=maybe-uninitialized]
  if (fw == NULL) {
     ^
sound/soc/intel/atom/sst/sst_loader.c:354:25: note: 'fw' was declared here
  const struct firmware *fw;

We must check the return code of request_firmware() before we look at the
pointer result that may be uninitialized when the function fails.

Fixes: 9012c9544eea ("ASoC: Intel: mrfld - Add DSP load and management")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/atom/sst/sst_loader.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/intel/atom/sst/sst_loader.c b/sound/soc/intel/atom/sst/sst_loader.c
index 27413ebae956..b8c456753f01 100644
--- a/sound/soc/intel/atom/sst/sst_loader.c
+++ b/sound/soc/intel/atom/sst/sst_loader.c
@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst)
 	const struct firmware *fw;
 
 	retval = request_firmware(&fw, sst->firmware_name, sst->dev);
-	if (fw == NULL) {
-		dev_err(sst->dev, "fw is returning as null\n");
-		return -EINVAL;
-	}
 	if (retval) {
 		dev_err(sst->dev, "request fw failed %d\n", retval);
 		return retval;
 	}
+	if (fw == NULL) {
+		dev_err(sst->dev, "fw is returning as null\n");
+		return -EINVAL;
+	}
 	mutex_lock(&sst->sst_lock);
 	retval = sst_cache_and_parse_fw(sst, fw);
 	mutex_unlock(&sst->sst_lock);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 008/352] gpiolib: Fix possible use after free on label
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 007/352] ASoC: Intel: mrfld: fix uninitialized variable access Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 009/352] drm/sun4i: Initialize registers in tcon-top driver Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Muchun Song, Linus Walleij, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 18534df419041e6c1f4b41af56ee7d41f757815c ]

gpiod_request_commit() copies the pointer to the label passed as
an argument only to be used later. But there's a chance the caller
could immediately free the passed string(e.g., local variable).
This could trigger a use after free when we use gpio label(e.g.,
gpiochip_unlock_as_irq(), gpiochip_is_requested()).

To be on the safe side: duplicate the string with kstrdup_const()
so that if an unaware user passes an address to a stack-allocated
buffer, we won't get the arbitrary label.

Also fix gpiod_set_consumer_name().

Signed-off-by: Muchun Song <smuchun@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib.c        | 25 +++++++++++++++++++++----
 include/linux/gpio/consumer.h |  6 ++++--
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 76913e23cf3a..bd44be115cdd 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2306,6 +2306,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 	unsigned long		flags;
 	unsigned		offset;
 
+	if (label) {
+		label = kstrdup_const(label, GFP_KERNEL);
+		if (!label)
+			return -ENOMEM;
+	}
+
 	spin_lock_irqsave(&gpio_lock, flags);
 
 	/* NOTE:  gpio_request() can be called in early boot,
@@ -2316,6 +2322,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 		desc_set_label(desc, label ? : "?");
 		status = 0;
 	} else {
+		kfree_const(label);
 		status = -EBUSY;
 		goto done;
 	}
@@ -2332,6 +2339,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 
 		if (status < 0) {
 			desc_set_label(desc, NULL);
+			kfree_const(label);
 			clear_bit(FLAG_REQUESTED, &desc->flags);
 			goto done;
 		}
@@ -2427,6 +2435,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc)
 			chip->free(chip, gpio_chip_hwgpio(desc));
 			spin_lock_irqsave(&gpio_lock, flags);
 		}
+		kfree_const(desc->label);
 		desc_set_label(desc, NULL);
 		clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
 		clear_bit(FLAG_REQUESTED, &desc->flags);
@@ -3382,11 +3391,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep);
  * @desc: gpio to set the consumer name on
  * @name: the new consumer name
  */
-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
+int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
 {
-	VALIDATE_DESC_VOID(desc);
-	/* Just overwrite whatever the previous name was */
-	desc->label = name;
+	VALIDATE_DESC(desc);
+	if (name) {
+		name = kstrdup_const(name, GFP_KERNEL);
+		if (!name)
+			return -ENOMEM;
+	}
+
+	kfree_const(desc->label);
+	desc_set_label(desc, name);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(gpiod_set_consumer_name);
 
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index f2f887795d43..ed070512b40e 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -162,7 +162,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc);
 int gpiod_cansleep(const struct gpio_desc *desc);
 
 int gpiod_to_irq(const struct gpio_desc *desc);
-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
+int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
 
 /* Convert between the old gpio_ and new gpiod_ interfaces */
 struct gpio_desc *gpio_to_desc(unsigned gpio);
@@ -495,10 +495,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
 	return -EINVAL;
 }
 
-static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
+static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+					  const char *name)
 {
 	/* GPIO can never have been requested */
 	WARN_ON(1);
+	return -EINVAL;
 }
 
 static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 009/352] drm/sun4i: Initialize registers in tcon-top driver
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 008/352] gpiolib: Fix possible use after free on label Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 010/352] ath10k: fixup extended per sta tx statistics Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c96d62215fb540e2ae61de44cb7caf4db50958e3 ]

It turns out that TCON TOP registers in H6 SoC have non-zero reset
value. This may cause issues if bits are not changed during
configuration.

To prevent that, initialize registers to 0.

Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181104182705.18047-24-jernej.skrabec@siol.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index 3040a79f298f..37158548b447 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -167,6 +167,13 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
 		goto err_assert_reset;
 	}
 
+	/*
+	 * At least on H6, some registers have some bits set by default
+	 * which may cause issues. Clear them here.
+	 */
+	writel(0, regs + TCON_TOP_PORT_SEL_REG);
+	writel(0, regs + TCON_TOP_GATE_SRC_REG);
+
 	/*
 	 * TCON TOP has two muxes, which select parent clock for each TCON TV
 	 * channel clock. Parent could be either TCON TV or TVE clock. For now
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 010/352] ath10k: fixup extended per sta tx statistics
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 009/352] drm/sun4i: Initialize registers in tcon-top driver Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 011/352] genirq/affinity: Spread IRQs to all available NUMA nodes Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 539b44e70c5b4ad82d2c0c97a4dfb37523d891f6 ]

I had a couple concerns with this code.  First, we definitely need to
set the error code if the kzalloc() fails.  Secondly, I was worried that
if we didn't set "arsta->tx_stats" to NULL after freeing it, then it
looks to me like it might lead to a use after free.  I can't test that,
but it's harmless to set it to NULL so I did.

Fixes: a904417fc876 ("ath10k: add extended per sta tx statistics support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 7e49342bae38..b4764fee4751 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6296,8 +6296,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
 			arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats),
 						  GFP_KERNEL);
-			if (!arsta->tx_stats)
+			if (!arsta->tx_stats) {
+				ret = -ENOMEM;
 				goto exit;
+			}
 		}
 
 		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);
@@ -6385,8 +6387,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			   "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
 			   arvif->vdev_id, sta->addr, sta);
 
-		if (ath10k_debug_is_extd_tx_stats_enabled(ar))
+		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
 			kfree(arsta->tx_stats);
+			arsta->tx_stats = NULL;
+		}
 
 		if (sta->tdls) {
 			ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 011/352] genirq/affinity: Spread IRQs to all available NUMA nodes
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 010/352] ath10k: fixup extended per sta tx statistics Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:13 ` [PATCH 4.20 012/352] gpu: ipu-v3: image-convert: Prevent race between run and unprepare Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Long Li, Thomas Gleixner, Ming Lei,
	Michael Kelley, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b82592199032bf7c778f861b936287e37ebc9f62 ]

If the number of NUMA nodes exceeds the number of MSI/MSI-X interrupts
which are allocated for a device, the interrupt affinity spreading code
fails to spread them across all nodes.

The reason is, that the spreading code starts from node 0 and continues up
to the number of interrupts requested for allocation. This leaves the nodes
past the last interrupt unused.

This results in interrupt concentration on the first nodes which violates
the assumption of the block layer that all nodes are covered evenly. As a
consequence the NUMA nodes above the number of interrupts are all assigned
to hardware queue 0 and therefore NUMA node 0, which results in bad
performance and has CPU hotplug implications, because queue 0 gets shut
down when the last CPU of node 0 is offlined.

Go over all NUMA nodes and assign them round-robin to all requested
interrupts to solve this.

[ tglx: Massaged changelog ]

Signed-off-by: Long Li <longli@microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Cc: Michael Kelley <mikelley@microsoft.com>
Link: https://lkml.kernel.org/r/20181102180248.13583-1-longli@linuxonhyperv.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/affinity.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index f4f29b9d90ee..e12cdf637c71 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -117,12 +117,11 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
 	 */
 	if (numvecs <= nodes) {
 		for_each_node_mask(n, nodemsk) {
-			cpumask_copy(masks + curvec, node_to_cpumask[n]);
-			if (++done == numvecs)
-				break;
+			cpumask_or(masks + curvec, masks + curvec, node_to_cpumask[n]);
 			if (++curvec == last_affv)
 				curvec = affd->pre_vectors;
 		}
+		done = numvecs;
 		goto out;
 	}
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 012/352] gpu: ipu-v3: image-convert: Prevent race between run and unprepare
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 011/352] genirq/affinity: Spread IRQs to all available NUMA nodes Greg Kroah-Hartman
@ 2019-02-11 14:13 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 013/352] drm/amd/display: Fix potential nullptr error Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Longerbeam, Philipp Zabel, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 819bec35c8c9706185498c9222bd244e0781ad35 ]

Prevent possible race by parallel threads between ipu_image_convert_run()
and ipu_image_convert_unprepare(). This involves setting ctx->aborting
to true unconditionally so that no new job runs can be queued during
unprepare, and holding the ctx->aborting flag until the context is freed.

Note that the "normal" ipu_image_convert_abort() case (e.g. not during
context unprepare) should clear the ctx->aborting flag after aborting
any active run and clearing the context's pending queue. This is because
it should be possible to continue to use the conversion context and queue
more runs after an abort.

Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
Tested-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/ipu-v3/ipu-image-convert.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
index f4081962784c..91653adc41cc 100644
--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
@@ -1524,7 +1524,7 @@ unlock:
 EXPORT_SYMBOL_GPL(ipu_image_convert_queue);
 
 /* Abort any active or pending conversions for this context */
-void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+static void __ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 {
 	struct ipu_image_convert_chan *chan = ctx->chan;
 	struct ipu_image_convert_priv *priv = chan->priv;
@@ -1551,7 +1551,7 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 
 	need_abort = (run_count || active_run);
 
-	ctx->aborting = need_abort;
+	ctx->aborting = true;
 
 	spin_unlock_irqrestore(&chan->irqlock, flags);
 
@@ -1572,7 +1572,11 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 		dev_warn(priv->ipu->dev, "%s: timeout\n", __func__);
 		force_abort(ctx);
 	}
+}
 
+void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+{
+	__ipu_image_convert_abort(ctx);
 	ctx->aborting = false;
 }
 EXPORT_SYMBOL_GPL(ipu_image_convert_abort);
@@ -1586,7 +1590,7 @@ void ipu_image_convert_unprepare(struct ipu_image_convert_ctx *ctx)
 	bool put_res;
 
 	/* make sure no runs are hanging around */
-	ipu_image_convert_abort(ctx);
+	__ipu_image_convert_abort(ctx);
 
 	dev_dbg(priv->ipu->dev, "%s: task %u: removing ctx %p\n", __func__,
 		chan->ic_task, ctx);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 013/352] drm/amd/display: Fix potential nullptr error
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2019-02-11 14:13 ` [PATCH 4.20 012/352] gpu: ipu-v3: image-convert: Prevent race between run and unprepare Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 014/352] nds32: Fix gcc 8.0 compiler option incompatible Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bhawanpreet Lakha, Aric Cyr, Leo Li,
	Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f7129112c2a30331f3045a42026fad82e6cb72b ]

[Why]
Fix surface/plane potential nullptr

[How]
add null check

Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 3118ae0e7a87..315a245aedc2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5333,6 +5333,12 @@ enum surface_update_type dm_determine_update_type_for_commit(struct dc *dc, stru
 	struct dc_stream_update stream_update;
 	enum surface_update_type update_type = UPDATE_TYPE_FAST;
 
+	if (!updates || !surface) {
+		DRM_ERROR("Plane or surface update failed to allocate");
+		/* Set type to FULL to avoid crashing in DC*/
+		update_type = UPDATE_TYPE_FULL;
+		goto ret;
+	}
 
 	for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
 		new_dm_crtc_state = to_dm_crtc_state(new_crtc_state);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 014/352] nds32: Fix gcc 8.0 compiler option incompatible.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 013/352] drm/amd/display: Fix potential nullptr error Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 015/352] wil6210: fix reset flow for Talyn-mb Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nickhu, Zong Li, Greentime Hu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4c3d6174e0e17599549f636ec48ddf78627a17fe ]

When the kernel configs of ftrace and frame pointer options are
choosed, the compiler option of kernel will incompatible.
	Error message:
		nds32le-linux-gcc: error: -pg and -fomit-frame-pointer are incompatible

Signed-off-by: Nickhu <nickhu@andestech.com>
Signed-off-by: Zong Li <zong@andestech.com>
Acked-by: Greentime Hu <greentime@andestech.com>
Signed-off-by: Greentime Hu <greentime@andestech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/nds32/mm/Makefile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/nds32/mm/Makefile b/arch/nds32/mm/Makefile
index 6b6855852223..7c5c15ad854a 100644
--- a/arch/nds32/mm/Makefile
+++ b/arch/nds32/mm/Makefile
@@ -4,4 +4,8 @@ obj-y				:= extable.o tlb.o \
 
 obj-$(CONFIG_ALIGNMENT_TRAP)	+= alignment.o
 obj-$(CONFIG_HIGHMEM)           += highmem.o
-CFLAGS_proc-n13.o		+= -fomit-frame-pointer
+
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_proc.o     = $(CC_FLAGS_FTRACE)
+endif
+CFLAGS_proc.o              += -fomit-frame-pointer
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 015/352] wil6210: fix reset flow for Talyn-mb
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 014/352] nds32: Fix gcc 8.0 compiler option incompatible Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 016/352] wil6210: fix memory leak in wil_find_tx_bcast_2 Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexei Avshalom Lazar, Maya Erez,
	Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d083b2e2b7db5cca1791643d036e6597af27f49b ]

With current reset flow, Talyn sometimes get stuck causing PCIe
enumeration to fail. Fix this by removing some reset flow operations
that are not relevant for Talyn.
Setting bit 15 in RGF_HP_CTRL is WBE specific and is not in use for
all wil6210 devices.
For Sparrow, BIT_HPAL_PERST_FROM_PAD and BIT_CAR_PERST_RST were set
as a WA an HW issue.

Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wil6210/main.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 398900a1c29e..c54b008996ee 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -998,10 +998,13 @@ static int wil_target_reset(struct wil6210_priv *wil, int no_flash)
 
 	wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
 
-	/* Clear MAC link up */
-	wil_s(wil, RGF_HP_CTRL, BIT(15));
-	wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_HPAL_PERST_FROM_PAD);
-	wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
+	if (wil->hw_version < HW_VER_TALYN) {
+		/* Clear MAC link up */
+		wil_s(wil, RGF_HP_CTRL, BIT(15));
+		wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0,
+		      BIT_HPAL_PERST_FROM_PAD);
+		wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
+	}
 
 	wil_halt_cpu(wil);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 016/352] wil6210: fix memory leak in wil_find_tx_bcast_2
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 015/352] wil6210: fix reset flow for Talyn-mb Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 017/352] ath10k: assign n_cipher_suites for WCN3990 Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lior David, Maya Erez, Kalle Valo,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 664497400c89a4d40aee51bcf48bbd2e4dc71104 ]

A successful call to wil_tx_ring takes skb reference so
it will only be freed in wil_tx_complete. Consume the skb
in wil_find_tx_bcast_2 to prevent memory leak.

Signed-off-by: Lior David <liord@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wil6210/txrx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index cc5f263cc965..005c4ba9e823 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1403,6 +1403,8 @@ found:
 			wil_dbg_txrx(wil, "BCAST DUP -> ring %d\n", i);
 			wil_set_da_for_vring(wil, skb2, i);
 			wil_tx_ring(wil, vif, v2, skb2);
+			/* successful call to wil_tx_ring takes skb2 ref */
+			dev_kfree_skb_any(skb2);
 		} else {
 			wil_err(wil, "skb_copy failed\n");
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 017/352] ath10k: assign n_cipher_suites for WCN3990
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 016/352] wil6210: fix memory leak in wil_find_tx_bcast_2 Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Govind Singh,
	Brian Norris, Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2bd345cd2bfc0bd44528896313c0b45f087bdf67 ]

Commit 2ea9f12cefe4 ("ath10k: add new cipher suite support") added a new
n_cipher_suites HW param with a fallback value and a warning log. Commit
03a72288c546 ("ath10k: wmi: add hw params entry for wcn3990") later
added WCN3990 HW entries, but it missed the n_cipher_suites.

Rather than seeing this warning every boot

  ath10k_snoc 18800000.wifi: invalid hw_params.n_cipher_suites 0

let's provide the appropriate value.

Cc: Rakesh Pillai <pillair@qti.qualcomm.com>
Cc: Govind Singh <govinds@qti.qualcomm.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index d210b0ed59be..59fdda67f89f 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -561,6 +561,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
 		.hw_ops = &wcn3990_ops,
 		.decap_align_bytes = 1,
 		.num_peers = TARGET_HL_10_TLV_NUM_PEERS,
+		.n_cipher_suites = 8,
 		.ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT,
 		.num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES,
 		.target_64bit = true,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 017/352] ath10k: assign n_cipher_suites for WCN3990 Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 15:48   ` Koen Vandeputte
  2019-02-11 14:14 ` [PATCH 4.20 019/352] scsi: lpfc: Correct LCB RJT handling Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Koen Vandeputte, Lorenzo Bianconi,
	Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ]

In order to properly support dynack in ad-hoc mode running
wpa_supplicant, take into account authentication frames for
'late ack' detection. This patch has been tested on devices
mounted on offshore high-voltage stations connected through
~24Km link

Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/dynack.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
index 7334c9b09e82..cc0dc966c512 100644
--- a/drivers/net/wireless/ath/ath9k/dynack.c
+++ b/drivers/net/wireless/ath/ath9k/dynack.c
@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
 	/* late ACK */
 	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
 		if (ieee80211_is_assoc_req(hdr->frame_control) ||
-		    ieee80211_is_assoc_resp(hdr->frame_control)) {
+		    ieee80211_is_assoc_resp(hdr->frame_control) ||
+		    ieee80211_is_auth(hdr->frame_control)) {
 			ath_dbg(common, DYNACK, "late ack\n");
 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 019/352] scsi: lpfc: Correct LCB RJT handling
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 020/352] scsi: mpt3sas: Call sas_remove_host before removing the target devices Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
	Hannes Reinecke, Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b114d9009d386276bfc3352289fc235781ae3353 ]

When LCB's are rejected, if beaconing was already in progress, the
Reason Code Explanation was not being set. Should have been set to
command in progress.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_els.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index f1c1faa74b46..96e2f542734a 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5701,6 +5701,9 @@ error:
 	stat = (struct ls_rjt *)(pcmd + sizeof(uint32_t));
 	stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC;
 
+	if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE)
+		stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS;
+
 	elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp;
 	phba->fc_stat.elsXmitLSRJT++;
 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 020/352] scsi: mpt3sas: Call sas_remove_host before removing the target devices
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 019/352] scsi: lpfc: Correct LCB RJT handling Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 021/352] scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Suganath Prabu, Bjorn Helgaas,
	Andy Shevchenko, Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit dc730212e8a378763cb182b889f90c8101331332 ]

Call sas_remove_host() before removing the target devices in the driver's
.remove() callback function(i.e. during driver unload time).  So that
driver can provide a way to allow SYNC CACHE, START STOP unit commands
etc. (which are issued from SML) to the target drives during driver unload
time.

Once sas_remove_host() is called before removing the target drives then
driver can just clean up the resources allocated for target devices and no
need to call sas_port_delete_phy(), sas_port_delete() API's as these API's
internally called from sas_remove_host().

Signed-off-by: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c     | 2 +-
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 03c52847ed07..adac18ba84d4 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -9641,6 +9641,7 @@ static void scsih_remove(struct pci_dev *pdev)
 
 	/* release all the volumes */
 	_scsih_ir_shutdown(ioc);
+	sas_remove_host(shost);
 	list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
 	    list) {
 		if (raid_device->starget) {
@@ -9682,7 +9683,6 @@ static void scsih_remove(struct pci_dev *pdev)
 		ioc->sas_hba.num_phys = 0;
 	}
 
-	sas_remove_host(shost);
 	mpt3sas_base_detach(ioc);
 	spin_lock(&gioc_lock);
 	list_del(&ioc->list);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index 6a8a3c09b4b1..8338b4db0e31 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -821,10 +821,13 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 			    mpt3sas_port->remote_identify.sas_address,
 			    mpt3sas_phy->phy_id);
 		mpt3sas_phy->phy_belongs_to_port = 0;
-		sas_port_delete_phy(mpt3sas_port->port, mpt3sas_phy->phy);
+		if (!ioc->remove_host)
+			sas_port_delete_phy(mpt3sas_port->port,
+						mpt3sas_phy->phy);
 		list_del(&mpt3sas_phy->port_siblings);
 	}
-	sas_port_delete(mpt3sas_port->port);
+	if (!ioc->remove_host)
+		sas_port_delete(mpt3sas_port->port);
 	kfree(mpt3sas_port);
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 021/352] scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 020/352] scsi: mpt3sas: Call sas_remove_host before removing the target devices Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 022/352] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
	Hannes Reinecke, Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 30e196cacefdd9a38c857caed23cefc9621bc5c1 ]

After a LOGO in response to an ABTS timeout, a PLOGI wasn't issued to
re-establish the login.  An nlp_type check in the LOGO completion
handler failed to restart discovery for NVME targets.  Revised the
nlp_type check for NVME as well as SCSI.

While reviewing the LOGO handling a few other issues were seen and
were addressed:

- Better lock synchronization around ndlp data types

- When the ABTS times out, unregister the RPI before sending the LOGO
  so that all local exchange contexts are cleared and nothing received
  while awaiting LOGO/PLOGI handling will be accepted.

- LOGO handling optimized to:
   Wait only R_A_TOV for a response.
   It doesn't need to be retried on timeout. If there wasn't a
     response, a PLOGI will be sent, thus an implicit logout
     applies as well when the other port sees it.
   If there is a response, any kind of response is considered "good"
     and the XRI quarantined for a exchange qualifier window.

- PLOGI is issued as soon a LOGO state is resolved.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_els.c       | 49 +++++++++++++-----------------
 drivers/scsi/lpfc/lpfc_nportdisc.c |  5 +++
 2 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 96e2f542734a..c2dae02f193e 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -242,6 +242,8 @@ lpfc_prep_els_iocb(struct lpfc_vport *vport, uint8_t expectRsp,
 		icmd->ulpCommand = CMD_ELS_REQUEST64_CR;
 		if (elscmd == ELS_CMD_FLOGI)
 			icmd->ulpTimeout = FF_DEF_RATOV * 2;
+		else if (elscmd == ELS_CMD_LOGO)
+			icmd->ulpTimeout = phba->fc_ratov;
 		else
 			icmd->ulpTimeout = phba->fc_ratov * 2;
 	} else {
@@ -2682,16 +2684,15 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 		goto out;
 	}
 
+	/* The LOGO will not be retried on failure.  A LOGO was
+	 * issued to the remote rport and a ACC or RJT or no Answer are
+	 * all acceptable.  Note the failure and move forward with
+	 * discovery.  The PLOGI will retry.
+	 */
 	if (irsp->ulpStatus) {
-		/* Check for retry */
-		if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
-			/* ELS command is being retried */
-			skip_recovery = 1;
-			goto out;
-		}
 		/* LOGO failed */
 		lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
-				 "2756 LOGO failure DID:%06X Status:x%x/x%x\n",
+				 "2756 LOGO failure, No Retry DID:%06X Status:x%x/x%x\n",
 				 ndlp->nlp_DID, irsp->ulpStatus,
 				 irsp->un.ulpWord[4]);
 		/* Do not call DSM for lpfc_els_abort'ed ELS cmds */
@@ -2737,7 +2738,8 @@ out:
 	 * For any other port type, the rpi is unregistered as an implicit
 	 * LOGO.
 	 */
-	if ((ndlp->nlp_type & NLP_FCP_TARGET) && (skip_recovery == 0)) {
+	if (ndlp->nlp_type & (NLP_FCP_TARGET | NLP_NVME_TARGET) &&
+	    skip_recovery == 0) {
 		lpfc_cancel_retry_delay_tmo(vport, ndlp);
 		spin_lock_irqsave(shost->host_lock, flags);
 		ndlp->nlp_flag |= NLP_NPR_2B_DISC;
@@ -2770,6 +2772,8 @@ out:
  * will be stored into the context1 field of the IOCB for the completion
  * callback function to the LOGO ELS command.
  *
+ * Callers of this routine are expected to unregister the RPI first
+ *
  * Return code
  *   0 - successfully issued logo
  *   1 - failed to issue logo
@@ -2811,22 +2815,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 		"Issue LOGO:      did:x%x",
 		ndlp->nlp_DID, 0, 0);
 
-	/*
-	 * If we are issuing a LOGO, we may try to recover the remote NPort
-	 * by issuing a PLOGI later. Even though we issue ELS cmds by the
-	 * VPI, if we have a valid RPI, and that RPI gets unreg'ed while
-	 * that ELS command is in-flight, the HBA returns a IOERR_INVALID_RPI
-	 * for that ELS cmd. To avoid this situation, lets get rid of the
-	 * RPI right now, before any ELS cmds are sent.
-	 */
-	spin_lock_irq(shost->host_lock);
-	ndlp->nlp_flag |= NLP_ISSUE_LOGO;
-	spin_unlock_irq(shost->host_lock);
-	if (lpfc_unreg_rpi(vport, ndlp)) {
-		lpfc_els_free_iocb(phba, elsiocb);
-		return 0;
-	}
-
 	phba->fc_stat.elsXmitLOGO++;
 	elsiocb->iocb_cmpl = lpfc_cmpl_els_logo;
 	spin_lock_irq(shost->host_lock);
@@ -2834,7 +2822,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	ndlp->nlp_flag &= ~NLP_ISSUE_LOGO;
 	spin_unlock_irq(shost->host_lock);
 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);
-
 	if (rc == IOCB_ERROR) {
 		spin_lock_irq(shost->host_lock);
 		ndlp->nlp_flag &= ~NLP_LOGO_SND;
@@ -2842,6 +2829,11 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 		lpfc_els_free_iocb(phba, elsiocb);
 		return 1;
 	}
+
+	spin_lock_irq(shost->host_lock);
+	ndlp->nlp_prev_state = ndlp->nlp_state;
+	spin_unlock_irq(shost->host_lock);
+	lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE);
 	return 0;
 }
 
@@ -9508,7 +9500,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport,
 				"rport in state 0x%x\n", ndlp->nlp_state);
 		return;
 	}
-	lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+	lpfc_printf_log(phba, KERN_ERR,
+			LOG_ELS | LOG_FCP_ERROR | LOG_NVME_IOERR,
 			"3094 Start rport recovery on shost id 0x%x "
 			"fc_id 0x%06x vpi 0x%x rpi 0x%x state 0x%x "
 			"flags 0x%x\n",
@@ -9521,8 +9514,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport,
 	 */
 	spin_lock_irqsave(shost->host_lock, flags);
 	ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+	ndlp->nlp_flag |= NLP_ISSUE_LOGO;
 	spin_unlock_irqrestore(shost->host_lock, flags);
-	lpfc_issue_els_logo(vport, ndlp, 0);
-	lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE);
+	lpfc_unreg_rpi(vport, ndlp);
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 269808e8480f..394ffbe9cb6d 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -836,7 +836,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
 
 	if (!(ndlp->nlp_flag & NLP_RPI_REGISTERED)) {
+		spin_lock_irq(shost->host_lock);
 		ndlp->nlp_flag &= ~NLP_NPR_ADISC;
+		spin_unlock_irq(shost->host_lock);
 		return 0;
 	}
 
@@ -851,7 +853,10 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 			return 1;
 		}
 	}
+
+	spin_lock_irq(shost->host_lock);
 	ndlp->nlp_flag &= ~NLP_NPR_ADISC;
+	spin_unlock_irq(shost->host_lock);
 	lpfc_unreg_rpi(vport, ndlp);
 	return 0;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 022/352] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 021/352] scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 023/352] clk: boston: fix possible memory leak in clk_boston_setup() Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yufen Wang, Russell King, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 82c08c3e7f171aa7f579b231d0abbc1d62e91974 ]

In case panic() and panic() called at the same time on different CPUS.
For example:
CPU 0:
  panic()
     __crash_kexec
       machine_crash_shutdown
         crash_smp_send_stop
       machine_kexec
         BUG_ON(num_online_cpus() > 1);

CPU 1:
  panic()
    local_irq_disable
    panic_smp_self_stop

If CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop(), kdump
fails. CPU1 can't receive the ipi irq, CPU1 will be always online.
To fix this problem, this patch split out the panic_smp_self_stop()
and add set_cpu_online(smp_processor_id(), false).

Signed-off-by: Yufen Wang <wangyufen@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/smp.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 12a6172263c0..3bf82232b1be 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -724,6 +724,21 @@ void smp_send_stop(void)
 		pr_warn("SMP: failed to stop secondary CPUs\n");
 }
 
+/* In case panic() and panic() called at the same time on CPU1 and CPU2,
+ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop()
+ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online,
+ * kdump fails. So split out the panic_smp_self_stop() and add
+ * set_cpu_online(smp_processor_id(), false).
+ */
+void panic_smp_self_stop(void)
+{
+	pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n",
+	         smp_processor_id());
+	set_cpu_online(smp_processor_id(), false);
+	while (1)
+		cpu_relax();
+}
+
 /*
  * not supported here
  */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 023/352] clk: boston: fix possible memory leak in clk_boston_setup()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 022/352] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 024/352] dlm: Dont swamp the CPU with callbacks queued during recovery Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yi Wang, Stephen Boyd, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 46fda5b5067a391912cf73bf3d32c26b6a22ad09 ]

Smatch report warnings:
drivers/clk/imgtec/clk-boston.c:76 clk_boston_setup() warn: possible memory leak of 'onecell'
drivers/clk/imgtec/clk-boston.c:83 clk_boston_setup() warn: possible memory leak of 'onecell'
drivers/clk/imgtec/clk-boston.c:90 clk_boston_setup() warn: possible memory leak of 'onecell'

'onecell' is malloced in clk_boston_setup(), but not be freed
before leaving from the error handling cases.

Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imgtec/clk-boston.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c
index 15af423cc0c9..f5d54a64d33c 100644
--- a/drivers/clk/imgtec/clk-boston.c
+++ b/drivers/clk/imgtec/clk-boston.c
@@ -73,27 +73,32 @@ static void __init clk_boston_setup(struct device_node *np)
 	hw = clk_hw_register_fixed_rate(NULL, "input", NULL, 0, in_freq);
 	if (IS_ERR(hw)) {
 		pr_err("failed to register input clock: %ld\n", PTR_ERR(hw));
-		return;
+		goto error;
 	}
 	onecell->hws[BOSTON_CLK_INPUT] = hw;
 
 	hw = clk_hw_register_fixed_rate(NULL, "sys", "input", 0, sys_freq);
 	if (IS_ERR(hw)) {
 		pr_err("failed to register sys clock: %ld\n", PTR_ERR(hw));
-		return;
+		goto error;
 	}
 	onecell->hws[BOSTON_CLK_SYS] = hw;
 
 	hw = clk_hw_register_fixed_rate(NULL, "cpu", "input", 0, cpu_freq);
 	if (IS_ERR(hw)) {
 		pr_err("failed to register cpu clock: %ld\n", PTR_ERR(hw));
-		return;
+		goto error;
 	}
 	onecell->hws[BOSTON_CLK_CPU] = hw;
 
 	err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, onecell);
 	if (err)
 		pr_err("failed to add DT provider: %d\n", err);
+
+	return;
+
+error:
+	kfree(onecell);
 }
 
 /*
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 024/352] dlm: Dont swamp the CPU with callbacks queued during recovery
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 023/352] clk: boston: fix possible memory leak in clk_boston_setup() Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 025/352] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bob Peterson, David Teigland, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 216f0efd19b9cc32207934fd1b87a45f2c4c593e ]

Before this patch, recovery would cause all callbacks to be delayed,
put on a queue, and afterward they were all queued to the callback
work queue. This patch does the same thing, but occasionally takes
a break after 25 of them so it won't swamp the CPU at the expense
of other RT processes like corosync.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/ast.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
index 562fa8c3edff..47ee66d70109 100644
--- a/fs/dlm/ast.c
+++ b/fs/dlm/ast.c
@@ -292,6 +292,8 @@ void dlm_callback_suspend(struct dlm_ls *ls)
 		flush_workqueue(ls->ls_callback_wq);
 }
 
+#define MAX_CB_QUEUE 25
+
 void dlm_callback_resume(struct dlm_ls *ls)
 {
 	struct dlm_lkb *lkb, *safe;
@@ -302,15 +304,23 @@ void dlm_callback_resume(struct dlm_ls *ls)
 	if (!ls->ls_callback_wq)
 		return;
 
+more:
 	mutex_lock(&ls->ls_cb_mutex);
 	list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) {
 		list_del_init(&lkb->lkb_cb_list);
 		queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
 		count++;
+		if (count == MAX_CB_QUEUE)
+			break;
 	}
 	mutex_unlock(&ls->ls_cb_mutex);
 
 	if (count)
 		log_rinfo(ls, "dlm_callback_resume %d", count);
+	if (count == MAX_CB_QUEUE) {
+		count = 0;
+		cond_resched();
+		goto more;
+	}
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 025/352] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 024/352] dlm: Dont swamp the CPU with callbacks queued during recovery Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 026/352] powerpc/pseries: add of_node_put() in dlpar_detach_node() Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Bjorn Helgaas, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 53bb565fc5439f2c8c57a786feea5946804aa3e9 ]

In the expression "word1 << 16", word1 starts as u16, but is promoted to a
signed int, then sign-extended to resource_size_t, which is probably not
what was intended.  Cast to resource_size_t to avoid the sign extension.

This fixes an identical issue as fixed by commit 0b2d70764bb3 ("x86/PCI:
Fix Broadcom CNB20LE unintended sign extension") back in 2014.

Detected by CoverityScan, CID#138749, 138750 ("Unintended sign extension")

Fixes: 3f6ea84a3035 ("PCI: read memory ranges out of Broadcom CNB20LE host bridge")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/pci/broadcom_bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c
index 526536c81ddc..ca1e8e6dccc8 100644
--- a/arch/x86/pci/broadcom_bus.c
+++ b/arch/x86/pci/broadcom_bus.c
@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func)
 	word1 = read_pci_config_16(bus, slot, func, 0xc0);
 	word2 = read_pci_config_16(bus, slot, func, 0xc2);
 	if (word1 != word2) {
-		res.start = (word1 << 16) | 0x0000;
-		res.end   = (word2 << 16) | 0xffff;
+		res.start = ((resource_size_t) word1 << 16) | 0x0000;
+		res.end   = ((resource_size_t) word2 << 16) | 0xffff;
 		res.flags = IORESOURCE_MEM;
 		update_res(info, res.start, res.end, res.flags, 0);
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 026/352] powerpc/pseries: add of_node_put() in dlpar_detach_node()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 025/352] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 027/352] bpftool: Improve handling of ENOENT on map dumps Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Tull, Michael Ellerman,
	Frank Rowand, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5b3f5c408d8cc59b87e47f1ab9803dbd006e4a91 ]

The previous commit, "of: overlay: add missing of_node_get() in
__of_attach_node_sysfs" added a missing of_node_get() to
__of_attach_node_sysfs().  This results in a refcount imbalance
for nodes attached with dlpar_attach_node().  The calling sequence
from dlpar_attach_node() to __of_attach_node_sysfs() is:

   dlpar_attach_node()
      of_attach_node()
         __of_attach_node_sysfs()

For more detailed description of the node refcount, see
commit 68baf692c435 ("powerpc/pseries: Fix of_node_put() underflow
during DLPAR remove").

Tested-by: Alan Tull <atull@kernel.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/dlpar.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 7625546caefd..17958043e7f7 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -270,6 +270,8 @@ int dlpar_detach_node(struct device_node *dn)
 	if (rc)
 		return rc;
 
+	of_node_put(dn);
+
 	return 0;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 027/352] bpftool: Improve handling of ENOENT on map dumps
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 026/352] powerpc/pseries: add of_node_put() in dlpar_detach_node() Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 028/352] s390/qeth: utilize virtual MAC for Layer2 OSD devices Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Ahern, Jakub Kicinski,
	Daniel Borkmann, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit bf598a8f0f771302d4ecb0ef0003c54732221597 ]

bpftool output is not user friendly when dumping a map with only a few
populated entries:

    $ bpftool map
    1: devmap  name tx_devmap  flags 0x0
            key 4B  value 4B  max_entries 64  memlock 4096B
    2: array  name tx_idxmap  flags 0x0
            key 4B  value 4B  max_entries 64  memlock 4096B

    $ bpftool map dump id 1
    key:
    00 00 00 00
    value:
    No such file or directory
    key:
    01 00 00 00
    value:
    No such file or directory
    key:
    02 00 00 00
    value:
    No such file or directory
    key: 03 00 00 00  value: 03 00 00 00

Handle ENOENT by keeping the line format sane and dumping
"<no entry>" for the value

    $ bpftool map dump id 1
    key: 00 00 00 00  value: <no entry>
    key: 01 00 00 00  value: <no entry>
    key: 02 00 00 00  value: <no entry>
    key: 03 00 00 00  value: 03 00 00 00
    ...

Signed-off-by: David Ahern <dsahern@gmail.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/map.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 7bf38f0e152e..9988d5c126b6 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -383,7 +383,10 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 		printf(single_line ? "  " : "\n");
 
 		printf("value:%c", break_names ? '\n' : ' ');
-		fprint_hex(stdout, value, info->value_size, " ");
+		if (value)
+			fprint_hex(stdout, value, info->value_size, " ");
+		else
+			printf("<no entry>");
 
 		printf("\n");
 	} else {
@@ -398,8 +401,11 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 		for (i = 0; i < n; i++) {
 			printf("value (CPU %02d):%c",
 			       i, info->value_size > 16 ? '\n' : ' ');
-			fprint_hex(stdout, value + i * step,
-				   info->value_size, " ");
+			if (value)
+				fprint_hex(stdout, value + i * step,
+					   info->value_size, " ");
+			else
+				printf("<no entry>");
 			printf("\n");
 		}
 	}
@@ -731,7 +737,11 @@ static int dump_map_elem(int fd, void *key, void *value,
 		jsonw_string_field(json_wtr, "error", strerror(lookup_errno));
 		jsonw_end_object(json_wtr);
 	} else {
-		print_entry_error(map_info, key, strerror(lookup_errno));
+		if (errno == ENOENT)
+			print_entry_plain(map_info, key, NULL);
+		else
+			print_entry_error(map_info, key,
+					  strerror(lookup_errno));
 	}
 
 	return 0;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 028/352] s390/qeth: utilize virtual MAC for Layer2 OSD devices
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 027/352] bpftool: Improve handling of ENOENT on map dumps Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 029/352] crypto: aes_ti - disable interrupts while accessing S-box Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Wiedmann, David S. Miller,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b144b99fff69a5bc0d34c8e168bedb88c68ca23d ]

By default, READ MAC on a Layer2 OSD device returns the adapter's
burnt-in MAC address. Given the default scenario of many virtual devices
on the same adapter, qeth can't make any use of this address and
therefore skips the READ MAC call for this device type.

But in some configurations, the READ MAC command for a Layer2 OSD device
actually returns a pre-provisioned, virtual MAC address. So enable the
READ MAC code to detect this situation, and let the L2 subdriver
call READ MAC for OSD devices.

This also removes the QETH_LAYER2_MAC_READ flag, which protects L2
devices against calling READ MAC multiple times. Instead protect the
whole call to qeth_l2_request_initial_mac().

Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_core.h      |  1 -
 drivers/s390/net/qeth_core_main.c | 12 +++++++-----
 drivers/s390/net/qeth_core_mpc.h  | 25 +++++++++++++++----------
 drivers/s390/net/qeth_l2_main.c   | 10 ++++------
 4 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 04e294d1d16d..99af1a0a3314 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -665,7 +665,6 @@ struct qeth_card_blkt {
 
 #define QETH_BROADCAST_WITH_ECHO    0x01
 #define QETH_BROADCAST_WITHOUT_ECHO 0x02
-#define QETH_LAYER2_MAC_READ	    0x01
 #define QETH_LAYER2_MAC_REGISTERED  0x02
 struct qeth_card_info {
 	unsigned short unit_addr2;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 254065271867..0c9a5250dd93 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -4235,16 +4235,18 @@ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
 	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+	struct qeth_ipacmd_setadpparms *adp_cmd;
 
 	QETH_CARD_TEXT(card, 4, "chgmaccb");
 	if (qeth_setadpparms_inspect_rc(cmd))
 		return 0;
 
-	if (IS_LAYER3(card) || !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
-		ether_addr_copy(card->dev->dev_addr,
-				cmd->data.setadapterparms.data.change_addr.addr);
-		card->info.mac_bits |= QETH_LAYER2_MAC_READ;
-	}
+	adp_cmd = &cmd->data.setadapterparms;
+	if (IS_LAYER2(card) && IS_OSD(card) && !IS_VM_NIC(card) &&
+	    !(adp_cmd->hdr.flags & QETH_SETADP_FLAGS_VIRTUAL_MAC))
+		return 0;
+
+	ether_addr_copy(card->dev->dev_addr, adp_cmd->data.change_addr.addr);
 	return 0;
 }
 
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index 3e54be201b27..10cc487c16d6 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -80,7 +80,9 @@ enum qeth_card_types {
 };
 
 #define IS_IQD(card)	((card)->info.type == QETH_CARD_TYPE_IQD)
+#define IS_OSD(card)	((card)->info.type == QETH_CARD_TYPE_OSD)
 #define IS_OSN(card)	((card)->info.type == QETH_CARD_TYPE_OSN)
+#define IS_VM_NIC(card)	((card)->info.guestlan)
 
 #define QETH_MPC_DIFINFO_LEN_INDICATES_LINK_TYPE 0x18
 /* only the first two bytes are looked at in qeth_get_cardname_short */
@@ -529,17 +531,20 @@ struct qeth_query_switch_attributes {
 	__u8  reserved3[8];
 };
 
+#define QETH_SETADP_FLAGS_VIRTUAL_MAC	0x80	/* for CHANGE_ADDR_READ_MAC */
+
 struct qeth_ipacmd_setadpparms_hdr {
-	__u32 supp_hw_cmds;
-	__u32 reserved1;
-	__u16 cmdlength;
-	__u16 reserved2;
-	__u32 command_code;
-	__u16 return_code;
-	__u8  used_total;
-	__u8  seq_no;
-	__u32 reserved3;
-} __attribute__ ((packed));
+	u32 supp_hw_cmds;
+	u32 reserved1;
+	u16 cmdlength;
+	u16 reserved2;
+	u32 command_code;
+	u16 return_code;
+	u8 used_total;
+	u8 seq_no;
+	u8 flags;
+	u8 reserved3[3];
+};
 
 struct qeth_ipacmd_setadpparms {
 	struct qeth_ipacmd_setadpparms_hdr hdr;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2914a1a69f83..8d3601891c62 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -461,12 +461,9 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
 		/* fall back to alternative mechanism: */
 	}
 
-	if (card->info.type == QETH_CARD_TYPE_IQD ||
-	    card->info.type == QETH_CARD_TYPE_OSM ||
-	    card->info.type == QETH_CARD_TYPE_OSX ||
-	    card->info.guestlan) {
+	if (!IS_OSN(card)) {
 		rc = qeth_setadpparms_change_macaddr(card);
-		if (!rc)
+		if (!rc && is_valid_ether_addr(card->dev->dev_addr))
 			goto out;
 		QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %x: %#x\n",
 				 CARD_DEVID(card), rc);
@@ -917,7 +914,8 @@ static int qeth_l2_setup_netdev(struct qeth_card *card, bool carrier_ok)
 				       PAGE_SIZE * (QDIO_MAX_ELEMENTS_PER_BUFFER - 1));
 	}
 
-	qeth_l2_request_initial_mac(card);
+	if (!is_valid_ether_addr(card->dev->dev_addr))
+		qeth_l2_request_initial_mac(card);
 	netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
 	rc = register_netdev(card->dev);
 	if (!rc && carrier_ok)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 029/352] crypto: aes_ti - disable interrupts while accessing S-box
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 028/352] s390/qeth: utilize virtual MAC for Layer2 OSD devices Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 030/352] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Eric Biggers,
	Herbert Xu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0a6a40c2a8c184a2fb467efacfb1cd338d719e0b ]

In the "aes-fixed-time" AES implementation, disable interrupts while
accessing the S-box, in order to make cache-timing attacks more
difficult.  Previously it was possible for the CPU to be interrupted
while the S-box was loaded into L1 cache, potentially evicting the
cachelines and causing later table lookups to be time-variant.

In tests I did on x86 and ARM, this doesn't affect performance
significantly.  Responsiveness is potentially a concern, but interrupts
are only disabled for a single AES block.

Note that even after this change, the implementation still isn't
necessarily guaranteed to be constant-time; see
https://cr.yp.to/antiforgery/cachetiming-20050414.pdf for a discussion
of the many difficulties involved in writing truly constant-time AES
software.  But it's valuable to make such attacks more difficult.

Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/Kconfig  |  3 ++-
 crypto/aes_ti.c | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/crypto/Kconfig b/crypto/Kconfig
index 05c91eb10ca1..4f24acac3d48 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1006,7 +1006,8 @@ config CRYPTO_AES_TI
 	  8 for decryption), this implementation only uses just two S-boxes of
 	  256 bytes each, and attempts to eliminate data dependent latencies by
 	  prefetching the entire table into the cache at the start of each
-	  block.
+	  block. Interrupts are also disabled to avoid races where cachelines
+	  are evicted when the CPU is interrupted to do something else.
 
 config CRYPTO_AES_586
 	tristate "AES cipher algorithms (i586)"
diff --git a/crypto/aes_ti.c b/crypto/aes_ti.c
index 03023b2290e8..1ff9785b30f5 100644
--- a/crypto/aes_ti.c
+++ b/crypto/aes_ti.c
@@ -269,6 +269,7 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	const u32 *rkp = ctx->key_enc + 4;
 	int rounds = 6 + ctx->key_length / 4;
 	u32 st0[4], st1[4];
+	unsigned long flags;
 	int round;
 
 	st0[0] = ctx->key_enc[0] ^ get_unaligned_le32(in);
@@ -276,6 +277,12 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	st0[2] = ctx->key_enc[2] ^ get_unaligned_le32(in + 8);
 	st0[3] = ctx->key_enc[3] ^ get_unaligned_le32(in + 12);
 
+	/*
+	 * Temporarily disable interrupts to avoid races where cachelines are
+	 * evicted when the CPU is interrupted to do something else.
+	 */
+	local_irq_save(flags);
+
 	st0[0] ^= __aesti_sbox[ 0] ^ __aesti_sbox[128];
 	st0[1] ^= __aesti_sbox[32] ^ __aesti_sbox[160];
 	st0[2] ^= __aesti_sbox[64] ^ __aesti_sbox[192];
@@ -300,6 +307,8 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	put_unaligned_le32(subshift(st1, 1) ^ rkp[5], out + 4);
 	put_unaligned_le32(subshift(st1, 2) ^ rkp[6], out + 8);
 	put_unaligned_le32(subshift(st1, 3) ^ rkp[7], out + 12);
+
+	local_irq_restore(flags);
 }
 
 static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
@@ -308,6 +317,7 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	const u32 *rkp = ctx->key_dec + 4;
 	int rounds = 6 + ctx->key_length / 4;
 	u32 st0[4], st1[4];
+	unsigned long flags;
 	int round;
 
 	st0[0] = ctx->key_dec[0] ^ get_unaligned_le32(in);
@@ -315,6 +325,12 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	st0[2] = ctx->key_dec[2] ^ get_unaligned_le32(in + 8);
 	st0[3] = ctx->key_dec[3] ^ get_unaligned_le32(in + 12);
 
+	/*
+	 * Temporarily disable interrupts to avoid races where cachelines are
+	 * evicted when the CPU is interrupted to do something else.
+	 */
+	local_irq_save(flags);
+
 	st0[0] ^= __aesti_inv_sbox[ 0] ^ __aesti_inv_sbox[128];
 	st0[1] ^= __aesti_inv_sbox[32] ^ __aesti_inv_sbox[160];
 	st0[2] ^= __aesti_inv_sbox[64] ^ __aesti_inv_sbox[192];
@@ -339,6 +355,8 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	put_unaligned_le32(inv_subshift(st1, 1) ^ rkp[5], out + 4);
 	put_unaligned_le32(inv_subshift(st1, 2) ^ rkp[6], out + 8);
 	put_unaligned_le32(inv_subshift(st1, 3) ^ rkp[7], out + 12);
+
+	local_irq_restore(flags);
 }
 
 static struct crypto_alg aes_alg = {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 030/352] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 029/352] crypto: aes_ti - disable interrupts while accessing S-box Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 031/352] serial: fsl_lpuart: clear parity enable bit when disable parity Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Eric Anholt, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0560054da5673b25d56bea6c57c8d069673af73b ]

For the YUV conversion to work properly, ->x_scaling[1] should never
be set to VC4_SCALING_NONE, but vc4_get_scaling_mode() might return
VC4_SCALING_NONE if the horizontal scaling ratio exactly matches the
horizontal subsampling factor. Add a test to turn VC4_SCALING_NONE
into VC4_SCALING_PPF when that happens.

The old ->x_scaling[0] adjustment is dropped as I couldn't find any
mention to this constraint in the spec and it's proven to be
unnecessary (I tested various multi-planar YUV formats with scaling
disabled, and all of them worked fine without this adjustment).

Fixes: fc04023fafec ("drm/vc4: Add support for YUV planes.")
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181109102633.32603-1-boris.brezillon@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vc4/vc4_plane.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index ae6254b0b1ae..ed8b0fc170ee 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -314,12 +314,14 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 			vc4_get_scaling_mode(vc4_state->src_h[1],
 					     vc4_state->crtc_h);
 
-		/* YUV conversion requires that horizontal scaling be enabled,
-		 * even on a plane that's otherwise 1:1. Looks like only PPF
-		 * works in that case, so let's pick that one.
+		/* YUV conversion requires that horizontal scaling be enabled
+		 * on the UV plane even if vc4_get_scaling_mode() returned
+		 * VC4_SCALING_NONE (which can happen when the down-scaling
+		 * ratio is 0.5). Let's force it to VC4_SCALING_PPF in this
+		 * case.
 		 */
-		if (vc4_state->is_unity)
-			vc4_state->x_scaling[0] = VC4_SCALING_PPF;
+		if (vc4_state->x_scaling[1] == VC4_SCALING_NONE)
+			vc4_state->x_scaling[1] = VC4_SCALING_PPF;
 	} else {
 		vc4_state->is_yuv = false;
 		vc4_state->x_scaling[1] = VC4_SCALING_NONE;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 031/352] serial: fsl_lpuart: clear parity enable bit when disable parity
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 030/352] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 032/352] ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Andy Duan,
	Fabio Estevam, Uwe Kleine-König, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 397bd9211fe014b347ca8f95a8f4e1017bac1aeb ]

Current driver only enable parity enable bit and never clear it
when user set the termios. The fix clear the parity enable bit when
PARENB flag is not set in termios->c_cflag.

Cc: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Andy Duan <fugang.duan@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/fsl_lpuart.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 00c220e4f43c..086642ea4b26 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1479,6 +1479,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
 			else
 				cr1 &= ~UARTCR1_PT;
 		}
+	} else {
+		cr1 &= ~UARTCR1_PE;
 	}
 
 	/* ask the core to calculate the divisor */
@@ -1690,6 +1692,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 			else
 				ctrl &= ~UARTCTRL_PT;
 		}
+	} else {
+		ctrl &= ~UARTCTRL_PE;
 	}
 
 	/* ask the core to calculate the divisor */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 032/352] ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 031/352] serial: fsl_lpuart: clear parity enable bit when disable parity Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 033/352] MIPS: Boston: Disable EG20T prefetch Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Cochran, Jacob Keller,
	Miroslav Lichvar, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 83d0bdc7390b890905634186baaa294475cd6a06 ]

If a gettime64 call fails, return the error and avoid copying data back
to user.

Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ptp/ptp_chardev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 2012551d93e0..796eeffdf93b 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -228,7 +228,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
 			pct->sec = ts.tv_sec;
 			pct->nsec = ts.tv_nsec;
 			pct++;
-			ptp->info->gettime64(ptp->info, &ts);
+			err = ptp->info->gettime64(ptp->info, &ts);
+			if (err)
+				goto out;
 			pct->sec = ts.tv_sec;
 			pct->nsec = ts.tv_nsec;
 			pct++;
@@ -281,6 +283,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
 		break;
 	}
 
+out:
 	kfree(sysoff);
 	return err;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 033/352] MIPS: Boston: Disable EG20T prefetch
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 032/352] ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 034/352] dpaa2-ptp: defer probe when portal allocation failed Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Burton, linux-mips, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5ec17af7ead09701e23d2065e16db6ce4e137289 ]

The Intel EG20T Platform Controller Hub used on the MIPS Boston
development board supports prefetching memory to optimize DMA transfers.
Unfortunately for unknown reasons this doesn't work well with some MIPS
CPUs such as the P6600, particularly when using an I/O Coherence Unit
(IOCU) to provide cache-coherent DMA. In these systems it is common for
DMA data to be lost, resulting in broken access to EG20T devices such as
the MMC or SATA controllers.

Support for a DT property to configure the prefetching was added a while
back by commit 549ce8f134bd ("misc: pch_phub: Read prefetch value from
device tree if passed") but we never added the DT snippet to make use of
it. Add that now in order to disable the prefetching & fix DMA on the
affected systems.

Signed-off-by: Paul Burton <paul.burton@mips.com>
Patchwork: https://patchwork.linux-mips.org/patch/21068/
Cc: linux-mips@linux-mips.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/boot/dts/img/boston.dts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts
index 65af3f6ba81c..84328afa3a55 100644
--- a/arch/mips/boot/dts/img/boston.dts
+++ b/arch/mips/boot/dts/img/boston.dts
@@ -141,6 +141,12 @@
 				#size-cells = <2>;
 				#interrupt-cells = <1>;
 
+				eg20t_phub@2,0,0 {
+					compatible = "pci8086,8801";
+					reg = <0x00020000 0 0 0 0>;
+					intel,eg20t-prefetch = <0>;
+				};
+
 				eg20t_mac@2,0,1 {
 					compatible = "pci8086,8802";
 					reg = <0x00020100 0 0 0 0>;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 034/352] dpaa2-ptp: defer probe when portal allocation failed
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 033/352] MIPS: Boston: Disable EG20T prefetch Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 035/352] iwlwifi: fw: do not set sgi bits for HE connection Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ioana Ciornei, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5500598abbfb5b46201b9768bd9ea873a5eeaece ]

The fsl_mc_portal_allocate can fail when the requested MC portals are
not yet probed by the fsl_mc_allocator. In this situation, the driver
should defer the probe.

Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c
index 84b942b1eccc..9b150db3b510 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c
@@ -140,7 +140,10 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev)
 
 	err = fsl_mc_portal_allocate(mc_dev, 0, &mc_dev->mc_io);
 	if (err) {
-		dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
+		if (err == -ENXIO)
+			err = -EPROBE_DEFER;
+		else
+			dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
 		goto err_exit;
 	}
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 035/352] iwlwifi: fw: do not set sgi bits for HE connection
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 034/352] dpaa2-ptp: defer probe when portal allocation failed Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 036/352] staging:iio:ad2s90: Make probe handle spi_setup failure Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naftali Goldstein, Luca Coelho, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5c2dbebb446539eb9640bf59a02756d6e7f1fc53 ]

If the association supports HE, HT/VHT rates will never be used for Tx
and therefore there's no need to set the sgi-per-channel-width-support
bits, so don't set them in this case.

Fixes: 110b32f065f3 ("iwlwifi: mvm: rs: add basic implementation of the new RS API handlers")
Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
index 7a98e1a1dc40..dabbc04853ac 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
@@ -98,8 +98,12 @@ static u8 rs_fw_sgi_cw_support(struct ieee80211_sta *sta)
 {
 	struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
 	u8 supp = 0;
 
+	if (he_cap && he_cap->has_he)
+		return 0;
+
 	if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
 		supp |= BIT(IWL_TLC_MNG_CH_WIDTH_20MHZ);
 	if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 036/352] staging:iio:ad2s90: Make probe handle spi_setup failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 035/352] iwlwifi: fw: do not set sgi bits for HE connection Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 037/352] fpga: altera-cvp: Fix registration for CvP incapable devices Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matheus Tavares, Jonathan Cameron,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b3a3eafeef769c6982e15f83631dcbf8d1794efb ]

Previously, ad2s90_probe ignored the return code from spi_setup, not
handling its possible failure. This patch makes ad2s90_probe check if
the code is an error code and, if so, do the following:

- Call dev_err with an appropriate error message.
- Return the spi_setup's error code.

Note: The 'return ret' statement could be out of the 'if' block, but
this whole block will be moved up in the function in the patch:
'staging:iio:ad2s90: Move device registration to the end of probe'.

Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/iio/resolver/ad2s90.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/iio/resolver/ad2s90.c b/drivers/staging/iio/resolver/ad2s90.c
index 59586947a936..51cda9151412 100644
--- a/drivers/staging/iio/resolver/ad2s90.c
+++ b/drivers/staging/iio/resolver/ad2s90.c
@@ -85,7 +85,12 @@ static int ad2s90_probe(struct spi_device *spi)
 	/* need 600ns between CS and the first falling edge of SCLK */
 	spi->max_speed_hz = 830000;
 	spi->mode = SPI_MODE_3;
-	spi_setup(spi);
+	ret = spi_setup(spi);
+
+	if (ret < 0) {
+		dev_err(&spi->dev, "spi_setup failed!\n");
+		return ret;
+	}
 
 	return 0;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 037/352] fpga: altera-cvp: Fix registration for CvP incapable devices
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 036/352] staging:iio:ad2s90: Make probe handle spi_setup failure Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 038/352] Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1 Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andreas Puhm, Anatolij Gustschin,
	Moritz Fischer, Alan Tull, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 68f60538daa4bc3da5d0764d46f391916fba20fd ]

The probe function needs to verify the CvP enable bit in order to
properly determine if FPGA Manager functionality can be safely
enabled.

Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Signed-off-by: Andreas Puhm <puhm@oregano.at>
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Reviewed-by: Moritz Fischer <mdf@kernel.org>
Acked-by: Alan Tull <atull@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/altera-cvp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index d9fa7d4bf11f..36d79b039c57 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 	struct altera_cvp_conf *conf;
 	struct fpga_manager *mgr;
 	u16 cmd, val;
+	u32 regval;
 	int ret;
 
 	/*
@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 		return -ENODEV;
 	}
 
+	pci_read_config_dword(pdev, VSE_CVP_STATUS, &regval);
+	if (!(regval & VSE_CVP_STATUS_CVP_EN)) {
+		dev_err(&pdev->dev,
+			"CVP is disabled for this device: CVP_STATUS Reg 0x%x\n",
+			regval);
+		return -ENODEV;
+	}
+
 	conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL);
 	if (!conf)
 		return -ENOMEM;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 038/352] Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 037/352] fpga: altera-cvp: Fix registration for CvP incapable devices Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 039/352] fpga: altera-cvp: fix bad IO access on x86_64 Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dexuan Cui, K. Y. Srinivasan,
	Haiyang Zhang, Stephen Hemminger, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4fcba7802c3e15a6e56e255871d6c72f829b9dd8 ]

The patch fixes:

hv_kvp_daemon.c: In function 'kvp_set_ip_info':
hv_kvp_daemon.c:1305:2: note: 'snprintf' output between 41 and 4136 bytes
into a destination of size 4096

The "(unsigned int)str_len" is to avoid:

hv_kvp_daemon.c:1309:30: warning: comparison of integer expressions of
different signedness: 'int' and 'long unsigned int' [-Wsign-compare]

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: K. Y. Srinivasan <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/hv/hv_kvp_daemon.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index bbb2a8ef367c..d7e06fe0270e 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
 	FILE *file;
 	char cmd[PATH_MAX];
 	char *mac_addr;
+	int str_len;
 
 	/*
 	 * Set the configuration for the specified interface with
@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
 	 * invoke the external script to do its magic.
 	 */
 
-	snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
-		 "hv_set_ifconfig", if_file);
+	str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+			   "hv_set_ifconfig", if_file);
+	/*
+	 * This is a little overcautious, but it's necessary to suppress some
+	 * false warnings from gcc 8.0.1.
+	 */
+	if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
+		syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
+		       cmd, str_len);
+		return HV_E_FAIL;
+	}
+
 	if (system(cmd)) {
 		syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s",
 				cmd, errno, strerror(errno));
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 039/352] fpga: altera-cvp: fix bad IO access on x86_64
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 038/352] Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1 Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 040/352] vbox: fix link error with gcc -Og Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatolij Gustschin, Alan Tull, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 187fade88ca0ff2df9d360ca751d948d73db7095 ]

If mapping the CvP BAR fails, we still can configure the FPGA via
PCI config space access. In this case the iomap pointer is NULL.
On x86_64, passing NULL address to pci_iounmap() generates
"Bad IO access at port 0x0" output with stack call trace. Fix it.

Signed-off-by: Anatolij Gustschin <agust@denx.de>
Acked-by: Alan Tull <atull@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/altera-cvp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 36d79b039c57..35c3aa5792e2 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -478,7 +478,8 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 	return 0;
 
 err_unmap:
-	pci_iounmap(pdev, conf->map);
+	if (conf->map)
+		pci_iounmap(pdev, conf->map);
 	pci_release_region(pdev, CVP_BAR);
 err_disable:
 	cmd &= ~PCI_COMMAND_MEMORY;
@@ -493,7 +494,8 @@ static void altera_cvp_remove(struct pci_dev *pdev)
 	u16 cmd;
 
 	fpga_mgr_unregister(mgr);
-	pci_iounmap(pdev, conf->map);
+	if (conf->map)
+		pci_iounmap(pdev, conf->map);
 	pci_release_region(pdev, CVP_BAR);
 	pci_read_config_word(pdev, PCI_COMMAND, &cmd);
 	cmd &= ~PCI_COMMAND_MEMORY;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 040/352] vbox: fix link error with gcc -Og
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 039/352] fpga: altera-cvp: fix bad IO access on x86_64 Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 041/352] platform/chrome: dont report EC_MKBP_EVENT_SENSOR_FIFO as wakeup Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Arnd Bergmann,
	Hans de Goede, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b8ae30a7020d61e0504529adf45abb08fa5c59f5 ]

With the new CONFIG_CC_OPTIMIZE_FOR_DEBUGGING option, we get a link
error in the vboxguest driver, when that fails to optimize out the
call to the compat handler:

drivers/virt/vboxguest/vboxguest_core.o: In function `vbg_ioctl_hgcm_call':
vboxguest_core.c:(.text+0x1f6e): undefined reference to `vbg_hgcm_call32'

Another compile-time check documents better what we want and avoids
the error.

Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virt/vboxguest/vboxguest_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 3093655c7b92..1475ed5ffcde 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1312,7 +1312,7 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
 		return -EINVAL;
 	}
 
-	if (f32bit)
+	if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
 		ret = vbg_hgcm_call32(gdev, client_id,
 				      call->function, call->timeout_ms,
 				      VBG_IOCTL_HGCM_CALL_PARMS32(call),
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 041/352] platform/chrome: dont report EC_MKBP_EVENT_SENSOR_FIFO as wakeup
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 040/352] vbox: fix link error with gcc -Og Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 042/352] i40e: suppress bogus error message Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Norris, Benson Leung, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6ad16b78a039b45294b1ad5d69c14ac57b2fe706 ]

EC_MKBP_EVENT_SENSOR_FIFO events can be triggered for a variety of
reasons, and there are very few cases in which they should be treated as
wakeup interrupts (particularly, when a certain
MOTIONSENSE_MODULE_FLAG_* is set, but this is not even supported in the
mainline cros_ec_sensor driver yet). Most of the time, they are benign
sensor readings. In any case, the top-level cros_ec device doesn't know
enough to determine that they should wake the system, and so it should
not report the event. This would be the job of the cros_ec_sensors
driver to parse.

This patch adds checks to cros_ec_get_next_event() such that it doesn't
signal 'wakeup' for events of type EC_MKBP_EVENT_SENSOR_FIFO.

This patch is particularly relevant on devices like Scarlet (Rockchip
RK3399 tablet, known as Acer Chromebook Tab 10), where the EC firmware
reports sensor events much more frequently. This was causing
/sys/power/wakeup_count to increase very frequently, often needlessly
interrupting our ability to suspend the system.

Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/chrome/cros_ec_proto.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index b6fd4838f60f..e5d5b1adb5a9 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -575,6 +575,7 @@ static int get_keyboard_state_event(struct cros_ec_device *ec_dev)
 
 int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event)
 {
+	u8 event_type;
 	u32 host_event;
 	int ret;
 
@@ -594,11 +595,22 @@ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event)
 		return ret;
 
 	if (wake_event) {
+		event_type = ec_dev->event_data.event_type;
 		host_event = cros_ec_get_host_event(ec_dev);
 
-		/* Consider non-host_event as wake event */
-		*wake_event = !host_event ||
-			      !!(host_event & ec_dev->host_event_wake_mask);
+		/*
+		 * Sensor events need to be parsed by the sensor sub-device.
+		 * Defer them, and don't report the wakeup here.
+		 */
+		if (event_type == EC_MKBP_EVENT_SENSOR_FIFO)
+			*wake_event = false;
+		/* Masked host-events should not count as wake events. */
+		else if (host_event &&
+			 !(host_event & ec_dev->host_event_wake_mask))
+			*wake_event = false;
+		/* Consider all other events as wake events. */
+		else
+			*wake_event = true;
 	}
 
 	return ret;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 042/352] i40e: suppress bogus error message
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 041/352] platform/chrome: dont report EC_MKBP_EVENT_SENSOR_FIFO as wakeup Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 043/352] i40e: prevent overlapping tx_timeout recover Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mitch Williams, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7cd8eb0861981ad212ce4242a1870c4b5831ceff ]

The i40e driver complains about unprivileged VFs trying to configure
promiscuous mode each time a VF reset occurs. This isn't the fault of
the poor VF driver - the PF driver itself is making the request.

To fix this, skip the privilege check if the request is to disable all
promiscuous activity. This gets rid of the bogus message, but doesn't
affect privilege checks, since we really only care if the unprivileged
VF is trying to enable promiscuous mode.

Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index ac5698ed0b11..c41e8ada23d1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1112,7 +1112,8 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf,
 	if (!i40e_vc_isvalid_vsi_id(vf, vsi_id) || !vsi)
 		return I40E_ERR_PARAM;
 
-	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
+	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) &&
+	    (allmulti || alluni)) {
 		dev_err(&pf->pdev->dev,
 			"Unprivileged VF %d is attempting to configure promiscuous mode\n",
 			vf->vf_id);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 043/352] i40e: prevent overlapping tx_timeout recover
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 042/352] i40e: suppress bogus error message Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 044/352] scsi: hisi_sas: change the time of SAS SSP connection Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Brady, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d5585b7b6846a6d0f9517afe57be3843150719da ]

If a TX hang occurs, we attempt to recover by incrementally resetting.
If we're starved for CPU time, it's possible the reset doesn't actually
complete (or even fire) before another tx_timeout fires causing us to
fly through the different resets without actually doing them.

This adds a bit to set and check if a timeout recovery is already
pending and, if so, bail out of tx_timeout.  The bit will get cleared at
the end of i40e_rebuild when reset is complete.

Signed-off-by: Alan Brady <alan.brady@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e.h      | 1 +
 drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index 876cac317e79..8245ff12fd64 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -122,6 +122,7 @@ enum i40e_state_t {
 	__I40E_MDD_EVENT_PENDING,
 	__I40E_VFLR_EVENT_PENDING,
 	__I40E_RESET_RECOVERY_PENDING,
+	__I40E_TIMEOUT_RECOVERY_PENDING,
 	__I40E_MISC_IRQ_REQUESTED,
 	__I40E_RESET_INTR_RECEIVED,
 	__I40E_REINIT_REQUESTED,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 0e5dc74b4ef2..419cf3faada6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -338,6 +338,10 @@ static void i40e_tx_timeout(struct net_device *netdev)
 		      (pf->tx_timeout_last_recovery + netdev->watchdog_timeo)))
 		return;   /* don't do any new action before the next timeout */
 
+	/* don't kick off another recovery if one is already pending */
+	if (test_and_set_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state))
+		return;
+
 	if (tx_ring) {
 		head = i40e_get_head(tx_ring);
 		/* Read interrupt register */
@@ -9632,6 +9636,7 @@ end_core_reset:
 	clear_bit(__I40E_RESET_FAILED, pf->state);
 clear_recovery:
 	clear_bit(__I40E_RESET_RECOVERY_PENDING, pf->state);
+	clear_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state);
 }
 
 /**
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 044/352] scsi: hisi_sas: change the time of SAS SSP connection
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 043/352] i40e: prevent overlapping tx_timeout recover Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 045/352] staging: iio: ad7780: update voltage on read Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiang Chen, John Garry,
	Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 15bc43f31a074076f114e0b87931e3b220b7bff1 ]

Currently the time of SAS SSP connection is 1ms, which means the link
connection will fail if no IO response after this period.

For some disks handling large IO (such as 512k), 1ms is not enough, so
change it to 5ms.

Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index a369450a1fa7..c3e0be90e19f 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -494,7 +494,7 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba)
 		hisi_sas_phy_write32(hisi_hba, i, PHYCTRL_OOB_RESTART_MSK, 0x1);
 		hisi_sas_phy_write32(hisi_hba, i, STP_LINK_TIMER, 0x7f7a120);
 		hisi_sas_phy_write32(hisi_hba, i, CON_CFG_DRIVER, 0x2a0a01);
-
+		hisi_sas_phy_write32(hisi_hba, i, SAS_SSP_CON_TIMER_CFG, 0x32);
 		/* used for 12G negotiate */
 		hisi_sas_phy_write32(hisi_hba, i, COARSETUNE_TIME, 0x1e);
 		hisi_sas_phy_write32(hisi_hba, i, AIP_LIMIT, 0x2ffff);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 045/352] staging: iio: ad7780: update voltage on read
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 044/352] scsi: hisi_sas: change the time of SAS SSP connection Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 046/352] usbnet: smsc95xx: fix rx packet alignment Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Renato Lui Geh, Alexandru Ardelean,
	Jonathan Cameron, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 336650c785b62c3bea7c8cf6061c933a90241f67 ]

The ad7780 driver previously did not read the correct device output, as
it read an outdated value set at initialization. It now updates its
voltage on read.

Signed-off-by: Renato Lui Geh <renatogeh@gmail.com>
Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/iio/adc/ad7780.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c
index b67412db0318..c7cb05cedbbc 100644
--- a/drivers/staging/iio/adc/ad7780.c
+++ b/drivers/staging/iio/adc/ad7780.c
@@ -87,12 +87,16 @@ static int ad7780_read_raw(struct iio_dev *indio_dev,
 			   long m)
 {
 	struct ad7780_state *st = iio_priv(indio_dev);
+	int voltage_uv;
 
 	switch (m) {
 	case IIO_CHAN_INFO_RAW:
 		return ad_sigma_delta_single_conversion(indio_dev, chan, val);
 	case IIO_CHAN_INFO_SCALE:
-		*val = st->int_vref_mv * st->gain;
+		voltage_uv = regulator_get_voltage(st->reg);
+		if (voltage_uv < 0)
+			return voltage_uv;
+		*val = (voltage_uv / 1000) * st->gain;
 		*val2 = chan->scan_type.realbits - 1;
 		return IIO_VAL_FRACTIONAL_LOG2;
 	case IIO_CHAN_INFO_OFFSET:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 046/352] usbnet: smsc95xx: fix rx packet alignment
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 045/352] staging: iio: ad7780: update voltage on read Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 047/352] drm/rockchip: fix for mailbox read size Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Dooks, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 810eeb1f41a9a272eedc94ca18c072e75678ede4 ]

The smsc95xx driver already takes into account the NET_IP_ALIGN
parameter when setting up the receive packet data, which means
we do not need to worry about aligning the packets in the usbnet
driver.

Adding the EVENT_NO_IP_ALIGN means that the IPv4 header is now
passed to the ip_rcv() routine with the start on an aligned address.

Tested on Raspberry Pi B3.

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc95xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index f2d01cb6f958..6e971628bb50 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1295,6 +1295,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 		dev->net->features |= NETIF_F_RXCSUM;
 
 	dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
+	set_bit(EVENT_NO_IP_ALIGN, &dev->flags);
 
 	smsc95xx_init_mac_address(dev);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 047/352] drm/rockchip: fix for mailbox read size
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 046/352] usbnet: smsc95xx: fix rx packet alignment Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 048/352] ARM: OMAP2+: hwmod: Fix some section annotations Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Damian Kos, Heiko Stuebner, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit fa68d4f8476bea4cdf441062b614b41bb85ef1da ]

Some of the functions (like cdn_dp_dpcd_read, cdn_dp_get_edid_block)
allow to read 64KiB, but the cdn_dp_mailbox_read_receive, that is
used by them, can read only up to 255 bytes at once. Normally, it's
not a big issue as DPCD or EDID reads won't (hopefully) exceed that
value.
The real issue here is the revocation list read during the HDCP
authentication process. (problematic use case:
https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.4/drivers/gpu/drm/rockchip/cdn-dp-reg.c#1152)
The list can reach 127*5+4 bytes (num devs * 5 bytes per ID/Bksv +
4 bytes of an additional info).
In other words - CTSes with HDCP Repeater won't pass without this
fix. Oh, and the driver will most likely stop working (best case
scenario).

Signed-off-by: Damian Kos <dkos@cadence.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/1541518625-25984-1-git-send-email-dkos@cadence.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
index 3105965fc260..5a485489a1e2 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
@@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
 }
 
 static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp,
-				       u8 *buff, u8 buff_size)
+				       u8 *buff, u16 buff_size)
 {
 	u32 i;
 	int ret;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 048/352] ARM: OMAP2+: hwmod: Fix some section annotations
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 047/352] drm/rockchip: fix for mailbox read size Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 049/352] drm/amd/display: fix gamma not being applied correctly Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Tony Lindgren,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c10b26abeb53cabc1e6271a167d3f3d396ce0218 ]

When building the kernel with Clang, the following section mismatch
warnings appears:

WARNING: vmlinux.o(.text+0x2d398): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_iclk_autoidle()
The function _setup() references
the function __init _setup_iclk_autoidle().
This is often because _setup lacks a __init
annotation or the annotation of _setup_iclk_autoidle is wrong.

WARNING: vmlinux.o(.text+0x2d3a0): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_reset()
The function _setup() references
the function __init _setup_reset().
This is often because _setup lacks a __init
annotation or the annotation of _setup_reset is wrong.

WARNING: vmlinux.o(.text+0x2d408): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_postsetup()
The function _setup() references
the function __init _setup_postsetup().
This is often because _setup lacks a __init
annotation or the annotation of _setup_postsetup is wrong.

_setup is used in omap_hwmod_allocate_module, which isn't marked __init
and looks like it shouldn't be, meaning to fix these warnings, those
functions must be moved out of the init section, which this patch does.

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/omap_hwmod.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 083dcd9942ce..921c9aaee63f 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2413,7 +2413,7 @@ static int __init _init(struct omap_hwmod *oh, void *data)
  * a stub; implementing this properly requires iclk autoidle usecounting in
  * the clock code.   No return value.
  */
-static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
+static void _setup_iclk_autoidle(struct omap_hwmod *oh)
 {
 	struct omap_hwmod_ocp_if *os;
 
@@ -2444,7 +2444,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
  * reset.  Returns 0 upon success or a negative error code upon
  * failure.
  */
-static int __init _setup_reset(struct omap_hwmod *oh)
+static int _setup_reset(struct omap_hwmod *oh)
 {
 	int r;
 
@@ -2505,7 +2505,7 @@ static int __init _setup_reset(struct omap_hwmod *oh)
  *
  * No return value.
  */
-static void __init _setup_postsetup(struct omap_hwmod *oh)
+static void _setup_postsetup(struct omap_hwmod *oh)
 {
 	u8 postsetup_state;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 049/352] drm/amd/display: fix gamma not being applied correctly
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 048/352] ARM: OMAP2+: hwmod: Fix some section annotations Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 050/352] drm/amd/display: calculate stream->phy_pix_clk before clock mapping Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Murton Liu, Krunoslav Kovac,
	Bhawanpreet Lakha, Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8ce504b9389be846bcdf512ed5be8f661b3bf097 ]

[why]
Gamma was always being set as identity on SDR monitor,
leading to no changes in gamma. This caused nightlight to
not apply correctly.

[how]
Added a default gamma structure to compare against
in the sdr case.

Signed-off-by: Murton Liu <murton.liu@amd.com>
Reviewed-by: Krunoslav Kovac <Krunoslav.Kovac@amd.com>
Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 193184affefb..32e4c653b1b4 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -1226,7 +1226,8 @@ static bool dcn10_set_input_transfer_func(struct pipe_ctx *pipe_ctx,
 		tf = plane_state->in_transfer_func;
 
 	if (plane_state->gamma_correction &&
-		!plane_state->gamma_correction->is_identity
+		!dpp_base->ctx->dc->debug.always_use_regamma
+		&& !plane_state->gamma_correction->is_identity
 			&& dce_use_lut(plane_state->format))
 		dpp_base->funcs->dpp_program_input_lut(dpp_base, plane_state->gamma_correction);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 050/352] drm/amd/display: calculate stream->phy_pix_clk before clock mapping
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 049/352] drm/amd/display: fix gamma not being applied correctly Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 051/352] bpf: libbpf: retry map creation without the name Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yogesh Mohan Marimuthu,
	Harry Wentland, Bhawanpreet Lakha, Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 08e1c28dd521c7b08d1b0af0bae9fb22ccc012a4 ]

[why]
phy_pix_clk is one of the variable used to check if one PLL can be shared
with displays having common mode set configuration. As of now
phy_pix_clock varialbe is calculated in function dc_validate_stream().
dc_validate_stream() function is called after clocks are assigned for the
new display. Due to this during hotplug, when PLL sharing conditions are
checked for new display phy_pix_clk variable will be 0 and for displays
that are already enabled phy_pix_clk will have some value. Hence PLL will
not be shared and if the display hardware doesn't have any more PLL to
assign, mode set will fail due to resource unavailability.

[how]
Instead of only calculating the phy_pix_clk variable after the PLL is
assigned for new display, this patch calculates phy_pix_clk also during
the before assigning the PLL for new display.

Signed-off-by: Yogesh Mohan Marimuthu <yogesh.mohanmarimuthu@amd.com>
Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index b6fe29b9fb65..8bd8f34b979c 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -2002,6 +2002,8 @@ enum dc_status resource_map_pool_resources(
 		}
 	*/
 
+	calculate_phy_pix_clks(stream);
+
 	/* acquire new resources */
 	pipe_idx = acquire_first_free_pipe(&context->res_ctx, pool, stream);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 051/352] bpf: libbpf: retry map creation without the name
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 050/352] drm/amd/display: calculate stream->phy_pix_clk before clock mapping Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 052/352] net/mlx5: EQ, Use the right place to store/read IRQ affinity hint Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stanislav Fomichev, Daniel Borkmann,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 23499442c319412aa8e54e7a939e2eb531bdd77d ]

Since commit 88cda1c9da02 ("bpf: libbpf: Provide basic API support
to specify BPF obj name"), libbpf unconditionally sets bpf_attr->name
for maps. Pre v4.14 kernels don't know about map names and return an
error about unexpected non-zero data. Retry sys_bpf without a map
name to cover older kernels.

v2 changes:
* check for errno == EINVAL as suggested by Daniel Borkmann

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/bpf.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 03f9bcc4ef50..961e1b9fc592 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -69,6 +69,7 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
 {
 	__u32 name_len = create_attr->name ? strlen(create_attr->name) : 0;
 	union bpf_attr attr;
+	int ret;
 
 	memset(&attr, '\0', sizeof(attr));
 
@@ -86,7 +87,15 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
 	attr.map_ifindex = create_attr->map_ifindex;
 	attr.inner_map_fd = create_attr->inner_map_fd;
 
-	return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	ret = sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	if (ret < 0 && errno == EINVAL && create_attr->name) {
+		/* Retry the same syscall, but without the name.
+		 * Pre v4.14 kernels don't support map names.
+		 */
+		memset(attr.map_name, 0, sizeof(attr.map_name));
+		return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	}
+	return ret;
 }
 
 int bpf_create_map_node(enum bpf_map_type map_type, const char *name,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 052/352] net/mlx5: EQ, Use the right place to store/read IRQ affinity hint
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 051/352] bpf: libbpf: retry map creation without the name Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 053/352] modpost: validate symbol names also in find_elf_symbol Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Saeed Mahameed, Leon Romanovsky,
	Tariq Toukan, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1e86ace4c140fd5a693e266c9b23409358f25381 ]

Currently the cpu affinity hint mask for completion EQs is stored and
read from the wrong place, since reading and storing is done from the
same index, there is no actual issue with that, but internal irq_info
for completion EQs stars at MLX5_EQ_VEC_COMP_BASE offset in irq_info
array, this patch changes the code to use the correct offset to store
and read the IRQ affinity hint.

Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c    | 14 ++++++++------
 include/linux/mlx5/driver.h                       |  2 +-
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index b70cb6fd164c..9577d0657839 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1771,7 +1771,7 @@ static void mlx5e_close_cq(struct mlx5e_cq *cq)
 
 static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix)
 {
-	return cpumask_first(priv->mdev->priv.irq_info[ix].mask);
+	return cpumask_first(priv->mdev->priv.irq_info[ix + MLX5_EQ_VEC_COMP_BASE].mask);
 }
 
 static int mlx5e_open_tx_cqs(struct mlx5e_channel *c,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 28132c7dc05f..d5cea0a36e6a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -640,18 +640,19 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev)
 static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
 {
 	struct mlx5_priv *priv  = &mdev->priv;
-	int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+	int vecidx = MLX5_EQ_VEC_COMP_BASE + i;
+	int irq = pci_irq_vector(mdev->pdev, vecidx);
 
-	if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
+	if (!zalloc_cpumask_var(&priv->irq_info[vecidx].mask, GFP_KERNEL)) {
 		mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
 		return -ENOMEM;
 	}
 
 	cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
-			priv->irq_info[i].mask);
+			priv->irq_info[vecidx].mask);
 
 	if (IS_ENABLED(CONFIG_SMP) &&
-	    irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+	    irq_set_affinity_hint(irq, priv->irq_info[vecidx].mask))
 		mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
 
 	return 0;
@@ -659,11 +660,12 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
 
 static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
 {
+	int vecidx = MLX5_EQ_VEC_COMP_BASE + i;
 	struct mlx5_priv *priv  = &mdev->priv;
-	int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+	int irq = pci_irq_vector(mdev->pdev, vecidx);
 
 	irq_set_affinity_hint(irq, NULL);
-	free_cpumask_var(priv->irq_info[i].mask);
+	free_cpumask_var(priv->irq_info[vecidx].mask);
 }
 
 static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev)
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index aa5963b5d38e..7d4ed995b4ce 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1309,7 +1309,7 @@ enum {
 static inline const struct cpumask *
 mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
 {
-	return dev->priv.irq_info[vector].mask;
+	return dev->priv.irq_info[vector + MLX5_EQ_VEC_COMP_BASE].mask;
 }
 
 #endif /* MLX5_DRIVER_H */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 053/352] modpost: validate symbol names also in find_elf_symbol
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 052/352] net/mlx5: EQ, Use the right place to store/read IRQ affinity hint Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 054/352] perf tools: Add Hygon Dhyana support Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Masahiro Yamada, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5818c683a619c534c113e1f66d24f636defc29bc ]

If an ARM mapping symbol shares an address with a valid symbol,
find_elf_symbol can currently return the mapping symbol instead, as the
symbol is not validated. This can result in confusing warnings:

  WARNING: vmlinux.o(.text+0x18f4028): Section mismatch in reference
  from the function set_reset_devices() to the variable .init.text:$x.0

This change adds a call to is_valid_name to find_elf_symbol, similarly
to how it's already used in find_elf_symbol2.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/mod/modpost.c | 50 ++++++++++++++++++++++---------------------
 1 file changed, 26 insertions(+), 24 deletions(-)

diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 5a5b3780456f..5a77efd39b3f 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1204,6 +1204,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
 	return 1;
 }
 
+static inline int is_arm_mapping_symbol(const char *str)
+{
+	return str[0] == '$' && strchr("axtd", str[1])
+	       && (str[2] == '\0' || str[2] == '.');
+}
+
+/*
+ * If there's no name there, ignore it; likewise, ignore it if it's
+ * one of the magic symbols emitted used by current ARM tools.
+ *
+ * Otherwise if find_symbols_between() returns those symbols, they'll
+ * fail the whitelist tests and cause lots of false alarms ... fixable
+ * only by merging __exit and __init sections into __text, bloating
+ * the kernel (which is especially evil on embedded platforms).
+ */
+static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
+{
+	const char *name = elf->strtab + sym->st_name;
+
+	if (!name || !strlen(name))
+		return 0;
+	return !is_arm_mapping_symbol(name);
+}
+
 /**
  * Find symbol based on relocation record info.
  * In some cases the symbol supplied is a valid symbol so
@@ -1229,6 +1253,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
 			continue;
 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
 			continue;
+		if (!is_valid_name(elf, sym))
+			continue;
 		if (sym->st_value == addr)
 			return sym;
 		/* Find a symbol nearby - addr are maybe negative */
@@ -1247,30 +1273,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
 		return NULL;
 }
 
-static inline int is_arm_mapping_symbol(const char *str)
-{
-	return str[0] == '$' && strchr("axtd", str[1])
-	       && (str[2] == '\0' || str[2] == '.');
-}
-
-/*
- * If there's no name there, ignore it; likewise, ignore it if it's
- * one of the magic symbols emitted used by current ARM tools.
- *
- * Otherwise if find_symbols_between() returns those symbols, they'll
- * fail the whitelist tests and cause lots of false alarms ... fixable
- * only by merging __exit and __init sections into __text, bloating
- * the kernel (which is especially evil on embedded platforms).
- */
-static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
-{
-	const char *name = elf->strtab + sym->st_name;
-
-	if (!name || !strlen(name))
-		return 0;
-	return !is_arm_mapping_symbol(name);
-}
-
 /*
  * Find symbols before or equal addr and after addr - in the section sec.
  * If we find two symbols with equal offset prefer one with a valid name.
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 054/352] perf tools: Add Hygon Dhyana support
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 053/352] modpost: validate symbol names also in find_elf_symbol Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 055/352] scsi: cxgb4i: fix thermal configuration dependencies Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pu Wen, Borislav Petkov,
	Alexander Shishkin, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
	Thomas Gleixner, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4787eff3fa88f62fede6ed7afa06477ae6bf984d ]

The tool perf is useful for the performance analysis on the Hygon Dhyana
platform. But right now there is no Hygon support for it to analyze the
KVM guest os data. So add Hygon Dhyana support to it by checking vendor
string to share the code path of AMD.

Signed-off-by: Pu Wen <puwen@hygon.cn>
Acked-by: Borislav Petkov <bp@suse.de>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1542008451-31735-1-git-send-email-puwen@hygon.cn
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/arch/x86/util/kvm-stat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c
index b32409a0e546..081353d7b095 100644
--- a/tools/perf/arch/x86/util/kvm-stat.c
+++ b/tools/perf/arch/x86/util/kvm-stat.c
@@ -156,7 +156,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid)
 	if (strstr(cpuid, "Intel")) {
 		kvm->exit_reasons = vmx_exit_reasons;
 		kvm->exit_reasons_isa = "VMX";
-	} else if (strstr(cpuid, "AMD")) {
+	} else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) {
 		kvm->exit_reasons = svm_exit_reasons;
 		kvm->exit_reasons_isa = "SVM";
 	} else
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 055/352] scsi: cxgb4i: fix thermal configuration dependencies
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 054/352] perf tools: Add Hygon Dhyana support Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 056/352] soc/tegra: Dont leak device tree node reference Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Martin K. Petersen,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8d0bb86e2cf6c96d88c3de56a2a29329872c454d ]

I fixed a bug by adding a dependency in the network driver, but that fix
caused a related bug in the SCSI driver:

WARNING: unmet direct dependencies detected for CHELSIO_T4
  Depends on [m]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_CHELSIO [=y] && PCI [=y] && (IPV6 [=y] || IPV6 [=y]=n) && (THERMAL [=m] || !THERMAL [=m])
  Selected by [y]:
  - SCSI_CXGB4_ISCSI [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && INET [=y] && (IPV6 [=y] || IPV6 [=y]=n)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function `cxgb4_thermal_init':
cxgb4_thermal.c:(.text+0x158): undefined reference to `thermal_zone_device_register'
drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function `cxgb4_thermal_remove':
cxgb4_thermal.c:(.text+0x1d8): undefined reference to `thermal_zone_device_unregister'
/git/arm-soc/Makefile:1042: recipe for target 'vmlinux' failed

The same dependency needs to be propagated here to make it work correctly
with CONFIG_THERMAL=m and SCSI_CXGB4_ISCSI=y. That change by itself causes
another problem with a circular dependency, as we use 'select NETDEVICES'.
This is something we really should not do anyway, as a driver symbol should
never select another major subsystem, so let's turn that into a 'depends
on'. I don't see any downsides of that, as NETDEVICES is only disabled in
rather obscure cases that are not relevant to the users of cxgb4i.

Fixes: e70a57fa59bb ("cxgb4: fix thermal configuration dependencies")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/cxgbi/cxgb4i/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/cxgbi/cxgb4i/Kconfig b/drivers/scsi/cxgbi/cxgb4i/Kconfig
index 594f593c8821..f36b76e8e12c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/Kconfig
+++ b/drivers/scsi/cxgbi/cxgb4i/Kconfig
@@ -1,8 +1,8 @@
 config SCSI_CXGB4_ISCSI
 	tristate "Chelsio T4 iSCSI support"
 	depends on PCI && INET && (IPV6 || IPV6=n)
-	select NETDEVICES
-	select ETHERNET
+	depends on THERMAL || !THERMAL
+	depends on ETHERNET
 	select NET_VENDOR_CHELSIO
 	select CHELSIO_T4
 	select CHELSIO_LIB
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 056/352] soc/tegra: Dont leak device tree node reference
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 055/352] scsi: cxgb4i: fix thermal configuration dependencies Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 057/352] media: rc: ensure close() is called on rc_unregister_device Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Jon Hunter,
	Thierry Reding, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9eb40fa2cd2d1f6829e7b49bb22692f754b9cfe0 ]

of_find_node_by_path() acquires a reference to the node returned by it
and that reference needs to be dropped by its caller. soc_is_tegra()
doesn't do that, so fix it.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
[treding: slightly rewrite to avoid inline comparison]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/tegra/common.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/tegra/common.c b/drivers/soc/tegra/common.c
index cd8f41351add..7bfb154d6fa5 100644
--- a/drivers/soc/tegra/common.c
+++ b/drivers/soc/tegra/common.c
@@ -22,11 +22,15 @@ static const struct of_device_id tegra_machine_match[] = {
 
 bool soc_is_tegra(void)
 {
+	const struct of_device_id *match;
 	struct device_node *root;
 
 	root = of_find_node_by_path("/");
 	if (!root)
 		return false;
 
-	return of_match_node(tegra_machine_match, root) != NULL;
+	match = of_match_node(tegra_machine_match, root);
+	of_node_put(root);
+
+	return match != NULL;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 057/352] media: rc: ensure close() is called on rc_unregister_device
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 056/352] soc/tegra: Dont leak device tree node reference Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 058/352] media: video-i2c: avoid accessing released memory area when removing driver Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Young, Mauro Carvalho Chehab,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8e782fcf78275f505194e767c515202d4fd274bc ]

If userspace has an open file descriptor on the rc input device or lirc
device when rc_unregister_device() is called, then the rc close() is
never called.

This ensures that the receiver is turned off on the nuvoton-cir driver
during shutdown.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/rc-main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 877978dbd409..66a174979b3c 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1952,6 +1952,8 @@ void rc_unregister_device(struct rc_dev *dev)
 	rc_free_rx_device(dev);
 
 	mutex_lock(&dev->lock);
+	if (dev->users && dev->close)
+		dev->close(dev);
 	dev->registered = false;
 	mutex_unlock(&dev->lock);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 058/352] media: video-i2c: avoid accessing released memory area when removing driver
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 057/352] media: rc: ensure close() is called on rc_unregister_device Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 059/352] media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matt Ranostay, Akinobu Mita,
	Sakari Ailus, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c764da98a600a4b068d25c77164f092f159cecec ]

The video device release() callback for video-i2c driver frees the whole
struct video_i2c_data.  If there is no user left for the video device
when video_unregister_device() is called, the release callback is executed.

However, in video_i2c_remove() some fields (v4l2_dev, lock, and queue_lock)
in struct video_i2c_data are still accessed after video_unregister_device()
is called.

This fixes the use after free by moving the code from video_i2c_remove()
to the release() callback.

Fixes: 5cebaac60974 ("media: video-i2c: add video-i2c driver")

Reviewed-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/video-i2c.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c
index 4d49af86c15e..ec0758dca2fc 100644
--- a/drivers/media/i2c/video-i2c.c
+++ b/drivers/media/i2c/video-i2c.c
@@ -510,7 +510,12 @@ static const struct v4l2_ioctl_ops video_i2c_ioctl_ops = {
 
 static void video_i2c_release(struct video_device *vdev)
 {
-	kfree(video_get_drvdata(vdev));
+	struct video_i2c_data *data = video_get_drvdata(vdev);
+
+	v4l2_device_unregister(&data->v4l2_dev);
+	mutex_destroy(&data->lock);
+	mutex_destroy(&data->queue_lock);
+	kfree(data);
 }
 
 static int video_i2c_probe(struct i2c_client *client,
@@ -608,10 +613,6 @@ static int video_i2c_remove(struct i2c_client *client)
 	struct video_i2c_data *data = i2c_get_clientdata(client);
 
 	video_unregister_device(&data->vdev);
-	v4l2_device_unregister(&data->v4l2_dev);
-
-	mutex_destroy(&data->lock);
-	mutex_destroy(&data->queue_lock);
 
 	return 0;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 059/352] media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 058/352] media: video-i2c: avoid accessing released memory area when removing driver Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 060/352] staging: erofs: fix the definition of DBG_BUGON Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8ea0f2ba0fa3f91ea1b8d823a54b042026ada6b3 ]

of_parse_phandle() returns the device node with refcount incremented.
There are two nodes that are used temporary in mtk_vcodec_init_enc_pm(),
but their refcounts are not decremented.

The patch adds one of_node_put() and fixes returning error codes.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
index 3e73e9db781f..7c025045ea90 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
@@ -41,25 +41,27 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 0);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -1;
+		return -ENODEV;
 	}
 	pdev = of_find_device_by_node(node);
+	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -1;
+		return -ENODEV;
 	}
 	pm->larbvenc = &pdev->dev;
 
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -1;
+		return -ENODEV;
 	}
 
 	pdev = of_find_device_by_node(node);
+	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -1;
+		return -ENODEV;
 	}
 
 	pm->larbvenclt = &pdev->dev;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 060/352] staging: erofs: fix the definition of DBG_BUGON
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 059/352] media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 061/352] staging: erofs: fix race when the managed cache is enabled Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Gao Xiang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit eef168789866514e5d4316f030131c9fe65b643f ]

It's better not to positively BUG_ON the kernel, however developers
need a way to locate issues as soon as possible.

DBG_BUGON is introduced and it could only crash when EROFS_FS_DEBUG
(EROFS developping feature) is on. It is helpful for developers
to find and solve bugs quickly by eng builds.

Previously, DBG_BUGON is defined as ((void)0) if EROFS_FS_DEBUG is off,
but some unused variable warnings as follows could occur:

drivers/staging/erofs/unzip_vle.c: In function `init_alway:':
drivers/staging/erofs/unzip_vle.c:61:33: warning: unused variable `work' [-Wunused-variable]
  struct z_erofs_vle_work *const work =
                                 ^~~~

Fix it to #define DBG_BUGON(x) ((void)(x)).

Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/erofs/internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
index 57575c7f5635..048fb034b5aa 100644
--- a/drivers/staging/erofs/internal.h
+++ b/drivers/staging/erofs/internal.h
@@ -39,7 +39,7 @@
 #define debugln(x, ...)         ((void)0)
 
 #define dbg_might_sleep()       ((void)0)
-#define DBG_BUGON(...)          ((void)0)
+#define DBG_BUGON(x)            ((void)(x))
 #endif
 
 enum {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 061/352] staging: erofs: fix race when the managed cache is enabled
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 060/352] staging: erofs: fix the definition of DBG_BUGON Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 062/352] x86/resctrl: Fixup the user-visible strings Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Gao Xiang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 51232df5e4b268936beccde5248f312a316800be ]

When the managed cache is enabled, the last reference count
of a workgroup must be used for its workstation.

Otherwise, it could lead to incorrect (un)freezes in
the reclaim path, and it would be harmful.

A typical race as follows:

Thread 1 (In the reclaim path)  Thread 2
workgroup_freeze(grp, 1)                                refcnt = 1
...
workgroup_unfreeze(grp, 1)                              refcnt = 1
                                workgroup_get(grp)      refcnt = 2 (x)
workgroup_put(grp)                                      refcnt = 1 (x)
                                ...unexpected behaviors

* grp is detached but still used, which violates cache-managed
  freeze constraint.

Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/erofs/internal.h |   1 +
 drivers/staging/erofs/utils.c    | 134 ++++++++++++++++++++++---------
 2 files changed, 96 insertions(+), 39 deletions(-)

diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
index 048fb034b5aa..3ac4599bbe01 100644
--- a/drivers/staging/erofs/internal.h
+++ b/drivers/staging/erofs/internal.h
@@ -250,6 +250,7 @@ repeat:
 }
 
 #define __erofs_workgroup_get(grp)	atomic_inc(&(grp)->refcount)
+#define __erofs_workgroup_put(grp)	atomic_dec(&(grp)->refcount)
 
 extern int erofs_workgroup_put(struct erofs_workgroup *grp);
 
diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c
index ea8a962e5c95..d2e3ace91046 100644
--- a/drivers/staging/erofs/utils.c
+++ b/drivers/staging/erofs/utils.c
@@ -83,12 +83,21 @@ int erofs_register_workgroup(struct super_block *sb,
 
 	grp = xa_tag_pointer(grp, tag);
 
-	err = radix_tree_insert(&sbi->workstn_tree,
-		grp->index, grp);
+	/*
+	 * Bump up reference count before making this workgroup
+	 * visible to other users in order to avoid potential UAF
+	 * without serialized by erofs_workstn_lock.
+	 */
+	__erofs_workgroup_get(grp);
 
-	if (!err) {
-		__erofs_workgroup_get(grp);
-	}
+	err = radix_tree_insert(&sbi->workstn_tree,
+				grp->index, grp);
+	if (unlikely(err))
+		/*
+		 * it's safe to decrease since the workgroup isn't visible
+		 * and refcount >= 2 (cannot be freezed).
+		 */
+		__erofs_workgroup_put(grp);
 
 	erofs_workstn_unlock(sbi);
 	radix_tree_preload_end();
@@ -97,19 +106,94 @@ int erofs_register_workgroup(struct super_block *sb,
 
 extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp);
 
+static void  __erofs_workgroup_free(struct erofs_workgroup *grp)
+{
+	atomic_long_dec(&erofs_global_shrink_cnt);
+	erofs_workgroup_free_rcu(grp);
+}
+
 int erofs_workgroup_put(struct erofs_workgroup *grp)
 {
 	int count = atomic_dec_return(&grp->refcount);
 
 	if (count == 1)
 		atomic_long_inc(&erofs_global_shrink_cnt);
-	else if (!count) {
-		atomic_long_dec(&erofs_global_shrink_cnt);
-		erofs_workgroup_free_rcu(grp);
-	}
+	else if (!count)
+		__erofs_workgroup_free(grp);
 	return count;
 }
 
+#ifdef EROFS_FS_HAS_MANAGED_CACHE
+/* for cache-managed case, customized reclaim paths exist */
+static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp)
+{
+	erofs_workgroup_unfreeze(grp, 0);
+	__erofs_workgroup_free(grp);
+}
+
+bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
+				    struct erofs_workgroup *grp,
+				    bool cleanup)
+{
+	/*
+	 * for managed cache enabled, the refcount of workgroups
+	 * themselves could be < 0 (freezed). So there is no guarantee
+	 * that all refcount > 0 if managed cache is enabled.
+	 */
+	if (!erofs_workgroup_try_to_freeze(grp, 1))
+		return false;
+
+	/*
+	 * note that all cached pages should be unlinked
+	 * before delete it from the radix tree.
+	 * Otherwise some cached pages of an orphan old workgroup
+	 * could be still linked after the new one is available.
+	 */
+	if (erofs_try_to_free_all_cached_pages(sbi, grp)) {
+		erofs_workgroup_unfreeze(grp, 1);
+		return false;
+	}
+
+	/*
+	 * it is impossible to fail after the workgroup is freezed,
+	 * however in order to avoid some race conditions, add a
+	 * DBG_BUGON to observe this in advance.
+	 */
+	DBG_BUGON(xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree,
+						     grp->index)) != grp);
+
+	/*
+	 * if managed cache is enable, the last refcount
+	 * should indicate the related workstation.
+	 */
+	erofs_workgroup_unfreeze_final(grp);
+	return true;
+}
+
+#else
+/* for nocache case, no customized reclaim path at all */
+bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
+				    struct erofs_workgroup *grp,
+				    bool cleanup)
+{
+	int cnt = atomic_read(&grp->refcount);
+
+	DBG_BUGON(cnt <= 0);
+	DBG_BUGON(cleanup && cnt != 1);
+
+	if (cnt > 1)
+		return false;
+
+	DBG_BUGON(xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree,
+						     grp->index)) != grp);
+
+	/* (rarely) could be grabbed again when freeing */
+	erofs_workgroup_put(grp);
+	return true;
+}
+
+#endif
+
 unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi,
 				       unsigned long nr_shrink,
 				       bool cleanup)
@@ -126,42 +210,14 @@ repeat:
 		batch, first_index, PAGEVEC_SIZE);
 
 	for (i = 0; i < found; ++i) {
-		int cnt;
 		struct erofs_workgroup *grp = xa_untag_pointer(batch[i]);
 
 		first_index = grp->index + 1;
 
-		cnt = atomic_read(&grp->refcount);
-		BUG_ON(cnt <= 0);
-
-		if (cleanup)
-			BUG_ON(cnt != 1);
-
-#ifndef EROFS_FS_HAS_MANAGED_CACHE
-		else if (cnt > 1)
-#else
-		if (!erofs_workgroup_try_to_freeze(grp, 1))
-#endif
+		/* try to shrink each valid workgroup */
+		if (!erofs_try_to_release_workgroup(sbi, grp, cleanup))
 			continue;
 
-		if (xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree,
-			grp->index)) != grp) {
-#ifdef EROFS_FS_HAS_MANAGED_CACHE
-skip:
-			erofs_workgroup_unfreeze(grp, 1);
-#endif
-			continue;
-		}
-
-#ifdef EROFS_FS_HAS_MANAGED_CACHE
-		if (erofs_try_to_free_all_cached_pages(sbi, grp))
-			goto skip;
-
-		erofs_workgroup_unfreeze(grp, 1);
-#endif
-		/* (rarely) grabbed again when freeing */
-		erofs_workgroup_put(grp);
-
 		++freed;
 		if (unlikely(!--nr_shrink))
 			break;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 062/352] x86/resctrl: Fixup the user-visible strings
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 061/352] staging: erofs: fix race when the managed cache is enabled Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 063/352] media: vivid: fill in media_device bus_info Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Babu Moger, Borislav Petkov,
	Andrew Morton, Andy Lutomirski, Arnd Bergmann, Brijesh Singh,
	Chang S. Bae, David Miller, David Woodhouse, Dmitry Safonov,
	Fenghua Yu, H. Peter Anvin, Ingo Molnar, Jann Horn, Joerg Roedel,
	Jonathan Corbet, Josh Poimboeuf, Kate Stewart,
	Kirill A. Shutemov, linux-doc, Mauro Carvalho Chehab,
	Paolo Bonzini, Peter Zijlstra, Philippe Ombredanne, Pu Wen,
	qianyue.zj, Rafael J. Wysocki, Reinette Chatre, Rian Hunter,
	Sherry Hurwitz, Suravee Suthikulpanit, Thomas Gleixner,
	Thomas Lendacky, Tony Luck, Vitaly Kuznetsov, xiaochen.shen,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 723f1a0dd8e26a7523ba068204bee11c95ded38d ]

Fix the messages in rdt_last_cmd_printf() and rdt_last_cmd_puts() to
make them more meaningful and consistent.

 [ bp: s/cpu/CPU/; s/mem\W/memory ]

Signed-off-by: Babu Moger <babu.moger@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: "Chang S. Bae" <chang.seok.bae@intel.com>
Cc: David Miller <davem@davemloft.net>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Dmitry Safonov <dima@arista.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: <linux-doc@vger.kernel.org>
Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Pu Wen <puwen@hygon.cn>
Cc: <qianyue.zj@alibaba-inc.com>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Reinette Chatre <reinette.chatre@intel.com>
Cc: Rian Hunter <rian@alum.mit.edu>
Cc: Sherry Hurwitz <sherry.hurwitz@amd.com>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: <xiaochen.shen@intel.com>
Link: https://lkml.kernel.org/r/20181121202811.4492-11-babu.moger@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 22 ++++++-------
 arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c | 34 +++++++++----------
 arch/x86/kernel/cpu/intel_rdt_rdtgroup.c    | 36 ++++++++++-----------
 3 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
index c8b72aff55e0..6e76ada71211 100644
--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
@@ -71,7 +71,7 @@ int parse_bw(struct rdt_parse_data *data, struct rdt_resource *r,
 	unsigned long bw_val;
 
 	if (d->have_new_ctrl) {
-		rdt_last_cmd_printf("duplicate domain %d\n", d->id);
+		rdt_last_cmd_printf("Duplicate domain %d\n", d->id);
 		return -EINVAL;
 	}
 
@@ -97,12 +97,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r)
 
 	ret = kstrtoul(buf, 16, &val);
 	if (ret) {
-		rdt_last_cmd_printf("non-hex character in mask %s\n", buf);
+		rdt_last_cmd_printf("Non-hex character in the mask %s\n", buf);
 		return false;
 	}
 
 	if (val == 0 || val > r->default_ctrl) {
-		rdt_last_cmd_puts("mask out of range\n");
+		rdt_last_cmd_puts("Mask out of range\n");
 		return false;
 	}
 
@@ -110,12 +110,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r)
 	zero_bit = find_next_zero_bit(&val, cbm_len, first_bit);
 
 	if (find_next_bit(&val, cbm_len, zero_bit) < cbm_len) {
-		rdt_last_cmd_printf("mask %lx has non-consecutive 1-bits\n", val);
+		rdt_last_cmd_printf("The mask %lx has non-consecutive 1-bits\n", val);
 		return false;
 	}
 
 	if ((zero_bit - first_bit) < r->cache.min_cbm_bits) {
-		rdt_last_cmd_printf("Need at least %d bits in mask\n",
+		rdt_last_cmd_printf("Need at least %d bits in the mask\n",
 				    r->cache.min_cbm_bits);
 		return false;
 	}
@@ -135,7 +135,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	u32 cbm_val;
 
 	if (d->have_new_ctrl) {
-		rdt_last_cmd_printf("duplicate domain %d\n", d->id);
+		rdt_last_cmd_printf("Duplicate domain %d\n", d->id);
 		return -EINVAL;
 	}
 
@@ -145,7 +145,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	 */
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP &&
 	    rdtgroup_pseudo_locked_in_hierarchy(d)) {
-		rdt_last_cmd_printf("pseudo-locked region in hierarchy\n");
+		rdt_last_cmd_printf("Pseudo-locked region in hierarchy\n");
 		return -EINVAL;
 	}
 
@@ -164,14 +164,14 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	 * either is exclusive.
 	 */
 	if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, true)) {
-		rdt_last_cmd_printf("overlaps with exclusive group\n");
+		rdt_last_cmd_printf("Overlaps with exclusive group\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, false)) {
 		if (rdtgrp->mode == RDT_MODE_EXCLUSIVE ||
 		    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
-			rdt_last_cmd_printf("overlaps with other group\n");
+			rdt_last_cmd_printf("0verlaps with other group\n");
 			return -EINVAL;
 		}
 	}
@@ -293,7 +293,7 @@ static int rdtgroup_parse_resource(char *resname, char *tok,
 		if (!strcmp(resname, r->name) && rdtgrp->closid < r->num_closid)
 			return parse_line(tok, r, rdtgrp);
 	}
-	rdt_last_cmd_printf("unknown/unsupported resource name '%s'\n", resname);
+	rdt_last_cmd_printf("Unknown or unsupported resource name '%s'\n", resname);
 	return -EINVAL;
 }
 
@@ -326,7 +326,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
 	 */
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("resource group is pseudo-locked\n");
+		rdt_last_cmd_puts("Resource group is pseudo-locked\n");
 		goto out;
 	}
 
diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
index 815b4e92522c..cde746d64600 100644
--- a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
@@ -213,7 +213,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr)
 	for_each_cpu(cpu, &plr->d->cpu_mask) {
 		pm_req = kzalloc(sizeof(*pm_req), GFP_KERNEL);
 		if (!pm_req) {
-			rdt_last_cmd_puts("fail allocating mem for PM QoS\n");
+			rdt_last_cmd_puts("Failure to allocate memory for PM QoS\n");
 			ret = -ENOMEM;
 			goto out_err;
 		}
@@ -222,7 +222,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr)
 					     DEV_PM_QOS_RESUME_LATENCY,
 					     30);
 		if (ret < 0) {
-			rdt_last_cmd_printf("fail to add latency req cpu%d\n",
+			rdt_last_cmd_printf("Failed to add latency req CPU%d\n",
 					    cpu);
 			kfree(pm_req);
 			ret = -1;
@@ -289,7 +289,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr)
 	plr->cpu = cpumask_first(&plr->d->cpu_mask);
 
 	if (!cpu_online(plr->cpu)) {
-		rdt_last_cmd_printf("cpu %u associated with cache not online\n",
+		rdt_last_cmd_printf("CPU %u associated with cache not online\n",
 				    plr->cpu);
 		ret = -ENODEV;
 		goto out_region;
@@ -307,7 +307,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr)
 	}
 
 	ret = -1;
-	rdt_last_cmd_puts("unable to determine cache line size\n");
+	rdt_last_cmd_puts("Unable to determine cache line size\n");
 out_region:
 	pseudo_lock_region_clear(plr);
 	return ret;
@@ -361,14 +361,14 @@ static int pseudo_lock_region_alloc(struct pseudo_lock_region *plr)
 	 * KMALLOC_MAX_SIZE.
 	 */
 	if (plr->size > KMALLOC_MAX_SIZE) {
-		rdt_last_cmd_puts("requested region exceeds maximum size\n");
+		rdt_last_cmd_puts("Requested region exceeds maximum size\n");
 		ret = -E2BIG;
 		goto out_region;
 	}
 
 	plr->kmem = kzalloc(plr->size, GFP_KERNEL);
 	if (!plr->kmem) {
-		rdt_last_cmd_puts("unable to allocate memory\n");
+		rdt_last_cmd_puts("Unable to allocate memory\n");
 		ret = -ENOMEM;
 		goto out_region;
 	}
@@ -665,7 +665,7 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	 * default closid associated with it.
 	 */
 	if (rdtgrp == &rdtgroup_default) {
-		rdt_last_cmd_puts("cannot pseudo-lock default group\n");
+		rdt_last_cmd_puts("Cannot pseudo-lock default group\n");
 		return -EINVAL;
 	}
 
@@ -707,17 +707,17 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	 */
 	prefetch_disable_bits = get_prefetch_disable_bits();
 	if (prefetch_disable_bits == 0) {
-		rdt_last_cmd_puts("pseudo-locking not supported\n");
+		rdt_last_cmd_puts("Pseudo-locking not supported\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_monitor_in_progress(rdtgrp)) {
-		rdt_last_cmd_puts("monitoring in progress\n");
+		rdt_last_cmd_puts("Monitoring in progress\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_tasks_assigned(rdtgrp)) {
-		rdt_last_cmd_puts("tasks assigned to resource group\n");
+		rdt_last_cmd_puts("Tasks assigned to resource group\n");
 		return -EINVAL;
 	}
 
@@ -727,13 +727,13 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	}
 
 	if (rdtgroup_locksetup_user_restrict(rdtgrp)) {
-		rdt_last_cmd_puts("unable to modify resctrl permissions\n");
+		rdt_last_cmd_puts("Unable to modify resctrl permissions\n");
 		return -EIO;
 	}
 
 	ret = pseudo_lock_init(rdtgrp);
 	if (ret) {
-		rdt_last_cmd_puts("unable to init pseudo-lock region\n");
+		rdt_last_cmd_puts("Unable to init pseudo-lock region\n");
 		goto out_release;
 	}
 
@@ -770,7 +770,7 @@ int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp)
 	if (rdt_mon_capable) {
 		ret = alloc_rmid();
 		if (ret < 0) {
-			rdt_last_cmd_puts("out of RMIDs\n");
+			rdt_last_cmd_puts("Out of RMIDs\n");
 			return ret;
 		}
 		rdtgrp->mon.rmid = ret;
@@ -1304,7 +1304,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 					"pseudo_lock/%u", plr->cpu);
 	if (IS_ERR(thread)) {
 		ret = PTR_ERR(thread);
-		rdt_last_cmd_printf("locking thread returned error %d\n", ret);
+		rdt_last_cmd_printf("Locking thread returned error %d\n", ret);
 		goto out_cstates;
 	}
 
@@ -1322,13 +1322,13 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 		 * the cleared, but not freed, plr struct resulting in an
 		 * empty pseudo-locking loop.
 		 */
-		rdt_last_cmd_puts("locking thread interrupted\n");
+		rdt_last_cmd_puts("Locking thread interrupted\n");
 		goto out_cstates;
 	}
 
 	ret = pseudo_lock_minor_get(&new_minor);
 	if (ret < 0) {
-		rdt_last_cmd_puts("unable to obtain a new minor number\n");
+		rdt_last_cmd_puts("Unable to obtain a new minor number\n");
 		goto out_cstates;
 	}
 
@@ -1360,7 +1360,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 
 	if (IS_ERR(dev)) {
 		ret = PTR_ERR(dev);
-		rdt_last_cmd_printf("failed to create character device: %d\n",
+		rdt_last_cmd_printf("Failed to create character device: %d\n",
 				    ret);
 		goto out_debugfs;
 	}
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 951c61367688..17b63a4748bf 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -345,7 +345,7 @@ static int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask,
 	/* Check whether cpus belong to parent ctrl group */
 	cpumask_andnot(tmpmask, newmask, &prgrp->cpu_mask);
 	if (cpumask_weight(tmpmask)) {
-		rdt_last_cmd_puts("can only add CPUs to mongroup that belong to parent\n");
+		rdt_last_cmd_puts("Can only add CPUs to mongroup that belong to parent\n");
 		return -EINVAL;
 	}
 
@@ -470,14 +470,14 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 	rdt_last_cmd_clear();
 	if (!rdtgrp) {
 		ret = -ENOENT;
-		rdt_last_cmd_puts("directory was removed\n");
+		rdt_last_cmd_puts("Directory was removed\n");
 		goto unlock;
 	}
 
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
 	    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto unlock;
 	}
 
@@ -487,7 +487,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 		ret = cpumask_parse(buf, newmask);
 
 	if (ret) {
-		rdt_last_cmd_puts("bad cpu list/mask\n");
+		rdt_last_cmd_puts("Bad CPU list/mask\n");
 		goto unlock;
 	}
 
@@ -495,7 +495,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 	cpumask_andnot(tmpmask, newmask, cpu_online_mask);
 	if (cpumask_weight(tmpmask)) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("can only assign online cpus\n");
+		rdt_last_cmd_puts("Can only assign online CPUs\n");
 		goto unlock;
 	}
 
@@ -574,7 +574,7 @@ static int __rdtgroup_move_task(struct task_struct *tsk,
 		 */
 		atomic_dec(&rdtgrp->waitcount);
 		kfree(callback);
-		rdt_last_cmd_puts("task exited\n");
+		rdt_last_cmd_puts("Task exited\n");
 	} else {
 		/*
 		 * For ctrl_mon groups move both closid and rmid.
@@ -692,7 +692,7 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of,
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
 	    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto unlock;
 	}
 
@@ -1158,14 +1158,14 @@ static bool rdtgroup_mode_test_exclusive(struct rdtgroup *rdtgrp)
 		list_for_each_entry(d, &r->domains, list) {
 			if (rdtgroup_cbm_overlaps(r, d, d->ctrl_val[closid],
 						  rdtgrp->closid, false)) {
-				rdt_last_cmd_puts("schemata overlaps\n");
+				rdt_last_cmd_puts("Schemata overlaps\n");
 				return false;
 			}
 		}
 	}
 
 	if (!has_cache) {
-		rdt_last_cmd_puts("cannot be exclusive without CAT/CDP\n");
+		rdt_last_cmd_puts("Cannot be exclusive without CAT/CDP\n");
 		return false;
 	}
 
@@ -1206,7 +1206,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of,
 		goto out;
 
 	if (mode == RDT_MODE_PSEUDO_LOCKED) {
-		rdt_last_cmd_printf("cannot change pseudo-locked group\n");
+		rdt_last_cmd_printf("Cannot change pseudo-locked group\n");
 		ret = -EINVAL;
 		goto out;
 	}
@@ -1235,7 +1235,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of,
 			goto out;
 		rdtgrp->mode = RDT_MODE_PSEUDO_LOCKSETUP;
 	} else {
-		rdt_last_cmd_printf("unknown/unsupported mode\n");
+		rdt_last_cmd_printf("Unknown orunsupported mode\n");
 		ret = -EINVAL;
 	}
 
@@ -2540,7 +2540,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
 			tmp_cbm = d->new_ctrl;
 			if (bitmap_weight(&tmp_cbm, r->cache.cbm_len) <
 			    r->cache.min_cbm_bits) {
-				rdt_last_cmd_printf("no space on %s:%d\n",
+				rdt_last_cmd_printf("No space on %s:%d\n",
 						    r->name, d->id);
 				return -ENOSPC;
 			}
@@ -2557,7 +2557,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
 			continue;
 		ret = update_domains(r, rdtgrp->closid);
 		if (ret < 0) {
-			rdt_last_cmd_puts("failed to initialize allocations\n");
+			rdt_last_cmd_puts("Failed to initialize allocations\n");
 			return ret;
 		}
 		rdtgrp->mode = RDT_MODE_SHAREABLE;
@@ -2580,7 +2580,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	rdt_last_cmd_clear();
 	if (!prdtgrp) {
 		ret = -ENODEV;
-		rdt_last_cmd_puts("directory was removed\n");
+		rdt_last_cmd_puts("Directory was removed\n");
 		goto out_unlock;
 	}
 
@@ -2588,7 +2588,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	    (prdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
 	     prdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto out_unlock;
 	}
 
@@ -2596,7 +2596,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	rdtgrp = kzalloc(sizeof(*rdtgrp), GFP_KERNEL);
 	if (!rdtgrp) {
 		ret = -ENOSPC;
-		rdt_last_cmd_puts("kernel out of memory\n");
+		rdt_last_cmd_puts("Kernel out of memory\n");
 		goto out_unlock;
 	}
 	*r = rdtgrp;
@@ -2637,7 +2637,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	if (rdt_mon_capable) {
 		ret = alloc_rmid();
 		if (ret < 0) {
-			rdt_last_cmd_puts("out of RMIDs\n");
+			rdt_last_cmd_puts("Out of RMIDs\n");
 			goto out_destroy;
 		}
 		rdtgrp->mon.rmid = ret;
@@ -2725,7 +2725,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
 	kn = rdtgrp->kn;
 	ret = closid_alloc();
 	if (ret < 0) {
-		rdt_last_cmd_puts("out of CLOSIDs\n");
+		rdt_last_cmd_puts("Out of CLOSIDs\n");
 		goto out_common_fail;
 	}
 	closid = ret;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 063/352] media: vivid: fill in media_device bus_info
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 062/352] x86/resctrl: Fixup the user-visible strings Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 064/352] RDMA/core: Sync unregistration with netlink commands Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e10b40f3304360d3a2d07d690ff12197f828f2c8 ]

If you create multiple vivid instances, each with their own media
device, then there was no way to tell them apart.

Fill in the bus_info so each instance has a unique bus_info string.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vivid/vivid-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 626e2b24a403..ec1b1a8ea775 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -669,6 +669,8 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 
 	/* Initialize media device */
 	strlcpy(dev->mdev.model, VIVID_MODULE_NAME, sizeof(dev->mdev.model));
+	snprintf(dev->mdev.bus_info, sizeof(dev->mdev.bus_info),
+		 "platform:%s-%03d", VIVID_MODULE_NAME, inst);
 	dev->mdev.dev = &pdev->dev;
 	media_device_init(&dev->mdev);
 	dev->mdev.ops = &vivid_media_ops;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 064/352] RDMA/core: Sync unregistration with netlink commands
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 063/352] media: vivid: fill in media_device bus_info Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 065/352] drm: rcar-du: Fix external clock error checks Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Parav Pandit, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 01b671170d7f82b959dad6d5dbb44d7a915e647d ]

When the rdma device is getting removed, get resource info can race with
device removal, as below:

      CPU-0                                  CPU-1
    --------                               --------
    rdma_nl_rcv_msg()
       nldev_res_get_cq_dumpit()
          mutex_lock(device_lock);
          get device reference
          mutex_unlock(device_lock);        [..]
                                            ib_unregister_device()
                                            /* Valid reference to
                                             * device->dev exists.
                                             */
                                             ib_dealloc_device()

          [..]
          provider->fill_res_entry();

Even though device object is not freed, fill_res_entry() can get called on
device which doesn't have a driver anymore. Kernel core device reference
count is not sufficient, as this only keeps the structure valid, and
doesn't guarantee the driver is still loaded.

Similar race can occur with device renaming and device removal, where
device_rename() tries to rename a unregistered device. While this is fine
for devices of a class which are not net namespace aware, but it is
incorrect for net namespace aware class coming in subsequent series.  If a
class is net namespace aware, then the below [1] call trace is observed in
above situation.

Therefore, to avoid the race, keep a reference count and let device
unregistration wait until all netlink users drop the reference.

[1] Call trace:
kernfs: ns required in 'infiniband' for 'mlx5_0'
WARNING: CPU: 18 PID: 44270 at fs/kernfs/dir.c:842 kernfs_find_ns+0x104/0x120
libahci i2c_core mlxfw libata dca [last unloaded: devlink]
RIP: 0010:kernfs_find_ns+0x104/0x120
Call Trace:
kernfs_find_and_get_ns+0x2e/0x50
sysfs_rename_link_ns+0x40/0xb0
device_rename+0xb2/0xf0
ib_device_rename+0xb3/0x100 [ib_core]
nldev_set_doit+0x165/0x190 [ib_core]
rdma_nl_rcv_msg+0x249/0x250 [ib_core]
? netlink_deliver_tap+0x8f/0x3e0
rdma_nl_rcv+0xd6/0x120 [ib_core]
netlink_unicast+0x17c/0x230
netlink_sendmsg+0x2f0/0x3e0
sock_sendmsg+0x30/0x40
__sys_sendto+0xdc/0x160

Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/core_priv.h |  1 +
 drivers/infiniband/core/device.c    | 26 ++++++++++++++++++++++----
 drivers/infiniband/core/nldev.c     | 20 ++++++++++----------
 include/rdma/ib_verbs.h             |  8 +++++++-
 4 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index bb9007a0cca7..d97d39a7537c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -296,6 +296,7 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
+void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 87eb4f2cdd7d..0027b0d79b09 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -145,7 +145,8 @@ static struct ib_device *__ib_device_get_by_index(u32 index)
 }
 
 /*
- * Caller is responsible to return refrerence count by calling put_device()
+ * Caller must perform ib_device_put() to return the device reference count
+ * when ib_device_get_by_index() returns valid device pointer.
  */
 struct ib_device *ib_device_get_by_index(u32 index)
 {
@@ -153,13 +154,21 @@ struct ib_device *ib_device_get_by_index(u32 index)
 
 	down_read(&lists_rwsem);
 	device = __ib_device_get_by_index(index);
-	if (device)
-		get_device(&device->dev);
-
+	if (device) {
+		/* Do not return a device if unregistration has started. */
+		if (!refcount_inc_not_zero(&device->refcount))
+			device = NULL;
+	}
 	up_read(&lists_rwsem);
 	return device;
 }
 
+void ib_device_put(struct ib_device *device)
+{
+	if (refcount_dec_and_test(&device->refcount))
+		complete(&device->unreg_completion);
+}
+
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
 	struct ib_device *device;
@@ -293,6 +302,8 @@ struct ib_device *ib_alloc_device(size_t size)
 	rwlock_init(&device->client_data_lock);
 	INIT_LIST_HEAD(&device->client_data_list);
 	INIT_LIST_HEAD(&device->port_list);
+	refcount_set(&device->refcount, 1);
+	init_completion(&device->unreg_completion);
 
 	return device;
 }
@@ -641,6 +652,13 @@ void ib_unregister_device(struct ib_device *device)
 	struct ib_client_data *context, *tmp;
 	unsigned long flags;
 
+	/*
+	 * Wait for all netlink command callers to finish working on the
+	 * device.
+	 */
+	ib_device_put(device);
+	wait_for_completion(&device->unreg_completion);
+
 	mutex_lock(&device_mutex);
 
 	down_write(&lists_rwsem);
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index ff6468e7fe79..77a0f1e1576f 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -632,13 +632,13 @@ static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	nlmsg_end(msg, nlh);
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }
 
@@ -668,7 +668,7 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		err = ib_device_rename(device, name);
 	}
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }
 
@@ -752,14 +752,14 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto err_free;
 
 	nlmsg_end(msg, nlh);
-	put_device(&device->dev);
+	ib_device_put(device);
 
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }
 
@@ -816,7 +816,7 @@ static int nldev_port_get_dumpit(struct sk_buff *skb,
 	}
 
 out:
-	put_device(&device->dev);
+	ib_device_put(device);
 	cb->args[0] = idx;
 	return skb->len;
 }
@@ -855,13 +855,13 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto err_free;
 
 	nlmsg_end(msg, nlh);
-	put_device(&device->dev);
+	ib_device_put(device);
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return ret;
 }
 
@@ -1054,7 +1054,7 @@ next:		idx++;
 	if (!filled)
 		goto err;
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return skb->len;
 
 res_err:
@@ -1065,7 +1065,7 @@ err:
 	nlmsg_cancel(skb, nlh);
 
 err_index:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return ret;
 }
 
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 9c0c2132a2d6..64626b32107b 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -56,7 +56,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/netdevice.h>
-
+#include <linux/refcount.h>
 #include <linux/if_link.h>
 #include <linux/atomic.h>
 #include <linux/mmu_notifier.h>
@@ -2605,6 +2605,12 @@ struct ib_device {
 
 	const struct uverbs_object_tree_def *const *driver_specs;
 	enum rdma_driver_id		driver_id;
+	/*
+	 * Provides synchronization between device unregistration and netlink
+	 * commands on a device. To be used only by core.
+	 */
+	refcount_t refcount;
+	struct completion unreg_completion;
 };
 
 struct ib_client {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 065/352] drm: rcar-du: Fix external clock error checks
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 064/352] RDMA/core: Sync unregistration with netlink commands Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuninori Morimoto, Laurent Pinchart,
	Kieran Bingham, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 63a298f22a6183b5b7536a203596c6570dfcfe8e ]

The rcar-du driver supports probe deferral for external clocks, but
implements it badly by checking the wrong pointer due to a bad copy and
paste. Fix it.

While at it, reject invalid clocks outright for DU channels that have a
display PLL, as the external clock is mandatory in that case. This
avoids a WARN_ON() at runtime.

Fixes: 1b30dbde8596 ("drm: rcar-du: Add support for external pixel clock")
Reported-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
index 17741843cf51..40a9afe818a8 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
@@ -226,9 +226,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
 		 * system clock, and have no internal clock divider.
 		 */
 
-		if (WARN_ON(!rcrtc->extclock))
-			return;
-
 		/*
 		 * The H3 ES1.x exhibits dot clock duty cycle stability issues.
 		 * We can work around them by configuring the DPLL to twice the
@@ -1113,9 +1110,16 @@ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int swindex,
 	clk = devm_clk_get(rcdu->dev, clk_name);
 	if (!IS_ERR(clk)) {
 		rcrtc->extclock = clk;
-	} else if (PTR_ERR(rcrtc->clock) == -EPROBE_DEFER) {
-		dev_info(rcdu->dev, "can't get external clock %u\n", hwindex);
+	} else if (PTR_ERR(clk) == -EPROBE_DEFER) {
 		return -EPROBE_DEFER;
+	} else if (rcdu->info->dpll_mask & BIT(hwindex)) {
+		/*
+		 * DU channels that have a display PLL can't use the internal
+		 * system clock and thus require an external clock.
+		 */
+		ret = PTR_ERR(clk);
+		dev_err(rcdu->dev, "can't get dclkin.%u: %d\n", hwindex, ret);
+		return ret;
 	}
 
 	init_waitqueue_head(&rcrtc->flip_wait);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 065/352] drm: rcar-du: Fix external clock error checks Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:39   ` Mark Brown
  2019-02-11 14:14 ` [PATCH 4.20 067/352] clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Mark Brown, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ca0412a05756cd0b94751ca4d54fe6522f00b1f4 ]

On the Allwinner A64 SoCs, the audio codec has a built-in headphone
amplifier. This amplifier has a power supply separate from the rest of
the analog audio circuitry, labeled cpvdd.

This patch adds a DAPM widget for this supply, and ties it to the
headphone amp widget.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun50i-codec-analog.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/sunxi/sun50i-codec-analog.c b/sound/soc/sunxi/sun50i-codec-analog.c
index 8f5f999df631..df1fed0aa001 100644
--- a/sound/soc/sunxi/sun50i-codec-analog.c
+++ b/sound/soc/sunxi/sun50i-codec-analog.c
@@ -274,6 +274,7 @@ static const struct snd_soc_dapm_widget sun50i_a64_codec_widgets[] = {
 	 * stream widgets at the card level.
 	 */
 
+	SND_SOC_DAPM_REGULATOR_SUPPLY("hpvcc", 0, 0),
 	SND_SOC_DAPM_MUX("Headphone Source Playback Route",
 			 SND_SOC_NOPM, 0, 0, sun50i_codec_hp_src),
 	SND_SOC_DAPM_OUT_DRV("Headphone Amp", SUN50I_ADDA_HP_CTRL,
@@ -361,6 +362,7 @@ static const struct snd_soc_dapm_route sun50i_a64_codec_routes[] = {
 	{ "Headphone Source Playback Route", "Mixer", "Left Mixer" },
 	{ "Headphone Source Playback Route", "Mixer", "Right Mixer" },
 	{ "Headphone Amp", NULL, "Headphone Source Playback Route" },
+	{ "Headphone Amp", NULL, "hpvcc" },
 	{ "HP", NULL, "Headphone Amp" },
 
 	/* Microphone Routes */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 067/352] clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 068/352] clk: meson: meson8b: fix the width of the cpu_scale_div clock Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
	Neil Armstrong, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a5ac1ead32c9aac285f6436e09b4f6111996e9b8 ]

The cpu_div3 clock (cpu_in divided by 3) generates a signal with a duty
cycle of 33%. The CPU clock however requires a clock signal with a duty
cycle of 50% to run stable.
cpu_div3 was observed to be problematic when cycling through all
available CPU frequencies (with additional patches on top of this one)
while running "stress --cpu 4" in the background. This caused sporadic
hangs where the whole system would fully lock up.

Amlogic's 3.10 kernel code also does not use the cpu_div3 clock either
when changing the CPU clock.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lkml.kernel.org/r/20181115224048.13511-3-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/meson8b.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index 1d39273d7a04..328fcf50d9e8 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -612,20 +612,27 @@ static struct clk_regmap meson8b_cpu_scale_div = {
 	},
 };
 
+static u32 mux_table_cpu_scale_out_sel[] = { 0, 1, 3 };
 static struct clk_regmap meson8b_cpu_scale_out_sel = {
 	.data = &(struct clk_regmap_mux_data){
 		.offset = HHI_SYS_CPU_CLK_CNTL0,
 		.mask = 0x3,
 		.shift = 2,
+		.table = mux_table_cpu_scale_out_sel,
 	},
 	.hw.init = &(struct clk_init_data){
 		.name = "cpu_scale_out_sel",
 		.ops = &clk_regmap_mux_ro_ops,
+		/*
+		 * NOTE: We are skipping the parent with value 0x2 (which is
+		 * "cpu_div3") because it results in a duty cycle of 33% which
+		 * makes the system unstable and can result in a lockup of the
+		 * whole system.
+		 */
 		.parent_names = (const char *[]) { "cpu_in_sel",
 						   "cpu_div2",
-						   "cpu_div3",
 						   "cpu_scale_div" },
-		.num_parents = 4,
+		.num_parents = 3,
 		.flags = CLK_SET_RATE_PARENT,
 	},
 };
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 068/352] clk: meson: meson8b: fix the width of the cpu_scale_div clock
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 067/352] clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 069/352] clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Neil Armstrong,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a8662eadd1032018f31e37deda811790b2326662 ]

According to the public S805 datasheet HHI_SYS_CPU_CLK_CNTL1[29:20] is
the register for the CPU scale_div clock. This matches the code in
Amlogic's 3.10 GPL kernel sources:
N = (aml_read_reg32(P_HHI_SYS_CPU_CLK_CNTL1) >> 20) & 0x3FF;

This means that the divider register is 10 bit wide instead of 9 bits.
So far this is not a problem since all u-boot versions I have seen are
not using the cpu_scale_div clock at all (instead they are configuring
the CPU clock to run off cpu_in_sel directly).

The fixes tag points to the latest rework of the CPU clocks. However,
even before the rework it was wrong. Commit 7a29a869434e8b ("clk: meson:
Add support for Meson clock controller") defines MESON_N_WIDTH as 9 (in
drivers/clk/meson/clk-cpu.c). But since the old clk-cpu implementation
this only carries the fixes tag for the CPU clock rewordk.

Fixes: 251b6fd38bcb9c ("clk: meson: rework meson8b cpu clock")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lkml.kernel.org/r/20180927085921.24627-3-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/meson8b.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index 328fcf50d9e8..9160a3b2e668 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -599,7 +599,7 @@ static struct clk_regmap meson8b_cpu_scale_div = {
 	.data = &(struct clk_regmap_div_data){
 		.offset =  HHI_SYS_CPU_CLK_CNTL1,
 		.shift = 20,
-		.width = 9,
+		.width = 10,
 		.table = cpu_scale_table,
 		.flags = CLK_DIVIDER_ALLOW_ZERO,
 	},
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 069/352] clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 068/352] clk: meson: meson8b: fix the width of the cpu_scale_div clock Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 070/352] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
	Neil Armstrong, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0dad1ec65bc30a549aba38d34a727309bbf41bc8 ]

We don't want the common clock framework to disable the "cpu_clk" if
it's not used by any device. The cpufreq-dt driver does not enable the
CPU clocks. However, even if it would we would still want the CPU clock
to be enabled at all times because the CPU clock is also required even
if we disable CPU frequency scaling on a specific board.

The reason why we want the CPU clock to be enabled is a clock further up
in the tree:
Since commit 6f888e7bc7bd58 ("clk: meson: clk-pll: add enable bit") the
sys_pll can be disabled. However, since the CPU clock is derived from
sys_pll we don't want sys_pll to get disabled. The common clock
framework takes care of that for us by enabling all parent clocks of our
CPU clock when we mark the CPU clock with CLK_IS_CRITICAL.

Until now this is not a problem yet because all clocks in the CPU
clock's tree (including sys_pll) are read-only. However, once we allow
modifications to the clocks in that tree we will need this.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lkml.kernel.org/r/20181115224048.13511-4-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/meson8b.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index 9160a3b2e668..a3a826419c16 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -650,7 +650,8 @@ static struct clk_regmap meson8b_cpu_clk = {
 						  "cpu_scale_out_sel" },
 		.num_parents = 2,
 		.flags = (CLK_SET_RATE_PARENT |
-			  CLK_SET_RATE_NO_REPARENT),
+			  CLK_SET_RATE_NO_REPARENT |
+			  CLK_IS_CRITICAL),
 	},
 };
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 070/352] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 069/352] clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 071/352] dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Richard Cochran,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit aea0a897af9e44c258e8ab9296fad417f1bc063a ]

Fix smatch warning:

drivers/ptp/ptp_clock.c:298 ptp_clock_register() warn:
 passing zero to 'ERR_PTR'

'err' should be set while device_create_with_groups and
pps_register_source fails

Fixes: 85a66e550195 ("ptp: create "pins" together with the rest of attributes")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ptp/ptp_clock.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index 5419a89d300e..9b8aa6718ee7 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -249,8 +249,10 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
 	ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid,
 					     ptp, ptp->pin_attr_groups,
 					     "ptp%d", ptp->index);
-	if (IS_ERR(ptp->dev))
+	if (IS_ERR(ptp->dev)) {
+		err = PTR_ERR(ptp->dev);
 		goto no_device;
+	}
 
 	/* Register a new PPS source. */
 	if (info->pps) {
@@ -261,6 +263,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
 		pps.owner = info->owner;
 		ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS);
 		if (!ptp->pps_source) {
+			err = -EINVAL;
 			pr_err("failed to register pps source\n");
 			goto no_pps;
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 071/352] dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 070/352] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:14 ` [PATCH 4.20 072/352] powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nick Desaulniers, Nathan Chancellor,
	Vinod Koul, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit aeaebcc17cdf37065d2693865eeb1ff1c7dc5bf3 ]

Clang warns:

drivers/dma/xilinx/zynqmp_dma.c:166:4: warning: attribute 'aligned' is
ignored, place it after "struct" to apply attribute to type declaration
[-Wignored-attributes]
}; __aligned(64)
   ^
./include/linux/compiler_types.h:200:38: note: expanded from macro
'__aligned'
                                               ^
1 warning generated.

As Nick pointed out in the previous version of this patch, the author
likely intended for this struct to be 8-byte (64-bit) aligned, not
64-byte, which is the default. Remove the hanging __aligned attribute.

Fixes: b0cc417c1637 ("dmaengine: Add Xilinx zynqmp dma engine driver support")
Reported-by: Nick Desaulniers <ndesaulniers@google.com>
Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/xilinx/zynqmp_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index c74a88b65039..73de6a6179fc 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -163,7 +163,7 @@ struct zynqmp_dma_desc_ll {
 	u32 ctrl;
 	u64 nxtdscraddr;
 	u64 rsvd;
-}; __aligned(64)
+};
 
 /**
  * struct zynqmp_dma_desc_sw - Per Transaction structure
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 072/352] powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 071/352] dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll Greg Kroah-Hartman
@ 2019-02-11 14:14 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 073/352] iio: adc: meson-saradc: check for devm_kasprintf failure Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Mathieu Malaterre,
	Michael Ellerman, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit beba24ac59133cb36ecd03f9af9ccb11971ee20e ]

When both `CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y` and `CONFIG_UBSAN=y`
are set, link step typically produce numberous warnings about orphan
section:

  + powerpc-linux-gnu-ld -EB -m elf32ppc -Bstatic --orphan-handling=warn --build-id --gc-sections -X -o .tmp_vmlinux1 -T ./arch/powerpc/kernel/vmlinux.lds --who
  le-archive built-in.a --no-whole-archive --start-group lib/lib.a --end-group
  powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_data393' from `init/main.o' being placed in section `.data..Lubsan_data393'.
  powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_data394' from `init/main.o' being placed in section `.data..Lubsan_data394'.
  ...
  powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_type11' from `init/main.o' being placed in section `.data..Lubsan_type11'.
  powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_type12' from `init/main.o' being placed in section `.data..Lubsan_type12'.
  ...

This commit remove those warnings produced at W=1.

Link: https://www.mail-archive.com/linuxppc-dev@lists.ozlabs.org/msg135407.html
Suggested-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Mathieu Malaterre <malat@debian.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/vmlinux.lds.S | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 434581bcd5b4..1148c3c60c3b 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -308,6 +308,10 @@ SECTIONS
 #ifdef CONFIG_PPC32
 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
 		DATA_DATA
+#ifdef CONFIG_UBSAN
+		*(.data..Lubsan_data*)
+		*(.data..Lubsan_type*)
+#endif
 		*(.data.rel*)
 		*(SDATA_MAIN)
 		*(.sdata2)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 073/352] iio: adc: meson-saradc: check for devm_kasprintf failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2019-02-11 14:14 ` [PATCH 4.20 072/352] powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 074/352] iio: adc: meson-saradc: fix internal clock names Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire,
	Martin Blumenstingl, Jonathan Cameron, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit aad172b017617994343e36d8659c69e14cd694fd ]

devm_kasprintf() may return NULL on failure of internal allocation thus
the assignments to  init.name  are not safe if not checked. On error
meson_sar_adc_clk_init() returns negative values so -ENOMEM in the
(unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs")
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/meson_saradc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 028ccd218f82..672a5dee4a9d 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -589,6 +589,9 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 
 	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div",
 				   indio_dev->dev.of_node);
+	if (!init.name)
+		return -ENOMEM;
+
 	init.flags = 0;
 	init.ops = &clk_divider_ops;
 	clk_parents[0] = __clk_get_name(priv->clkin);
@@ -608,6 +611,9 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 
 	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en",
 				   indio_dev->dev.of_node);
+	if (!init.name)
+		return -ENOMEM;
+
 	init.flags = CLK_SET_RATE_PARENT;
 	init.ops = &clk_gate_ops;
 	clk_parents[0] = __clk_get_name(priv->adc_div_clk);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 074/352] iio: adc: meson-saradc: fix internal clock names
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 073/352] iio: adc: meson-saradc: check for devm_kasprintf failure Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 075/352] iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl,
	Jonathan Cameron, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 50314f98b0ac468218e7c9af8c99f215a35436df ]

Before this patch we are registering the internal clocks (for example on
Meson8b, where the SAR ADC IP block implements the divider and gate
clocks) with the following names:
- /soc/cbus@c1100000/adc@8680#adc_div
- /soc/cbus@c1100000/adc@8680#adc_en

This is bad because the common clock framework uses the clock to create
a directory in <debugfs>/clk. With such name, the directory creation
(silently) fails and the debugfs entry ends up being created at the
debugfs root.

With this change, the new clock names are:
- c1108680.adc#adc_div
- c1108680.adc#adc_en

This matches the clock naming scheme used in the PWM, Ethernet and MMC
drivers. It also fixes the problem with debugfs.
The idea is shamelessly taken from commit b96e9eb62841c5 ("pwm: meson:
Fix mux clock names").

Fixes: 3921db46a8c5bc ("iio: Convert to using %pOF instead of full_name")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/meson_saradc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 672a5dee4a9d..ba4b42429a2a 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -587,8 +587,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 	struct clk_init_data init;
 	const char *clk_parents[1];
 
-	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div",
-				   indio_dev->dev.of_node);
+	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_div",
+				   dev_name(indio_dev->dev.parent));
 	if (!init.name)
 		return -ENOMEM;
 
@@ -609,8 +609,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 	if (WARN_ON(IS_ERR(priv->adc_div_clk)))
 		return PTR_ERR(priv->adc_div_clk);
 
-	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en",
-				   indio_dev->dev.of_node);
+	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_en",
+				   dev_name(indio_dev->dev.parent));
 	if (!init.name)
 		return -ENOMEM;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 075/352] iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 074/352] iio: adc: meson-saradc: fix internal clock names Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 076/352] media: adv*/tc358743/ths8200: fill in min width/height/pixelclock Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Jonathan Cameron, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7f6232e69539971cf9eaed07a6c14ab4a2361133 ]

Various 2-in-1's use KIOX010A and KIOX020A as HIDs for 2 KXCJ91008
accelerometers. The KIOX010A HID is for the one in the base and the
KIOX020A for the accelerometer in the keyboard.

Since userspace does not have a way yet to deal with (or ignore) the
accelerometer in the keyboard, this commit just adds the KIOX010A HID
for now so that display rotation will work.

Related: https://github.com/hadess/iio-sensor-proxy/issues/166
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/kxcjk-1013.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index af53a1084ee5..471caa5323e4 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1490,6 +1490,7 @@ static const struct acpi_device_id kx_acpi_match[] = {
 	{"KXCJ1008", KXCJ91008},
 	{"KXCJ9000", KXCJ91008},
 	{"KIOX000A", KXCJ91008},
+	{"KIOX010A", KXCJ91008}, /* KXCJ91008 inside the display of a 2-in-1 */
 	{"KXTJ1009", KXTJ21009},
 	{"SMO8500",  KXCJ91008},
 	{ },
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 076/352] media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 075/352] iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 077/352] ACPI: SPCR: Consider baud rate 0 as preconfigured state Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2912289a518077ddb8214e05336700148e97e235 ]

The v4l2_dv_timings_cap struct is used to do sanity checks when setting and
enumerating DV timings, ensuring that only valid timings as per the HW
capabilities are allowed.

However, many drivers just filled in 0 for the minimum width, height or
pixelclock frequency. This can cause timings with e.g. 0 as width and height
to be accepted, which will in turn lead to a potential division by zero.

Fill in proper values are minimum boundaries. 640x350 was chosen since it is
the smallest resolution in v4l2-dv-timings.h. Same for 13 MHz as the lowest
pixelclock frequency (it's slightly below the minimum of 13.5 MHz in the
v4l2-dv-timings.h header).

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ad9389b.c  | 2 +-
 drivers/media/i2c/adv7511.c  | 2 +-
 drivers/media/i2c/adv7604.c  | 4 ++--
 drivers/media/i2c/adv7842.c  | 4 ++--
 drivers/media/i2c/tc358743.c | 2 +-
 drivers/media/i2c/ths8200.c  | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c
index 5b008b0002c0..aa8b04cfed0f 100644
--- a/drivers/media/i2c/ad9389b.c
+++ b/drivers/media/i2c/ad9389b.c
@@ -578,7 +578,7 @@ static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
index f3899cc84e27..88349b5053cc 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511.c
@@ -130,7 +130,7 @@ static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
+	V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
 		ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 9eb7c70a7712..ff28f5692986 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -766,7 +766,7 @@ static const struct v4l2_dv_timings_cap adv7604_timings_cap_analog = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
@@ -777,7 +777,7 @@ static const struct v4l2_dv_timings_cap adv76xx_timings_cap_digital = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 4721d49dcf0f..5305c3ad80e6 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -663,7 +663,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
@@ -674,7 +674,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 41d470d9ca94..00dc930e049f 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -59,7 +59,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = {
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
 	/* Pixel clock from REF_01 p. 20. Min/max height/width are unknown */
-	V4L2_INIT_BT_TIMINGS(1, 10000, 1, 10000, 0, 165000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 13000000, 165000000,
 			V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 			V4L2_DV_BT_CAP_PROGRESSIVE |
diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c
index 498ad2368cbc..f5ee28058ea2 100644
--- a/drivers/media/i2c/ths8200.c
+++ b/drivers/media/i2c/ths8200.c
@@ -49,7 +49,7 @@ static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1080, 25000000, 148500000,
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
 };
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 077/352] ACPI: SPCR: Consider baud rate 0 as preconfigured state
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 076/352] media: adv*/tc358743/ths8200: fill in min width/height/pixelclock Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 078/352] staging: pi433: fix potential null dereference Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Prarit Bhargava,
	Rafael J. Wysocki, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b413b1abeb21b4a152c0bf8d1379efa30759b6e3 ]

Since SPCR 1.04 [1] the baud rate of 0 means a preconfigured state of UART.
Assume firmware or bootloader configures console correctly.

[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Prarit Bhargava <prarit@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/spcr.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 9d52743080a4..c336784d0bcb 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -148,6 +148,13 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
 	}
 
 	switch (table->baud_rate) {
+	case 0:
+		/*
+		 * SPCR 1.04 defines 0 as a preconfigured state of UART.
+		 * Assume firmware or bootloader configures console correctly.
+		 */
+		baud_rate = 0;
+		break;
 	case 3:
 		baud_rate = 9600;
 		break;
@@ -196,6 +203,10 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
 		 * UART so don't attempt to change to the baud rate state
 		 * in the table because driver cannot calculate the dividers
 		 */
+		baud_rate = 0;
+	}
+
+	if (!baud_rate) {
 		snprintf(opts, sizeof(opts), "%s,%s,0x%llx", uart, iotype,
 			 table->serial_port.address);
 	} else {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 078/352] staging: pi433: fix potential null dereference
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 077/352] ACPI: SPCR: Consider baud rate 0 as preconfigured state Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 079/352] f2fs: avoid GC causing encrypted file corrupted Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Straube, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 64c4c4ca6c129a4191e8e1e91b2d5d9b8d08c518 ]

Add a test for successful call to cdev_alloc() to avoid
potential null dereference. Issue reported by smatch.

Signed-off-by: Michael Straube <straube.linux@gmail.com>
Fixes: 874bcba65f9a ("staging: pi433: New driver")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/pi433/pi433_if.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/pi433/pi433_if.c b/drivers/staging/pi433/pi433_if.c
index c85a805a1243..a497ec197872 100644
--- a/drivers/staging/pi433/pi433_if.c
+++ b/drivers/staging/pi433/pi433_if.c
@@ -1255,6 +1255,10 @@ static int pi433_probe(struct spi_device *spi)
 
 	/* create cdev */
 	device->cdev = cdev_alloc();
+	if (!device->cdev) {
+		dev_dbg(device->dev, "allocation of cdev failed");
+		goto cdev_failed;
+	}
 	device->cdev->owner = THIS_MODULE;
 	cdev_init(device->cdev, &pi433_fops);
 	retval = cdev_add(device->cdev, device->devt, 1);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 079/352] f2fs: avoid GC causing encrypted file corrupted
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 078/352] staging: pi433: fix potential null dereference Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 080/352] f2fs: move dir data flush to write checkpoint process Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunlong Song, Chao Yu, Jaegeuk Kim,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9bf1a3f73927492c8be127b642197125e9d52be8 ]

The encrypted file may be corrupted by GC in following case:

Time 1: | segment 1 blkaddr = A |  GC -> | segment 2 blkaddr = B |
Encrypted block 1 is moved from blkaddr A of segment 1 to blkaddr B of
segment 2,

Time 2: | segment 1 blkaddr = B |  GC -> | segment 3 blkaddr = C |

Before page 1 is written back and if segment 2 become a victim, then
page 1 is moved from blkaddr B of segment 2 to blkaddr Cof segment 3,
during the GC process of Time 2, f2fs should wait for page 1 written back
before reading it, or move_data_block will read a garbage block from
blkaddr B since page is not written back to blkaddr B yet.

Commit 6aa58d8a ("f2fs: readahead encrypted block during GC") introduce
ra_data_block to read encrypted block, but it forgets to add
f2fs_wait_on_page_writeback to avoid racing between GC and flush.

Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/gc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index a07241fb8537..c96e7c6354ef 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -658,6 +658,14 @@ got_it:
 	fio.page = page;
 	fio.new_blkaddr = fio.old_blkaddr = dn.data_blkaddr;
 
+	/*
+	 * don't cache encrypted data into meta inode until previous dirty
+	 * data were writebacked to avoid racing between GC and flush.
+	 */
+	f2fs_wait_on_page_writeback(page, DATA, true);
+
+	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
 	fio.encrypted_page = f2fs_pagecache_get_page(META_MAPPING(sbi),
 					dn.data_blkaddr,
 					FGP_LOCK | FGP_CREAT, GFP_NOFS);
@@ -745,6 +753,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
 	 */
 	f2fs_wait_on_page_writeback(page, DATA, true);
 
+	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
 	err = f2fs_get_node_info(fio.sbi, dn.nid, &ni);
 	if (err)
 		goto put_out;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 080/352] f2fs: move dir data flush to write checkpoint process
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 079/352] f2fs: avoid GC causing encrypted file corrupted Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunlei He, Jaegeuk Kim, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b61ac5b720146c619c7cdf17eff2551b934399e5 ]

This patch move dir data flush to write checkpoint process, by
doing this, it may reduce some time for dir fsync.

pre:
	-f2fs_do_sync_file enter
		-file_write_and_wait_range  <- flush & wait
		-write_checkpoint
			-do_checkpoint	    <- wait all
	-f2fs_do_sync_file exit

now:
	-f2fs_do_sync_file enter
		-write_checkpoint
			-block_operations   <- flush dir & no wait
			-do_checkpoint	    <- wait all
	-f2fs_do_sync_file exit

Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 88b124677189..9eaf07fd8b4c 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -216,6 +216,9 @@ static int f2fs_do_sync_file(struct file *file, loff_t start, loff_t end,
 
 	trace_f2fs_sync_file_enter(inode);
 
+	if (S_ISDIR(inode->i_mode))
+		goto go_write;
+
 	/* if fdatasync is triggered, let's do in-place-update */
 	if (datasync || get_dirty_pages(inode) <= SM_I(sbi)->min_fsync_blocks)
 		set_inode_flag(inode, FI_NEED_IPU);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 080/352] f2fs: move dir data flush to write checkpoint process Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 20:18   ` Stephen Rothwell
  2019-02-11 14:15 ` [PATCH 4.20 082/352] f2fs: fix race between write_checkpoint and write_begin Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Jaegeuk Kim, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f5d5510e7389fa264337fb524346bac9eb93adc8 ]

After merging the f2fs tree, today's linux-next build
 (x86_64_allmodconfig) produced this warning:

 In file included from fs/f2fs/dir.c:11:
 fs/f2fs/f2fs.h: In function '__mark_inode_dirty_flag':
 fs/f2fs/f2fs.h:2388:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
    if (set)
       ^
 fs/f2fs/f2fs.h:2390:2: note: here
   case FI_DATA_EXIST:
   ^~~~

 Exposed by my use of -Wimplicit-fallthrough

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/f2fs.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 1e031971a466..ebad864c031c 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2370,6 +2370,7 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,
 	case FI_NEW_INODE:
 		if (set)
 			return;
+		/* fall through */
 	case FI_DATA_EXIST:
 	case FI_INLINE_DOTS:
 	case FI_PIN_FILE:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 082/352] f2fs: fix race between write_checkpoint and write_begin
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 083/352] f2fs: fix wrong return value of f2fs_acl_create Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sheng Yong, Chao Yu, Jaegeuk Kim,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2866fb16d67992195b0526d19e65acb6640fb87f ]

The following race could lead to inconsistent SIT bitmap:

Task A                          Task B
======                          ======
f2fs_write_checkpoint
  block_operations
    f2fs_lock_all
      down_write(node_change)
      down_write(node_write)
      ... sync ...
      up_write(node_change)
                                f2fs_file_write_iter
                                  set_inode_flag(FI_NO_PREALLOC)
                                  ......
                                  f2fs_write_begin(index=0, has inline data)
                                    prepare_write_begin
                                      __do_map_lock(AIO) => down_read(node_change)
                                      f2fs_convert_inline_page => update SIT
                                      __do_map_lock(AIO) => up_read(node_change)
  f2fs_flush_sit_entries <= inconsistent SIT
  finish write checkpoint
  sudden-power-off

If SPO occurs after checkpoint is finished, SIT bitmap will be set
incorrectly.

Signed-off-by: Sheng Yong <shengyong1@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 17049b030b6c..e90ca6aa3a00 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2326,6 +2326,7 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi,
 	bool locked = false;
 	struct extent_info ei = {0,0,0};
 	int err = 0;
+	int flag;
 
 	/*
 	 * we already allocated all the blocks, so we don't need to get
@@ -2335,9 +2336,15 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi,
 			!is_inode_flag_set(inode, FI_NO_PREALLOC))
 		return 0;
 
+	/* f2fs_lock_op avoids race between write CP and convert_inline_page */
+	if (f2fs_has_inline_data(inode) && pos + len > MAX_INLINE_DATA(inode))
+		flag = F2FS_GET_BLOCK_DEFAULT;
+	else
+		flag = F2FS_GET_BLOCK_PRE_AIO;
+
 	if (f2fs_has_inline_data(inode) ||
 			(pos & PAGE_MASK) >= i_size_read(inode)) {
-		__do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, true);
+		__do_map_lock(sbi, flag, true);
 		locked = true;
 	}
 restart:
@@ -2375,6 +2382,7 @@ restart:
 				f2fs_put_dnode(&dn);
 				__do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO,
 								true);
+				WARN_ON(flag != F2FS_GET_BLOCK_PRE_AIO);
 				locked = true;
 				goto restart;
 			}
@@ -2388,7 +2396,7 @@ out:
 	f2fs_put_dnode(&dn);
 unlock_out:
 	if (locked)
-		__do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, false);
+		__do_map_lock(sbi, flag, false);
 	return err;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 083/352] f2fs: fix wrong return value of f2fs_acl_create
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 082/352] f2fs: fix race between write_checkpoint and write_begin Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 084/352] i2c: sh_mobile: add support for r8a77990 (R-Car E3) Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tiezhu Yang, Chao Yu, Jaegeuk Kim,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f6176473a0c7472380eef72ebeb330cf9485bf0a ]

When call f2fs_acl_create_masq() failed, the caller f2fs_acl_create()
should return -EIO instead of -ENOMEM, this patch makes it consistent
with posix_acl_create() which has been fixed in commit beaf226b863a
("posix_acl: don't ignore return value of posix_acl_create_masq()").

Fixes: 83dfe53c185e ("f2fs: fix reference leaks in f2fs_acl_create")
Signed-off-by: Tiezhu Yang <kernelpatch@126.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/acl.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c
index fa707cdd4120..22f0d17cde43 100644
--- a/fs/f2fs/acl.c
+++ b/fs/f2fs/acl.c
@@ -352,12 +352,14 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode,
 		return PTR_ERR(p);
 
 	clone = f2fs_acl_clone(p, GFP_NOFS);
-	if (!clone)
-		goto no_mem;
+	if (!clone) {
+		ret = -ENOMEM;
+		goto release_acl;
+	}
 
 	ret = f2fs_acl_create_masq(clone, mode);
 	if (ret < 0)
-		goto no_mem_clone;
+		goto release_clone;
 
 	if (ret == 0)
 		posix_acl_release(clone);
@@ -371,11 +373,11 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode,
 
 	return 0;
 
-no_mem_clone:
+release_clone:
 	posix_acl_release(clone);
-no_mem:
+release_acl:
 	posix_acl_release(p);
-	return -ENOMEM;
+	return ret;
 }
 
 int f2fs_init_acl(struct inode *inode, struct inode *dir, struct page *ipage,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 084/352] i2c: sh_mobile: add support for r8a77990 (R-Car E3)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 083/352] f2fs: fix wrong return value of f2fs_acl_create Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 085/352] arm64: io: Ensure calls to delay routines are ordered against prior readX() Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Horman, Geert Uytterhoeven,
	Wolfram Sang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5eb316e636eb298c204f5b368526d4480b63c0ba ]

Add support for the IIC code for the r8a77990 (R-Car E3).

It is not considered compatible with existing fallback bindings
due to the documented absence of automatic transmission registers.

These registers are currently not used by the driver and
thus the provides the same behaviour for "renesas,iic-r8a77990" and
"renesas,rcar-gen3-iic". The point of declaring incompatibility is
to allow for automatic transmission register support to be added to
"renesas,iic-r8a77990" and "renesas,rcar-gen3-iic" in future.

Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-sh_mobile.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index a7a7a9c3bc7c..28db6b59c4ca 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -808,6 +808,7 @@ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
 	{ .compatible = "renesas,rcar-gen2-iic", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7795", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,rcar-gen3-iic", .data = &fast_clock_dt_config },
+	{ .compatible = "renesas,iic-r8a77990", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-sh73a0", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,rmobile-iic", .data = &default_dt_config },
 	{},
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 085/352] arm64: io: Ensure calls to delay routines are ordered against prior readX()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 084/352] i2c: sh_mobile: add support for r8a77990 (R-Car E3) Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 086/352] net: aquantia: return err if set MPI_DEINIT state fails Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Benjamin Herrenschmidt,
	Arnd Bergmann, Will Deacon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6460d32014717686d3b7963595950ba2c6d1bb5e ]

A relatively standard idiom for ensuring that a pair of MMIO writes to a
device arrive at that device with a specified minimum delay between them
is as follows:

	writel_relaxed(42, dev_base + CTL1);
	readl(dev_base + CTL1);
	udelay(10);
	writel_relaxed(42, dev_base + CTL2);

the intention being that the read-back from the device will push the
prior write to CTL1, and the udelay will hold up the write to CTL1 until
at least 10us have elapsed.

Unfortunately, on arm64 where the underlying delay loop is implemented
as a read of the architected counter, the CPU does not guarantee
ordering from the readl() to the delay loop and therefore the delay loop
could in theory be speculated and not provide the desired interval
between the two writes.

Fix this in a similar manner to PowerPC by introducing a dummy control
dependency on the output of readX() which, combined with the ISB in the
read of the architected counter, guarantees that a subsequent delay loop
can not be executed until the readX() has returned its result.

Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/io.h | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 9f8b915af3a7..d42d00d8d5b6 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -104,7 +104,22 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 }
 
 /* IO barriers */
-#define __iormb()		rmb()
+#define __iormb(v)							\
+({									\
+	unsigned long tmp;						\
+									\
+	rmb();								\
+									\
+	/*								\
+	 * Create a dummy control dependency from the IO read to any	\
+	 * later instructions. This ensures that a subsequent call to	\
+	 * udelay() will be ordered due to the ISB in get_cycles().	\
+	 */								\
+	asm volatile("eor	%0, %1, %1\n"				\
+		     "cbnz	%0, ."					\
+		     : "=r" (tmp) : "r" (v) : "memory");		\
+})
+
 #define __iowmb()		wmb()
 
 #define mmiowb()		do { } while (0)
@@ -129,10 +144,10 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
  * following Normal memory access. Writes are ordered relative to any prior
  * Normal memory access.
  */
-#define readb(c)		({ u8  __v = readb_relaxed(c); __iormb(); __v; })
-#define readw(c)		({ u16 __v = readw_relaxed(c); __iormb(); __v; })
-#define readl(c)		({ u32 __v = readl_relaxed(c); __iormb(); __v; })
-#define readq(c)		({ u64 __v = readq_relaxed(c); __iormb(); __v; })
+#define readb(c)		({ u8  __v = readb_relaxed(c); __iormb(__v); __v; })
+#define readw(c)		({ u16 __v = readw_relaxed(c); __iormb(__v); __v; })
+#define readl(c)		({ u32 __v = readl_relaxed(c); __iormb(__v); __v; })
+#define readq(c)		({ u64 __v = readq_relaxed(c); __iormb(__v); __v; })
 
 #define writeb(v,c)		({ __iowmb(); writeb_relaxed((v),(c)); })
 #define writew(v,c)		({ __iowmb(); writew_relaxed((v),(c)); })
@@ -183,9 +198,9 @@ extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size);
 /*
  * io{read,write}{16,32,64}be() macros
  */
-#define ioread16be(p)		({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; })
-#define ioread32be(p)		({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; })
-#define ioread64be(p)		({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(); __v; })
+#define ioread16be(p)		({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(__v); __v; })
+#define ioread32be(p)		({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(__v); __v; })
+#define ioread64be(p)		({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(__v); __v; })
 
 #define iowrite16be(v,p)	({ __iowmb(); __raw_writew((__force __u16)cpu_to_be16(v), p); })
 #define iowrite32be(v,p)	({ __iowmb(); __raw_writel((__force __u32)cpu_to_be32(v), p); })
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 086/352] net: aquantia: return err if set MPI_DEINIT state fails
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 085/352] arm64: io: Ensure calls to delay routines are ordered against prior readX() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 087/352] sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4e3c7c00bba0636b97eb23d582c20b0f5d95ce20 ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c:260:7:
 warning: variable 'err' set but not used [-Wunused-but-set-variable]

'err' should be returned while set MPI_DEINIT state fails
in hw_atl_utils_soft_reset.

Fixes: cce96d1883da ("net: aquantia: Regression on reset with 1.x firmware")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 7def1cb8ab9d..22cbf8dc6fa9 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -263,6 +263,8 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
 		AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
 				HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
 			       10, 1000U);
+		if (err)
+			return err;
 	}
 
 	if (self->rbl_enabled)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 087/352] sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 086/352] net: aquantia: return err if set MPI_DEINIT state fails Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 088/352] soc: bcm: brcmstb: Dont leak device tree node reference Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Young Xiao, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec ]

__vdc_tx_trigger should only loop on EAGAIN a finite
number of times.

See commit adddc32d6fde ("sunvnet: Do not spin in an
infinite loop when vio_ldc_send() returns EAGAIN") for detail.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/sunvdc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index b54fa6726303..6b7b0d8a2acb 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -45,6 +45,8 @@ MODULE_VERSION(DRV_MODULE_VERSION);
 #define WAITING_FOR_GEN_CMD	0x04
 #define WAITING_FOR_ANY		-1
 
+#define	VDC_MAX_RETRIES	10
+
 static struct workqueue_struct *sunvdc_wq;
 
 struct vdc_req_entry {
@@ -431,6 +433,7 @@ static int __vdc_tx_trigger(struct vdc_port *port)
 		.end_idx		= dr->prod,
 	};
 	int err, delay;
+	int retries = 0;
 
 	hdr.seq = dr->snd_nxt;
 	delay = 1;
@@ -443,6 +446,8 @@ static int __vdc_tx_trigger(struct vdc_port *port)
 		udelay(delay);
 		if ((delay <<= 1) > 128)
 			delay = 128;
+		if (retries++ > VDC_MAX_RETRIES)
+			break;
 	} while (err == -EAGAIN);
 
 	if (err == -ENOTCONN)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 088/352] soc: bcm: brcmstb: Dont leak device tree node reference
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 087/352] sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 089/352] nfsd4: fix crash on writing v4_end_grace before nfsd startup Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Florian Fainelli, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1861a7f07e02292830a1ca256328d370deefea30 ]

of_find_node_by_path() acquires a reference to the node returned by it
and that reference needs to be dropped by its caller. soc_is_brcmstb()
doesn't do that, so fix it.

[treding: slightly rewrite to avoid inline comparison]

Fixes: d52fad262041 ("soc: add stubs for brcmstb SoC's")
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/bcm/brcmstb/common.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c
index 14185451901d..bf9123f727e8 100644
--- a/drivers/soc/bcm/brcmstb/common.c
+++ b/drivers/soc/bcm/brcmstb/common.c
@@ -31,13 +31,17 @@ static const struct of_device_id brcmstb_machine_match[] = {
 
 bool soc_is_brcmstb(void)
 {
+	const struct of_device_id *match;
 	struct device_node *root;
 
 	root = of_find_node_by_path("/");
 	if (!root)
 		return false;
 
-	return of_match_node(brcmstb_machine_match, root) != NULL;
+	match = of_match_node(brcmstb_machine_match, root);
+	of_node_put(root);
+
+	return match != NULL;
 }
 
 u32 brcmstb_get_family_id(void)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 089/352] nfsd4: fix crash on writing v4_end_grace before nfsd startup
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 088/352] soc: bcm: brcmstb: Dont leak device tree node reference Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 090/352] drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, J. Bruce Fields,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 62a063b8e7d1db684db3f207261a466fa3194e72 ]

Anatoly Trosinenko reports that this:

1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
3) From `kvm-xfstests shell`:

results in NULL dereference in locks_end_grace.

Check that nfsd has been started before trying to end the grace period.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfsctl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 6384c9b94898..b33f9785b756 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1126,6 +1126,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
 		case 'Y':
 		case 'y':
 		case '1':
+			if (nn->nfsd_serv)
+				return -EBUSY;
 			nfsd4_end_grace(nn);
 			break;
 		default:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 090/352] drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 089/352] nfsd4: fix crash on writing v4_end_grace before nfsd startup Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 091/352] perf: arm_spe: handle devm_kasprintf() failure Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Daniel Vetter,
	Sean Paul, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit aa394b0dd68cb00c483e151dcd84713d4d517ed1 ]

drm_atomic_helper_commit_duplicated_state() sets state->acquire_ctx to
the context given in the argument and leaves it in state after it
quits. The lifetime of state and context are not guaranteed to be the
same, so we shouldn't leave that pointer hanging around. This patch
resets the context to NULL to avoid any oopses.

Changes in v2:
- Added to the set

Suggested-by: Daniel Vetter <daniel@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20181129150423.239081-1-sean@poorly.run
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_atomic_helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index b4e292a56046..df86c2ebfc12 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -3212,7 +3212,7 @@ EXPORT_SYMBOL(drm_atomic_helper_suspend);
 int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
 					      struct drm_modeset_acquire_ctx *ctx)
 {
-	int i;
+	int i, ret;
 	struct drm_plane *plane;
 	struct drm_plane_state *new_plane_state;
 	struct drm_connector *connector;
@@ -3231,7 +3231,11 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
 	for_each_new_connector_in_state(state, connector, new_conn_state, i)
 		state->connectors[i].old_state = connector->state;
 
-	return drm_atomic_commit(state);
+	ret = drm_atomic_commit(state);
+
+	state->acquire_ctx = NULL;
+
+	return ret;
 }
 EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 091/352] perf: arm_spe: handle devm_kasprintf() failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 090/352] drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 092/352] arm64: io: Ensure value passed to __iormb() is held in a 64-bit register Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Nicholas Mc Guire,
	Will Deacon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 754a58db6a556e6e5f5e32f3e84e7d67b5bf9c8e ]

devm_kasprintf() may return NULL on failure of internal allocation
thus the assignment to 'name' is not safe if unchecked. If NULL
is passed in for name then perf_pmu_register() would not fail
but rather silently jump to skip_type which is not the intent
here. As perf_pmu_register() may also return -ENOMEM returning
-ENOMEM in the (unlikely) failure case of devm_kasprintf() should
be fine here as well.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[will: reworded error message]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/arm_spe_pmu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 54ec278d2fc4..e1a77b2de78a 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -927,6 +927,11 @@ static int arm_spe_pmu_perf_init(struct arm_spe_pmu *spe_pmu)
 
 	idx = atomic_inc_return(&pmu_idx);
 	name = devm_kasprintf(dev, GFP_KERNEL, "%s_%d", PMUNAME, idx);
+	if (!name) {
+		dev_err(dev, "failed to allocate name for pmu %d\n", idx);
+		return -ENOMEM;
+	}
+
 	return perf_pmu_register(&spe_pmu->pmu, name, -1);
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 092/352] arm64: io: Ensure value passed to __iormb() is held in a 64-bit register
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 091/352] perf: arm_spe: handle devm_kasprintf() failure Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 093/352] Thermal: do not clear passive state during system sleep Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nick Desaulniers, Nathan Chancellor,
	Will Deacon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1b57ec8c75279b873639eb44a215479236f93481 ]

As of commit 6460d3201471 ("arm64: io: Ensure calls to delay routines
are ordered against prior readX()"), MMIO reads smaller than 64 bits
fail to compile under clang because we end up mixing 32-bit and 64-bit
register operands for the same data processing instruction:

./include/asm-generic/io.h:695:9: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths]
        return readb(addr);
               ^
./arch/arm64/include/asm/io.h:147:58: note: expanded from macro 'readb'
                                                                       ^
./include/asm-generic/io.h:695:9: note: use constraint modifier "w"
./arch/arm64/include/asm/io.h:147:50: note: expanded from macro 'readb'
                                                               ^
./arch/arm64/include/asm/io.h:118:24: note: expanded from macro '__iormb'
        asm volatile("eor       %0, %1, %1\n"                           \
                                    ^

Fix the build by casting the macro argument to 'unsigned long' when used
as an input to the inline asm.

Reported-by: Nick Desaulniers <nick.desaulniers@gmail.com>
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/io.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index d42d00d8d5b6..ee723835c1f4 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -117,7 +117,8 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 	 */								\
 	asm volatile("eor	%0, %1, %1\n"				\
 		     "cbnz	%0, ."					\
-		     : "=r" (tmp) : "r" (v) : "memory");		\
+		     : "=r" (tmp) : "r" ((unsigned long)(v))		\
+		     : "memory");					\
 })
 
 #define __iowmb()		wmb()
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 093/352] Thermal: do not clear passive state during system sleep
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 092/352] arm64: io: Ensure value passed to __iormb() is held in a 64-bit register Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 094/352] thermal: Fix locking in cooling device sysfs update cur_state Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kame Wang, Wei Wang, Zhang Rui, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 964f4843a455d2ffb199512b08be8d5f077c4cac ]

commit ff140fea847e ("Thermal: handle thermal zone device properly
during system sleep") added PM hook to call thermal zone reset during
sleep. However resetting thermal zone will also clear the passive state
and thus cancel the polling queue which leads the passive cooling device
state not being cleared properly after sleep.

thermal_pm_notify => thermal_zone_device_reset set passive to 0
thermal_zone_trip_update will skip update passive as `old_target ==
instance->target'.
monitor_thermal_zone => thermal_zone_device_set_polling will cancel
tz->poll_queue, so the cooling device state will not be changed
afterwards.

Reported-by: Kame Wang <kamewang@google.com>
Signed-off-by: Wei Wang <wvw@google.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal_core.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index d6ebc1cf6aa9..3a014cd8daf0 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -453,16 +453,20 @@ static void update_temperature(struct thermal_zone_device *tz)
 			tz->last_temperature, tz->temperature);
 }
 
-static void thermal_zone_device_reset(struct thermal_zone_device *tz)
+static void thermal_zone_device_init(struct thermal_zone_device *tz)
 {
 	struct thermal_instance *pos;
-
 	tz->temperature = THERMAL_TEMP_INVALID;
-	tz->passive = 0;
 	list_for_each_entry(pos, &tz->thermal_instances, tz_node)
 		pos->initialized = false;
 }
 
+static void thermal_zone_device_reset(struct thermal_zone_device *tz)
+{
+	tz->passive = 0;
+	thermal_zone_device_init(tz);
+}
+
 void thermal_zone_device_update(struct thermal_zone_device *tz,
 				enum thermal_notify_event event)
 {
@@ -1504,7 +1508,7 @@ static int thermal_pm_notify(struct notifier_block *nb,
 	case PM_POST_SUSPEND:
 		atomic_set(&in_suspend, 0);
 		list_for_each_entry(tz, &thermal_tz_list, node) {
-			thermal_zone_device_reset(tz);
+			thermal_zone_device_init(tz);
 			thermal_zone_device_update(tz,
 						   THERMAL_EVENT_UNSPECIFIED);
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 094/352] thermal: Fix locking in cooling device sysfs update cur_state
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 093/352] Thermal: do not clear passive state during system sleep Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 095/352] firmware/efi: Add NULL pointer checks in efivars API functions Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thara Gopinath, Zhang Rui, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 68000a0d983f539c95ebe5dccd4f29535c7ac0af ]

Sysfs interface to update cooling device cur_state does not
currently holding cooling device lock sometimes leading to
stale values in cur_state if getting updated simultanelously
from user space and thermal framework. Adding the proper locking
code fixes this issue.

Signed-off-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal_sysfs.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
index 2241ceae7d7f..aa99edb4dff7 100644
--- a/drivers/thermal/thermal_sysfs.c
+++ b/drivers/thermal/thermal_sysfs.c
@@ -712,11 +712,14 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
 	if ((long)state < 0)
 		return -EINVAL;
 
+	mutex_lock(&cdev->lock);
+
 	result = cdev->ops->set_cur_state(cdev, state);
-	if (result)
-		return result;
-	thermal_cooling_device_stats_update(cdev, state);
-	return count;
+	if (!result)
+		thermal_cooling_device_stats_update(cdev, state);
+
+	mutex_unlock(&cdev->lock);
+	return result ? result : count;
 }
 
 static struct device_attribute
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 095/352] firmware/efi: Add NULL pointer checks in efivars API functions
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 094/352] thermal: Fix locking in cooling device sysfs update cur_state Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 096/352] s390/zcrypt: improve special ap message cmd handling Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Hunter, Arend van Spriel,
	Ard Biesheuvel, Andy Lutomirski, Bhupesh Sharma, Borislav Petkov,
	Dave Hansen, Eric Snowberg, Hans de Goede, Joe Perches,
	Julien Thierry, Linus Torvalds, Marc Zyngier, Matt Fleming,
	Nathan Chancellor, Peter Zijlstra, Sai Praneeth Prakhya,
	Sedat Dilek, Thomas Gleixner, YiFei Zhu, linux-efi, Ingo Molnar,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ab2180a15ce54739fed381efb4cb12e78dfb1561 ]

Since commit:

   ce2e6db554fa ("brcmfmac: Add support for getting nvram contents from EFI variables")

we have a device driver accessing the efivars API. Several functions in
the efivars API assume __efivars is set, i.e., that they will be accessed
only after efivars_register() has been called. However, the following NULL
pointer access was reported calling efivar_entry_size() from the brcmfmac
device driver:

  Unable to handle kernel NULL pointer dereference at virtual address 00000008
  pgd = 60bfa5f1
  [00000008] *pgd=00000000
  Internal error: Oops: 5 [#1] SMP ARM
  ...
  Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
  Workqueue: events request_firmware_work_func
  PC is at efivar_entry_size+0x28/0x90
  LR is at brcmf_fw_complete_request+0x3f8/0x8d4 [brcmfmac]
  pc : [<c0c40718>]    lr : [<bf2a3ef4>]    psr: a00d0113
  sp : ede7fe28  ip : ee983410  fp : c1787f30
  r10: 00000000  r9 : 00000000  r8 : bf2b2258
  r7 : ee983000  r6 : c1604c48  r5 : ede7fe88  r4 : edf337c0
  r3 : 00000000  r2 : 00000000  r1 : ede7fe88  r0 : c17712c8
  Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
  Control: 10c5387d  Table: ad16804a  DAC: 00000051

Disassembly showed that the local static variable __efivars is NULL,
which is not entirely unexpected given that it is a non-EFI platform.

So add a NULL pointer check to efivar_entry_size(), and to related
functions while at it. In efivars_register() a couple of sanity checks
are added as well.

Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Bhupesh Sharma <bhsharma@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Eric Snowberg <eric.snowberg@oracle.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Julien Thierry <julien.thierry@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Sedat Dilek <sedat.dilek@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: YiFei Zhu <zhuyifei1999@gmail.com>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/20181129171230.18699-9-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/vars.c | 99 +++++++++++++++++++++++++++++--------
 1 file changed, 78 insertions(+), 21 deletions(-)

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 9336ffdf6e2c..fceaafd67ec6 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -318,7 +318,12 @@ EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
 static efi_status_t
 check_var_size(u32 attributes, unsigned long size)
 {
-	const struct efivar_operations *fops = __efivars->ops;
+	const struct efivar_operations *fops;
+
+	if (!__efivars)
+		return EFI_UNSUPPORTED;
+
+	fops = __efivars->ops;
 
 	if (!fops->query_variable_store)
 		return EFI_UNSUPPORTED;
@@ -329,7 +334,12 @@ check_var_size(u32 attributes, unsigned long size)
 static efi_status_t
 check_var_size_nonblocking(u32 attributes, unsigned long size)
 {
-	const struct efivar_operations *fops = __efivars->ops;
+	const struct efivar_operations *fops;
+
+	if (!__efivars)
+		return EFI_UNSUPPORTED;
+
+	fops = __efivars->ops;
 
 	if (!fops->query_variable_store)
 		return EFI_UNSUPPORTED;
@@ -429,13 +439,18 @@ static void dup_variable_bug(efi_char16_t *str16, efi_guid_t *vendor_guid,
 int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 		void *data, bool duplicates, struct list_head *head)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	unsigned long variable_name_size = 1024;
 	efi_char16_t *variable_name;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
 	int err = 0;
 
+	if (!__efivars)
+		return -EFAULT;
+
+	ops = __efivars->ops;
+
 	variable_name = kzalloc(variable_name_size, GFP_KERNEL);
 	if (!variable_name) {
 		printk(KERN_ERR "efivars: Memory allocation failed.\n");
@@ -583,12 +598,14 @@ static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
  */
 int __efivar_entry_delete(struct efivar_entry *entry)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
-	status = ops->set_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   0, 0, NULL);
+	if (!__efivars)
+		return -EINVAL;
+
+	status = __efivars->ops->set_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      0, 0, NULL);
 
 	return efi_status_to_err(status);
 }
@@ -607,12 +624,17 @@ EXPORT_SYMBOL_GPL(__efivar_entry_delete);
  */
 int efivar_entry_delete(struct efivar_entry *entry)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
 
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	status = ops->set_variable(entry->var.VariableName,
 				   &entry->var.VendorGuid,
 				   0, 0, NULL);
@@ -650,13 +672,19 @@ EXPORT_SYMBOL_GPL(efivar_entry_delete);
 int efivar_entry_set(struct efivar_entry *entry, u32 attributes,
 		     unsigned long size, void *data, struct list_head *head)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 	efi_char16_t *name = entry->var.VariableName;
 	efi_guid_t vendor = entry->var.VendorGuid;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
+
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	if (head && efivar_entry_find(name, vendor, head, false)) {
 		up(&efivars_lock);
 		return -EEXIST;
@@ -687,12 +715,17 @@ static int
 efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 			     u32 attributes, unsigned long size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	if (down_trylock(&efivars_lock))
 		return -EBUSY;
 
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+
 	status = check_var_size_nonblocking(attributes,
 					    size + ucs2_strsize(name, 1024));
 	if (status != EFI_SUCCESS) {
@@ -700,6 +733,7 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 		return -ENOSPC;
 	}
 
+	ops = __efivars->ops;
 	status = ops->set_variable_nonblocking(name, &vendor, attributes,
 					       size, data);
 
@@ -727,9 +761,13 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
 			  bool block, unsigned long size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
+	if (!__efivars)
+		return -EINVAL;
+
+	ops = __efivars->ops;
 	if (!ops->query_variable_store)
 		return -ENOSYS;
 
@@ -829,13 +867,18 @@ EXPORT_SYMBOL_GPL(efivar_entry_find);
  */
 int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	*size = 0;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	status = ops->get_variable(entry->var.VariableName,
 				   &entry->var.VendorGuid, NULL, size, NULL);
 	up(&efivars_lock);
@@ -861,12 +904,14 @@ EXPORT_SYMBOL_GPL(efivar_entry_size);
 int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
 		       unsigned long *size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
-	status = ops->get_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   attributes, size, data);
+	if (!__efivars)
+		return -EINVAL;
+
+	status = __efivars->ops->get_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      attributes, size, data);
 
 	return efi_status_to_err(status);
 }
@@ -882,14 +927,19 @@ EXPORT_SYMBOL_GPL(__efivar_entry_get);
 int efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
 		     unsigned long *size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
-	status = ops->get_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   attributes, size, data);
+
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+
+	status = __efivars->ops->get_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      attributes, size, data);
 	up(&efivars_lock);
 
 	return efi_status_to_err(status);
@@ -921,7 +971,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_get);
 int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 			      unsigned long *size, void *data, bool *set)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_char16_t *name = entry->var.VariableName;
 	efi_guid_t *vendor = &entry->var.VendorGuid;
 	efi_status_t status;
@@ -940,6 +990,11 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
 
+	if (!__efivars) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Ensure that the available space hasn't shrunk below the safe level
 	 */
@@ -956,6 +1011,8 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 		}
 	}
 
+	ops = __efivars->ops;
+
 	status = ops->set_variable(name, vendor, attributes, *size, data);
 	if (status != EFI_SUCCESS) {
 		err = efi_status_to_err(status);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 096/352] s390/zcrypt: improve special ap message cmd handling
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 095/352] firmware/efi: Add NULL pointer checks in efivars API functions Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 097/352] mt76x0: dfs: fix IBI_R11 configuration on non-radar channels Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harald Freudenberger,
	Martin Schwidefsky, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit be534791011100d204602e2e0496e9e6ce8edf63 ]

There exist very few ap messages which need to have the 'special' flag
enabled. This flag tells the firmware layer to do some pre- and maybe
postprocessing. However, it may happen that this special flag is
enabled but the firmware is unable to deal with this kind of message
and thus returns with reply code 0x41. For example older firmware may
not know the newest messages triggered by the zcrypt device driver and
thus react with reject and the named reply code. Unfortunately this
reply code is not known to the zcrypt error routines and thus default
behavior is to switch the ap queue offline.

This patch now makes the ap error routine aware of the reply code and
so userspace is informed about the bad processing result but the queue
is not switched to offline state any more.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/uapi/asm/zcrypt.h | 4 ++--
 drivers/s390/crypto/zcrypt_error.h  | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/s390/include/uapi/asm/zcrypt.h b/arch/s390/include/uapi/asm/zcrypt.h
index 42c81a95e97b..494c34c50716 100644
--- a/arch/s390/include/uapi/asm/zcrypt.h
+++ b/arch/s390/include/uapi/asm/zcrypt.h
@@ -150,8 +150,8 @@ struct ica_xcRB {
  * @cprb_len:		CPRB header length [0x0020]
  * @cprb_ver_id:	CPRB version id.   [0x04]
  * @pad_000:		Alignment pad bytes
- * @flags:		Admin cmd [0x80] or functional cmd [0x00]
- * @func_id:		Function id / subtype [0x5434]
+ * @flags:		Admin bit [0x80], Special bit [0x20]
+ * @func_id:		Function id / subtype [0x5434] "T4"
  * @source_id:		Source id [originator id]
  * @target_id:		Target id [usage/ctrl domain id]
  * @ret_code:		Return code
diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
index 240b27f3f5f6..f34ee41cbed8 100644
--- a/drivers/s390/crypto/zcrypt_error.h
+++ b/drivers/s390/crypto/zcrypt_error.h
@@ -51,6 +51,7 @@ struct error_hdr {
 #define REP82_ERROR_FORMAT_FIELD	    0x29
 #define REP82_ERROR_INVALID_COMMAND	    0x30
 #define REP82_ERROR_MALFORMED_MSG	    0x40
+#define REP82_ERROR_INVALID_SPECIAL_CMD	    0x41
 #define REP82_ERROR_INVALID_DOMAIN_PRECHECK 0x42
 #define REP82_ERROR_RESERVED_FIELDO	    0x50 /* old value	*/
 #define REP82_ERROR_WORD_ALIGNMENT	    0x60
@@ -89,6 +90,7 @@ static inline int convert_error(struct zcrypt_queue *zq,
 	case REP88_ERROR_MESSAGE_MALFORMD:
 	case REP82_ERROR_INVALID_DOMAIN_PRECHECK:
 	case REP82_ERROR_INVALID_DOMAIN_PENDING:
+	case REP82_ERROR_INVALID_SPECIAL_CMD:
 	//   REP88_ERROR_INVALID_KEY		// '82' CEX2A
 	//   REP88_ERROR_OPERAND		// '84' CEX2A
 	//   REP88_ERROR_OPERAND_EVEN_MOD	// '85' CEX2A
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 097/352] mt76x0: dfs: fix IBI_R11 configuration on non-radar channels
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 096/352] s390/zcrypt: improve special ap message cmd handling Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 098/352] arm64: ftrace: dont adjust the LR value Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6bf4a8e902aad7df55d7f2b10b850cfa3f880996 ]

Fix IBI_R11 configuration on non-radar channels for mt76x0e
driver. This patch improve system stability under heavy load.
Moreover use IBI_R11 name and remove magic numbers for
0x212c register

Fixes: 0c3b3abc9251 ("mt76x0: pci: add DFS support")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c
index b56febae8945..764528c9f48a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c
@@ -800,7 +800,7 @@ static void mt76x2_dfs_set_bbp_params(struct mt76x02_dev *dev)
 
 	/* enable detection*/
 	mt76_wr(dev, MT_BBP(DFS, 0), MT_DFS_CH_EN << 16);
-	mt76_wr(dev, 0x212c, 0x0c350001);
+	mt76_wr(dev, MT_BBP(IBI, 11), 0x0c350001);
 }
 
 void mt76x2_dfs_adjust_agc(struct mt76x02_dev *dev)
@@ -843,7 +843,11 @@ void mt76x2_dfs_init_params(struct mt76x02_dev *dev)
 		mt76_wr(dev, MT_BBP(DFS, 0), 0);
 		/* clear detector status */
 		mt76_wr(dev, MT_BBP(DFS, 1), 0xf);
-		mt76_wr(dev, 0x212c, 0);
+		if (mt76_chip(&dev->mt76) == 0x7610 ||
+		    mt76_chip(&dev->mt76) == 0x7630)
+			mt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081);
+		else
+			mt76_wr(dev, MT_BBP(IBI, 11), 0);
 
 		mt76x02_irq_disable(dev, MT_INT_GPTIMER);
 		mt76_rmw_field(dev, MT_INT_TIMER_EN,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 098/352] arm64: ftrace: dont adjust the LR value
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 097/352] mt76x0: dfs: fix IBI_R11 configuration on non-radar channels Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 099/352] drm/v3d: Fix prime imports of buffers from other drivers Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, AKASHI Takahiro,
	Ard Biesheuvel, Catalin Marinas, Torsten Duwe, Will Deacon,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6e803e2e6e367db9a0d6ecae1bd24bb5752011bd ]

The core ftrace code requires that when it is handed the PC of an
instrumented function, this PC is the address of the instrumented
instruction. This is necessary so that the core ftrace code can identify
the specific instrumentation site. Since the instrumented function will
be a BL, the address of the instrumented function is LR - 4 at entry to
the ftrace code.

This fixup is applied in the mcount_get_pc and mcount_get_pc0 helpers,
which acquire the PC of the instrumented function.

The mcount_get_lr helper is used to acquire the LR of the instrumented
function, whose value does not require this adjustment, and cannot be
adjusted to anything meaningful. No adjustment of this value is made on
other architectures, including arm. However, arm64 adjusts this value by
4.

This patch brings arm64 in line with other architectures and removes the
adjustment of the LR value.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Torsten Duwe <duwe@suse.de>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/entry-ftrace.S | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S
index 1175f5827ae1..295951f3172e 100644
--- a/arch/arm64/kernel/entry-ftrace.S
+++ b/arch/arm64/kernel/entry-ftrace.S
@@ -79,7 +79,6 @@
 	.macro mcount_get_lr reg
 	ldr	\reg, [x29]
 	ldr	\reg, [\reg, #8]
-	mcount_adjust_addr	\reg, \reg
 	.endm
 
 	.macro mcount_get_lr_addr reg
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 099/352] drm/v3d: Fix prime imports of buffers from other drivers.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 098/352] arm64: ftrace: dont adjust the LR value Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 100/352] ARM: dts: mmp2: fix TWSI2 Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Anholt, Daniel Vetter,
	Dave Emett, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 62d1a752874962f072de8a779e960fcd2ab4847b ]

v3d_bo_get_pages() checks this to decide to map the imported buffer
instead of the backing shmem file.  The caller was about to set this
value anyway, and there's no error path in between.  Ideally we
wouldn't even allocate the shmem file for our imports, but that's a
more invasive fix.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
Link: https://patchwork.freedesktop.org/patch/msgid/20181128230927.10951-3-eric@anholt.net
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Dave Emett <david.emett@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/v3d/v3d_bo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/v3d/v3d_bo.c b/drivers/gpu/drm/v3d/v3d_bo.c
index 54d96518a131..a08766d39eab 100644
--- a/drivers/gpu/drm/v3d/v3d_bo.c
+++ b/drivers/gpu/drm/v3d/v3d_bo.c
@@ -293,6 +293,7 @@ v3d_prime_import_sg_table(struct drm_device *dev,
 	bo->resv = attach->dmabuf->resv;
 
 	bo->sgt = sgt;
+	obj->import_attach = attach;
 	v3d_bo_get_pages(bo);
 
 	v3d_mmu_insert_ptes(bo);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 100/352] ARM: dts: mmp2: fix TWSI2
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 099/352] drm/v3d: Fix prime imports of buffers from other drivers Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 101/352] ARM: mmp/mmp2: dt: enable the clock Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lubomir Rintel, Pavel Machek,
	Olof Johansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1147e05ac9fc2ef86a3691e7ca5c2db7602d81dd ]

Marvell keeps their MMP2 datasheet secret, but there are good clues
that TWSI2 is not on 0xd4025000 on that platform, not does it use
IRQ 58. In fact, the IRQ 58 on MMP2 seems to be a signal processor:

   arch/arm/mach-mmp/irqs.h:#define IRQ_MMP2_MSP  58

I'm taking a somewhat educated guess that is probably a copy & paste
error from PXA168 or PXA910 and that the real controller in fact hides
at address 0xd4031000 and uses an interrupt line multiplexed via IRQ 17.

I'm also copying some properties from TWSI1 that were missing or
incorrect.

Tested on a OLPC XO 1.75 machine, where the RTC is on TWSI2.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Tested-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/mmp2.dtsi | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
index 766bbb8495b6..47e5b63339d1 100644
--- a/arch/arm/boot/dts/mmp2.dtsi
+++ b/arch/arm/boot/dts/mmp2.dtsi
@@ -220,12 +220,15 @@
 				status = "disabled";
 			};
 
-			twsi2: i2c@d4025000 {
+			twsi2: i2c@d4031000 {
 				compatible = "mrvl,mmp-twsi";
-				reg = <0xd4025000 0x1000>;
-				interrupts = <58>;
+				reg = <0xd4031000 0x1000>;
+				interrupt-parent = <&intcmux17>;
+				interrupts = <0>;
 				clocks = <&soc_clocks MMP2_CLK_TWSI1>;
 				resets = <&soc_clocks MMP2_CLK_TWSI1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
 				status = "disabled";
 			};
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 101/352] ARM: mmp/mmp2: dt: enable the clock
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 100/352] ARM: dts: mmp2: fix TWSI2 Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 102/352] ARM: dts: aspeed: add missing memory unit-address Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lubomir Rintel, Pavel Machek,
	Olof Johansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f36797ee43802b367e59f0f9a9805304a4ff0c98 ]

The device-tree booted MMP2 needs to enable the timer clock, otherwise
it would stop ticking when the boot finishes.

It can also use the clock rate from the clk, the non-DT boards need to
keep using the hardcoded rates.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-mmp/common.h |  2 +-
 arch/arm/mach-mmp/mmp2.c   |  2 +-
 arch/arm/mach-mmp/pxa168.c |  2 +-
 arch/arm/mach-mmp/time.c   | 32 ++++++++++++++++++++------------
 4 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/arch/arm/mach-mmp/common.h b/arch/arm/mach-mmp/common.h
index 7e284d9c429f..5ac2851ef5d3 100644
--- a/arch/arm/mach-mmp/common.h
+++ b/arch/arm/mach-mmp/common.h
@@ -2,7 +2,7 @@
 #include <linux/reboot.h>
 #define ARRAY_AND_SIZE(x)	(x), ARRAY_SIZE(x)
 
-extern void timer_init(int irq);
+extern void timer_init(int irq, unsigned long rate);
 
 extern void __init mmp_map_io(void);
 extern void mmp_restart(enum reboot_mode, const char *);
diff --git a/arch/arm/mach-mmp/mmp2.c b/arch/arm/mach-mmp/mmp2.c
index afba5460cdaf..fb3e7e32c882 100644
--- a/arch/arm/mach-mmp/mmp2.c
+++ b/arch/arm/mach-mmp/mmp2.c
@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void)
 	clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1);
 	__raw_writel(clk_rst, APBC_TIMERS);
 
-	timer_init(IRQ_MMP2_TIMER1);
+	timer_init(IRQ_MMP2_TIMER1, 6500000);
 }
 
 /* on-chip devices */
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 0f5f16fb8c66..77a358165a56 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void)
 	/* 3.25MHz, bus/functional clock enabled, release reset */
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA168_TIMER1);
+	timer_init(IRQ_PXA168_TIMER1, 6500000);
 }
 
 void pxa168_clear_keypad_wakeup(void)
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index 96ad1db0b04b..eab0fd8a7343 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -22,6 +22,7 @@
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
+#include <linux/clk.h>
 
 #include <linux/io.h>
 #include <linux/irq.h>
@@ -38,12 +39,6 @@
 #include "cputype.h"
 #include "clock.h"
 
-#ifdef CONFIG_CPU_MMP2
-#define MMP_CLOCK_FREQ		6500000
-#else
-#define MMP_CLOCK_FREQ		3250000
-#endif
-
 #define TIMERS_VIRT_BASE	TIMERS1_VIRT_BASE
 
 #define MAX_DELTA		(0xfffffffe)
@@ -189,19 +184,18 @@ static struct irqaction timer_irq = {
 	.dev_id		= &ckevt,
 };
 
-void __init timer_init(int irq)
+void __init timer_init(int irq, unsigned long rate)
 {
 	timer_config();
 
-	sched_clock_register(mmp_read_sched_clock, 32, MMP_CLOCK_FREQ);
+	sched_clock_register(mmp_read_sched_clock, 32, rate);
 
 	ckevt.cpumask = cpumask_of(0);
 
 	setup_irq(irq, &timer_irq);
 
-	clocksource_register_hz(&cksrc, MMP_CLOCK_FREQ);
-	clockevents_config_and_register(&ckevt, MMP_CLOCK_FREQ,
-					MIN_DELTA, MAX_DELTA);
+	clocksource_register_hz(&cksrc, rate);
+	clockevents_config_and_register(&ckevt, rate, MIN_DELTA, MAX_DELTA);
 }
 
 #ifdef CONFIG_OF
@@ -213,7 +207,9 @@ static const struct of_device_id mmp_timer_dt_ids[] = {
 void __init mmp_dt_init_timer(void)
 {
 	struct device_node *np;
+	struct clk *clk;
 	int irq, ret;
+	unsigned long rate;
 
 	np = of_find_matching_node(NULL, mmp_timer_dt_ids);
 	if (!np) {
@@ -221,6 +217,18 @@ void __init mmp_dt_init_timer(void)
 		goto out;
 	}
 
+	clk = of_clk_get(np, 0);
+	if (!IS_ERR(clk)) {
+		ret = clk_prepare_enable(clk);
+		if (ret)
+			goto out;
+		rate = clk_get_rate(clk) / 2;
+	} else if (cpu_is_pj4()) {
+		rate = 6500000;
+	} else {
+		rate = 3250000;
+	}
+
 	irq = irq_of_parse_and_map(np, 0);
 	if (!irq) {
 		ret = -EINVAL;
@@ -231,7 +239,7 @@ void __init mmp_dt_init_timer(void)
 		ret = -ENOMEM;
 		goto out;
 	}
-	timer_init(irq);
+	timer_init(irq, rate);
 	return;
 out:
 	pr_err("Failed to get timer from device tree with error:%d\n", ret);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 102/352] ARM: dts: aspeed: add missing memory unit-address
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 101/352] ARM: mmp/mmp2: dt: enable the clock Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 103/352] spi: fix spi-at91-usart.c build errors when PINCTRL is not set Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joel Stanley, Andrew Jeffery,
	devicetree, linux-arm-kernel, linux-aspeed, Rob Herring,
	Olof Johansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8ef86955fe59f7912a40d57ae4c6d511f0187b4d ]

The base aspeed-g5.dtsi already defines a '/memory@80000000' node, so
'/memory' in the board files create a duplicate node. We're probably
getting lucky that the bootloader fixes up the memory node that the
kernel ends up using. Add the unit-address so it's merged with the base
node.

Found with DT json-schema checks.

Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: devicetree@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-aspeed@lists.ozlabs.org
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts | 2 +-
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts       | 2 +-
 arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts         | 3 +--
 arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts    | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
index df1227613d48..c2ece0b91885 100644
--- a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
@@ -13,7 +13,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory@80000000 {
 		reg = <0x80000000 0x40000000>;
 	};
 
diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
index 7a291de02543..22dade6393d0 100644
--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
@@ -13,7 +13,7 @@
 		bootargs = "earlyprintk";
 	};
 
-	memory {
+	memory@80000000 {
 		reg = <0x80000000 0x20000000>;
 	};
 
diff --git a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
index d598b6391362..024e52a6cd0f 100644
--- a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
@@ -14,7 +14,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory@80000000 {
 		reg = <0x80000000 0x40000000>;
 	};
 
@@ -322,4 +322,3 @@
 &adc {
 	status = "okay";
 };
-
diff --git a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
index 43ed13963d35..33d704541de6 100644
--- a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
@@ -17,7 +17,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory@80000000 {
 		reg = <0x80000000 0x20000000>;
 	};
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 103/352] spi: fix spi-at91-usart.c build errors when PINCTRL is not set
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 102/352] ARM: dts: aspeed: add missing memory unit-address Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 104/352] x86/fpu: Add might_fault() to user_insn() Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Radu Pirea, Mark Brown,
	linux-spi, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c2b142cc3939e932d4fa2210c2a5155df5736590 ]

Fix build errors when CONFIG_PINCTRL is not enabled.
The header file <linux/pinctrl/consumer.h> handles both CONFIG_PINCTRL
enabled and disabled cases.

  CC [M]  drivers/spi/spi-at91-usart.o
../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_suspend':
../drivers/spi/spi-at91-usart.c:409:2: error: implicit declaration of function 'pinctrl_pm_select_sleep_state' [-Werror=implicit-function-declaration]
  pinctrl_pm_select_sleep_state(dev);
../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_resume':
../drivers/spi/spi-at91-usart.c:419:2: error: implicit declaration of function 'pinctrl_pm_select_default_state' [-Werror=implicit-function-declaration]
  pinctrl_pm_select_default_state(dev);

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Radu Pirea <radu.pirea@microchip.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-at91-usart.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-at91-usart.c b/drivers/spi/spi-at91-usart.c
index a924657642fa..08bcbd1f9aa2 100644
--- a/drivers/spi/spi-at91-usart.c
+++ b/drivers/spi/spi-at91-usart.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of_gpio.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 
 #include <linux/spi/spi.h>
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 104/352] x86/fpu: Add might_fault() to user_insn()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 103/352] spi: fix spi-at91-usart.c build errors when PINCTRL is not set Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 105/352] media: i2c: TDA1997x: select CONFIG_HDMI Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Borislav Petkov, Rik van Riel, H. Peter Anvin,
	Jason A. Donenfeld, Andy Lutomirski, Dave Hansen, Ingo Molnar,
	Jann Horn, Paolo Bonzini, Radim Krčmář,
	Thomas Gleixner, kvm ML, x86-ml, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6637401c35b2f327a35d27f44bda05e327f2f017 ]

Every user of user_insn() passes an user memory pointer to this macro.

Add might_fault() to user_insn() so we can spot users which are using
this macro in sections where page faulting is not allowed.

 [ bp: Space it out to make it more visible. ]

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kvm ML <kvm@vger.kernel.org>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/20181128222035.2996-6-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/fpu/internal.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 69dcdf195b61..fa2c93cb42a2 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -106,6 +106,9 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
 #define user_insn(insn, output, input...)				\
 ({									\
 	int err;							\
+									\
+	might_fault();							\
+									\
 	asm volatile(ASM_STAC "\n"					\
 		     "1:" #insn "\n\t"					\
 		     "2: " ASM_CLAC "\n"				\
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 105/352] media: i2c: TDA1997x: select CONFIG_HDMI
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 104/352] x86/fpu: Add might_fault() to user_insn() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 106/352] media: DaVinci-VPBE: fix error handling in vpbe_initialize() Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 79e89e36dc8a47ef965a35b484d737a5227feed1 ]

Without CONFIG_HDMI, we get a link error for this driver:

drivers/media/i2c/tda1997x.o: In function `tda1997x_parse_infoframe':
tda1997x.c:(.text+0x2195): undefined reference to `hdmi_infoframe_unpack'
tda1997x.c:(.text+0x21b6): undefined reference to `hdmi_infoframe_log'
drivers/media/i2c/tda1997x.o: In function `tda1997x_log_infoframe':
tda1997x.c:(.text.unlikely+0x13d3): undefined reference to `hdmi_infoframe_unpack'
tda1997x.c:(.text.unlikely+0x1426): undefined reference to `hdmi_infoframe_log'

All other drivers in this directory that use HDMI select CONFIG_HDMI,
so do the same here:

Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index 704af210e270..f4714bd6fef0 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -61,6 +61,7 @@ config VIDEO_TDA1997X
 	depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
 	depends on SND_SOC
 	select SND_PCM
+	select HDMI
 	---help---
 	  V4L2 subdevice driver for the NXP TDA1997x HDMI receivers.
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 106/352] media: DaVinci-VPBE: fix error handling in vpbe_initialize()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 105/352] media: i2c: TDA1997x: select CONFIG_HDMI Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 107/352] platform/x86: Fix config space access for intel_atomisp2_pm Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit aa35dc3c71950e3fec3e230c06c27c0fbd0067f8 ]

If vpbe_set_default_output() or vpbe_set_default_mode() fails,
vpbe_initialize() returns error code without releasing resources.

The patch adds error handling for that case.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpbe.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
index 18c035ef84cf..df1ae6b5c854 100644
--- a/drivers/media/platform/davinci/vpbe.c
+++ b/drivers/media/platform/davinci/vpbe.c
@@ -740,7 +740,7 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
 	if (ret) {
 		v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default output %s",
 			 def_output);
-		return ret;
+		goto fail_kfree_amp;
 	}
 
 	printk(KERN_NOTICE "Setting default mode to %s\n", def_mode);
@@ -748,12 +748,15 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
 	if (ret) {
 		v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default mode %s",
 			 def_mode);
-		return ret;
+		goto fail_kfree_amp;
 	}
 	vpbe_dev->initialized = 1;
 	/* TBD handling of bootargs for default output and mode */
 	return 0;
 
+fail_kfree_amp:
+	mutex_lock(&vpbe_dev->lock);
+	kfree(vpbe_dev->amp);
 fail_kfree_encoders:
 	kfree(vpbe_dev->encoders);
 fail_dev_unregister:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 107/352] platform/x86: Fix config space access for intel_atomisp2_pm
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 106/352] media: DaVinci-VPBE: fix error handling in vpbe_initialize() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 108/352] smack: fix access permissions for keyring Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Alan Cox,
	Andy Shevchenko, Darren Hart, Ville Syrjälä,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6a31061833a52a79c99221b6251db08cf377470e ]

We lose even config space access when we power gate the ISP
via the PUNIT. That makes lspci & co. produce gibberish.

To fix that let's try to implement actual runtime pm hooks
and inform the pci core that the device always goes to
D3cold. That will cause the pci core to resume the device
before attempting config space access.

This introduces another annoyance though. We get the
following error every time we try to resume the device:
intel_atomisp2_pm 0000:00:03.0: Refused to change power state, currently in D3

The reason being that the pci core tries to put the device
back into D0 via the standard PCI PM mechanism before
calling the driver resume hook. To fix this properly
we'd need to infiltrate the platform pm hooks (could
turn ugly real fast), or use pm domains (which don't
seem to exist on x86), or some extra early resume
hook for the driver (which doesn't exist either).
So maybe we just choose to live with the error?

Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Darren Hart <dvhart@infradead.org>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel_atomisp2_pm.c | 68 +++++++++++++++++-------
 1 file changed, 48 insertions(+), 20 deletions(-)

diff --git a/drivers/platform/x86/intel_atomisp2_pm.c b/drivers/platform/x86/intel_atomisp2_pm.c
index 9371603a0ac9..2a8c7a4cea35 100644
--- a/drivers/platform/x86/intel_atomisp2_pm.c
+++ b/drivers/platform/x86/intel_atomisp2_pm.c
@@ -33,46 +33,45 @@
 #define ISPSSPM0_IUNIT_POWER_ON		0x0
 #define ISPSSPM0_IUNIT_POWER_OFF	0x3
 
-static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id)
+static int isp_set_power(struct pci_dev *dev, bool enable)
 {
 	unsigned long timeout;
-	u32 val;
-
-	pci_write_config_dword(dev, PCI_INTERRUPT_CTRL, 0);
-
-	/*
-	 * MRFLD IUNIT DPHY is located in an always-power-on island
-	 * MRFLD HW design need all CSI ports are disabled before
-	 * powering down the IUNIT.
-	 */
-	pci_read_config_dword(dev, PCI_CSI_CONTROL, &val);
-	val |= PCI_CSI_CONTROL_PORTS_OFF_MASK;
-	pci_write_config_dword(dev, PCI_CSI_CONTROL, val);
+	u32 val = enable ? ISPSSPM0_IUNIT_POWER_ON :
+		ISPSSPM0_IUNIT_POWER_OFF;
 
-	/* Write 0x3 to ISPSSPM0 bit[1:0] to power off the IUNIT */
+	/* Write to ISPSSPM0 bit[1:0] to power on/off the IUNIT */
 	iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0,
-			ISPSSPM0_IUNIT_POWER_OFF, ISPSSPM0_ISPSSC_MASK);
+			val, ISPSSPM0_ISPSSC_MASK);
 
 	/*
 	 * There should be no IUNIT access while power-down is
 	 * in progress HW sighting: 4567865
 	 * Wait up to 50 ms for the IUNIT to shut down.
+	 * And we do the same for power on.
 	 */
 	timeout = jiffies + msecs_to_jiffies(50);
 	while (1) {
-		/* Wait until ISPSSPM0 bit[25:24] shows 0x3 */
-		iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &val);
-		val = (val & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET;
-		if (val == ISPSSPM0_IUNIT_POWER_OFF)
+		u32 tmp;
+
+		/* Wait until ISPSSPM0 bit[25:24] shows the right value */
+		iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &tmp);
+		tmp = (tmp & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET;
+		if (tmp == val)
 			break;
 
 		if (time_after(jiffies, timeout)) {
-			dev_err(&dev->dev, "IUNIT power-off timeout.\n");
+			dev_err(&dev->dev, "IUNIT power-%s timeout.\n",
+				enable ? "on" : "off");
 			return -EBUSY;
 		}
 		usleep_range(1000, 2000);
 	}
 
+	return 0;
+}
+
+static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id)
+{
 	pm_runtime_allow(&dev->dev);
 	pm_runtime_put_sync_suspend(&dev->dev);
 
@@ -87,11 +86,40 @@ static void isp_remove(struct pci_dev *dev)
 
 static int isp_pci_suspend(struct device *dev)
 {
+	struct pci_dev *pdev = to_pci_dev(dev);
+	u32 val;
+
+	pci_write_config_dword(pdev, PCI_INTERRUPT_CTRL, 0);
+
+	/*
+	 * MRFLD IUNIT DPHY is located in an always-power-on island
+	 * MRFLD HW design need all CSI ports are disabled before
+	 * powering down the IUNIT.
+	 */
+	pci_read_config_dword(pdev, PCI_CSI_CONTROL, &val);
+	val |= PCI_CSI_CONTROL_PORTS_OFF_MASK;
+	pci_write_config_dword(pdev, PCI_CSI_CONTROL, val);
+
+	/*
+	 * We lose config space access when punit power gates
+	 * the ISP. Can't use pci_set_power_state() because
+	 * pmcsr won't actually change when we write to it.
+	 */
+	pci_save_state(pdev);
+	pdev->current_state = PCI_D3cold;
+	isp_set_power(pdev, false);
+
 	return 0;
 }
 
 static int isp_pci_resume(struct device *dev)
 {
+	struct pci_dev *pdev = to_pci_dev(dev);
+
+	isp_set_power(pdev, true);
+	pdev->current_state = PCI_D0;
+	pci_restore_state(pdev);
+
 	return 0;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 108/352] smack: fix access permissions for keyring
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 107/352] platform/x86: Fix config space access for intel_atomisp2_pm Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 109/352] xtensa: xtfpga.dtsi: fix dtc warnings about SPI Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zoran Markovic, Casey Schaufler,
	James Morris, Serge E. Hallyn, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5b841bfab695e3b8ae793172a9ff7990f99cc3e2 ]

Function smack_key_permission() only issues smack requests for the
following operations:
 - KEY_NEED_READ (issues MAY_READ)
 - KEY_NEED_WRITE (issues MAY_WRITE)
 - KEY_NEED_LINK (issues MAY_WRITE)
 - KEY_NEED_SETATTR (issues MAY_WRITE)
A blank smack request is issued in all other cases, resulting in
smack access being granted if there is any rule defined between
subject and object, or denied with -EACCES otherwise.

Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW.
Fix the logic in the unlikely case when both MAY_READ and
MAY_WRITE are needed. Validate access permission field for valid
contents.

Signed-off-by: Zoran Markovic <zmarkovic@sierrawireless.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smack_lsm.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 81fb4c1631e9..cd720c06b78c 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4333,6 +4333,12 @@ static int smack_key_permission(key_ref_t key_ref,
 	int request = 0;
 	int rc;
 
+	/*
+	 * Validate requested permissions
+	 */
+	if (perm & ~KEY_NEED_ALL)
+		return -EINVAL;
+
 	keyp = key_ref_to_ptr(key_ref);
 	if (keyp == NULL)
 		return -EINVAL;
@@ -4356,10 +4362,10 @@ static int smack_key_permission(key_ref_t key_ref,
 	ad.a.u.key_struct.key = keyp->serial;
 	ad.a.u.key_struct.key_desc = keyp->description;
 #endif
-	if (perm & KEY_NEED_READ)
-		request = MAY_READ;
+	if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
+		request |= MAY_READ;
 	if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
-		request = MAY_WRITE;
+		request |= MAY_WRITE;
 	rc = smk_access(tkp, keyp->security, request, &ad);
 	rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
 	return rc;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 109/352] xtensa: xtfpga.dtsi: fix dtc warnings about SPI
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 108/352] smack: fix access permissions for keyring Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 110/352] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb() Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f37598be4e3896359e87c824be57ddddc280cc3f ]

Rename SPI controller node in the XTFPGA DTS to spi@...
This fixes the following build warnings:

arch/xtensa/boot/dts/kc705_nommu.dtb: Warning (spi_bus_bridge):
 /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi'
arch/xtensa/boot/dts/kc705_nommu.dtb: Warning (spi_bus_reg):
 Failed prerequisite 'spi_bus_bridge'
arch/xtensa/boot/dts/lx200mx.dtb: Warning (spi_bus_bridge):
 /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi'
arch/xtensa/boot/dts/lx200mx.dtb: Warning (spi_bus_reg):
 Failed prerequisite 'spi_bus_bridge'
arch/xtensa/boot/dts/kc705.dtb: Warning (spi_bus_bridge):
 /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi'
arch/xtensa/boot/dts/kc705.dtb: Warning (spi_bus_reg):
 Failed prerequisite 'spi_bus_bridge'
arch/xtensa/boot/dts/ml605.dtb: Warning (spi_bus_bridge):
 /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi'
arch/xtensa/boot/dts/ml605.dtb: Warning (spi_bus_reg):
 Failed prerequisite 'spi_bus_bridge'
arch/xtensa/boot/dts/lx60.dtb: Warning (spi_bus_bridge):
 /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi'
arch/xtensa/boot/dts/lx60.dtb: Warning (spi_bus_reg):
 Failed prerequisite 'spi_bus_bridge'

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/boot/dts/xtfpga.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi
index 1090528825ec..e46ae07bab05 100644
--- a/arch/xtensa/boot/dts/xtfpga.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga.dtsi
@@ -103,7 +103,7 @@
 			};
 		};
 
-		spi0: spi-master@0d0a0000 {
+		spi0: spi@0d0a0000 {
 			compatible = "cdns,xtfpga-spi";
 			#address-cells = <1>;
 			#size-cells = <0>;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 110/352] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 109/352] xtensa: xtfpga.dtsi: fix dtc warnings about SPI Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 111/352] dmaengine: sprd: Support DMA link-list cyclic callback Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anurag Kumar Vulisha, Thinh Nguyen,
	Tejas Joglekar, Felipe Balbi, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b7a4fbe2300a8965ea760c7e871507b84aea17f6 ]

Availability of TRB's is calculated using dwc3_calc_trbs_left(), which
determines total available TRB's based on the HWO bit set in a TRB.

In the present code, __dwc3_prepare_one_trb() is called with a TRB which
needs to be prepared for transfer. This __dwc3_prepare_one_trb() calls
dwc3_calc_trbs_left() to determine total available TRBs and set IOC bit
if the total available TRBs are zero. Since the present working TRB (which
is passed as an argument to __dwc3_prepare_one_trb() )  doesn't yet have
the HWO bit set before calling dwc3_calc_trbs_left(), there are chances
that dwc3_calc_trbs_left() wrongly calculates this present working TRB
as free(since the HWO bit is not yet set) and returns the total available
TRBs as greater than zero (including the present working TRB). This could
be a problem.

This patch corrects the above mentioned problem in __dwc3_prepare_one_trb()
by increementing the dep->trb_enqueue at the last (after preparing the TRB)
instead of increementing at the start and setting the IOC bit only if the
total available TRBs returned by dwc3_calc_trbs_left() is 1 . Since we are
increementing the dep->trb_enqueue at the last, the present working TRB is
also considered as available by dwc3_calc_trbs_left() and non zero value is
returned . So, according to the modified logic, when the total available
TRBs is equal to 1 that means the total available TRBs in the pool are 0.

Signed-off-by: Anurag Kumar Vulisha <anurag.kumar.vulisha@xilinx.com>
Reviewed-by: Thinh Nguyen <thinhn@synopsys.com>
Tested-by: Tejas Joglekar <tejas.joglekar@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/gadget.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2a4ea9a1b1e3..88f69d823be5 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -921,8 +921,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 	struct usb_gadget	*gadget = &dwc->gadget;
 	enum usb_device_speed	speed = gadget->speed;
 
-	dwc3_ep_inc_enq(dep);
-
 	trb->size = DWC3_TRB_SIZE_LENGTH(length);
 	trb->bpl = lower_32_bits(dma);
 	trb->bph = upper_32_bits(dma);
@@ -1001,7 +999,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 	}
 
 	if ((!no_interrupt && !chain) ||
-			(dwc3_calc_trbs_left(dep) == 0))
+			(dwc3_calc_trbs_left(dep) == 1))
 		trb->ctrl |= DWC3_TRB_CTRL_IOC;
 
 	if (chain)
@@ -1012,6 +1010,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 
 	trb->ctrl |= DWC3_TRB_CTRL_HWO;
 
+	dwc3_ep_inc_enq(dep);
+
 	trace_dwc3_prepare_trb(dep, trb);
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 111/352] dmaengine: sprd: Support DMA link-list cyclic callback
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 110/352] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 112/352] usb: dwc2: Disable power down feature on Samsung SoCs Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Long, Baolin Wang, Vinod Koul,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 97dbd6ea02beb3a7027c158e0a110b5095268d59 ]

The Spreadtrum DMA link-list mode is always one cyclic transfer,
so we should clear the SPRD_DMA_LLIST_END flag for the link-list
configuration. Moreover add cyclic callback support for the cyclic
transfer.

Signed-off-by: Eric Long <eric.long@spreadtrum.com>
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/sprd-dma.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
index 38d4e4f07c66..f7da9ab31b7c 100644
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -450,7 +450,7 @@ static irqreturn_t dma_irq_handle(int irq, void *dev_id)
 	struct sprd_dma_desc *sdesc;
 	enum sprd_dma_req_mode req_type;
 	enum sprd_dma_int_type int_type;
-	bool trans_done = false;
+	bool trans_done = false, cyclic = false;
 	u32 i;
 
 	while (irq_status) {
@@ -465,13 +465,19 @@ static irqreturn_t dma_irq_handle(int irq, void *dev_id)
 
 		sdesc = schan->cur_desc;
 
-		/* Check if the dma request descriptor is done. */
-		trans_done = sprd_dma_check_trans_done(sdesc, int_type,
-						       req_type);
-		if (trans_done == true) {
-			vchan_cookie_complete(&sdesc->vd);
-			schan->cur_desc = NULL;
-			sprd_dma_start(schan);
+		/* cyclic mode schedule callback */
+		cyclic = schan->linklist.phy_addr ? true : false;
+		if (cyclic == true) {
+			vchan_cyclic_callback(&sdesc->vd);
+		} else {
+			/* Check if the dma request descriptor is done. */
+			trans_done = sprd_dma_check_trans_done(sdesc, int_type,
+							       req_type);
+			if (trans_done == true) {
+				vchan_cookie_complete(&sdesc->vd);
+				schan->cur_desc = NULL;
+				sprd_dma_start(schan);
+			}
 		}
 		spin_unlock(&schan->vc.lock);
 	}
@@ -674,9 +680,6 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
 
 	/* link-list configuration */
 	if (schan->linklist.phy_addr) {
-		if (sg_index == sglen - 1)
-			hw->frg_len |= SPRD_DMA_LLIST_END;
-
 		hw->cfg |= SPRD_DMA_LINKLIST_EN;
 
 		/* link-list index */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 112/352] usb: dwc2: Disable power down feature on Samsung SoCs
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 111/352] dmaengine: sprd: Support DMA link-list cyclic callback Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 113/352] usb: hub: delay hub autosuspend if USB3 port is still link training Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Minas Harutyunyan, Marek Szyprowski,
	Felipe Balbi, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 35a6054132286a4ab92b536595093b82e6bdfcbc ]

Power down feature of DWC2 module integrated in Samsung SoCs doesn't work
properly or needs some additional handling in PHY or SoC glue layer, so
disable it for now. Without disabling power down, DWC2 causes random memory
trashes and fails enumeration if there is no USB link to host on driver
probe.

Fixes: 03ea6d6e9e1ff1 ("usb: dwc2: Enable power down")
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/params.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 38c813b1d203..24ff5f21cb25 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -71,6 +71,13 @@ static void dwc2_set_his_params(struct dwc2_hsotg *hsotg)
 	p->power_down = false;
 }
 
+static void dwc2_set_s3c6400_params(struct dwc2_hsotg *hsotg)
+{
+	struct dwc2_core_params *p = &hsotg->params;
+
+	p->power_down = 0;
+}
+
 static void dwc2_set_rk_params(struct dwc2_hsotg *hsotg)
 {
 	struct dwc2_core_params *p = &hsotg->params;
@@ -152,7 +159,8 @@ const struct of_device_id dwc2_of_match_table[] = {
 	{ .compatible = "lantiq,arx100-usb", .data = dwc2_set_ltq_params },
 	{ .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
 	{ .compatible = "snps,dwc2" },
-	{ .compatible = "samsung,s3c6400-hsotg" },
+	{ .compatible = "samsung,s3c6400-hsotg",
+	  .data = dwc2_set_s3c6400_params },
 	{ .compatible = "amlogic,meson8-usb",
 	  .data = dwc2_set_amlogic_params },
 	{ .compatible = "amlogic,meson8b-usb",
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 113/352] usb: hub: delay hub autosuspend if USB3 port is still link training
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 112/352] usb: dwc2: Disable power down feature on Samsung SoCs Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 114/352] timekeeping: Use proper seqcount initializer Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathias Nyman, Alan Stern, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e86108940e541febf35813402ff29fa6f4a9ac0b ]

When initializing a hub we want to give a USB3 port in link training
the same debounce delay time before autosuspening the hub as already
trained, connected enabled ports.

USB3 ports won't reach the enabled state with "current connect status" and
"connect status change" bits set until the USB3 link training finishes.

Catching the port in link training (polling) and adding the debounce delay
prevents unnecessary failed attempts to autosuspend the hub.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/hub.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f76b2e0aba9d..1d1e61e980f3 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1112,6 +1112,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 						   USB_PORT_FEAT_ENABLE);
 		}
 
+		/*
+		 * Add debounce if USB3 link is in polling/link training state.
+		 * Link will automatically transition to Enabled state after
+		 * link training completes.
+		 */
+		if (hub_is_superspeed(hdev) &&
+		    ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+						USB_SS_PORT_LS_POLLING))
+			need_debounce_delay = true;
+
 		/* Clear status-change flags; we'll debounce later */
 		if (portchange & USB_PORT_STAT_C_CONNECTION) {
 			need_debounce_delay = true;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 114/352] timekeeping: Use proper seqcount initializer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 113/352] usb: hub: delay hub autosuspend if USB3 port is still link training Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 115/352] usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Thomas Gleixner,
	peterz, tj, johannes.berg, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ce10a5b3954f2514af726beb78ed8d7350c5e41c ]

tk_core.seq is initialized open coded, but that misses to initialize the
lockdep map when lockdep is enabled. Lockdep splats involving tk_core seq
consequently lack a name and are hard to read.

Use the proper initializer which takes care of the lockdep map
initialization.

[ tglx: Massaged changelog ]

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: peterz@infradead.org
Cc: tj@kernel.org
Cc: johannes.berg@intel.com
Link: https://lkml.kernel.org/r/20181128234325.110011-12-bvanassche@acm.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/timekeeping.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 2d110c948805..6c9493495538 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -50,7 +50,9 @@ enum timekeeping_adv_mode {
 static struct {
 	seqcount_t		seq;
 	struct timekeeper	timekeeper;
-} tk_core ____cacheline_aligned;
+} tk_core ____cacheline_aligned = {
+	.seq = SEQCNT_ZERO(tk_core.seq),
+};
 
 static DEFINE_RAW_SPINLOCK(timekeeper_lock);
 static struct timekeeper shadow_timekeeper;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 115/352] usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 114/352] timekeeping: Use proper seqcount initializer Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 116/352] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunfeng Yun, Felipe Balbi, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a0678e2eed41e81004308693ac84ea95614b0920 ]

Fix the issue: device doesn't accept LGO_U1/U2:
1. set SW_U1/U2_ACCEPT_ENABLE to eanble controller to accept LGO_U1/U2
    by default;
2. enable/disable controller to initiate requests for transition into
    U1/U2 by SW_U1/U2_REQUEST_ENABLE instead of SW_U1/U2_ACCEPT_ENABLE;

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/mtu3/mtu3_core.c       | 4 +++-
 drivers/usb/mtu3/mtu3_gadget_ep0.c | 8 ++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index ae70b9bfd797..860693520132 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -578,8 +578,10 @@ static void mtu3_regs_init(struct mtu3 *mtu)
 	if (mtu->is_u3_ip) {
 		/* disable LGO_U1/U2 by default */
 		mtu3_clrbits(mbase, U3D_LINK_POWER_CONTROL,
-				SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE |
 				SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE);
+		/* enable accept LGO_U1/U2 link command from host */
+		mtu3_setbits(mbase, U3D_LINK_POWER_CONTROL,
+				SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE);
 		/* device responses to u3_exit from host automatically */
 		mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN);
 		/* automatically build U2 link when U3 detect fail */
diff --git a/drivers/usb/mtu3/mtu3_gadget_ep0.c b/drivers/usb/mtu3/mtu3_gadget_ep0.c
index 25216e79cd6e..3c464d8ae023 100644
--- a/drivers/usb/mtu3/mtu3_gadget_ep0.c
+++ b/drivers/usb/mtu3/mtu3_gadget_ep0.c
@@ -336,9 +336,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
 
 		lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
 		if (set)
-			lpc |= SW_U1_ACCEPT_ENABLE;
+			lpc |= SW_U1_REQUEST_ENABLE;
 		else
-			lpc &= ~SW_U1_ACCEPT_ENABLE;
+			lpc &= ~SW_U1_REQUEST_ENABLE;
 		mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
 
 		mtu->u1_enable = !!set;
@@ -351,9 +351,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
 
 		lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
 		if (set)
-			lpc |= SW_U2_ACCEPT_ENABLE;
+			lpc |= SW_U2_REQUEST_ENABLE;
 		else
-			lpc &= ~SW_U2_ACCEPT_ENABLE;
+			lpc &= ~SW_U2_REQUEST_ENABLE;
 		mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
 
 		mtu->u2_enable = !!set;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 116/352] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 115/352] usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 117/352] media: imx274: select REGMAP_I2C Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6e6da2039c82271dd873b9ad2b902a692a7dd554 ]

All the audio interfaces on Allwinner SoCs need to change their module
clocks during operation, to switch between support for 44.1 kHz and 48
kHz family sample rates. The clock rate for the module clocks is
governed by their upstream audio PLL. The module clocks themselves only
have a gate, and sometimes a divider or mux. Thus any rate changes need
to be propagated upstream.

Set the CLK_SET_RATE_PARENT flag for all audio module clocks to achieve
this.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index 13eb5b23c5e7..c40d572a7602 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -366,10 +366,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4,
 static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
 					    "pll-audio-2x", "pll-audio" };
 static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
-			       0x0b0, 16, 2, BIT(31), 0);
+			       0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
 
 static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
-			       0x0b4, 16, 2, BIT(31), 0);
+			       0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
 
 /* TODO: the parent for most of the USB clocks is not known */
 static SUNXI_CCU_GATE(usb_phy0_clk,	"usb-phy0",	"osc24M",
@@ -446,7 +446,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve",
 static SUNXI_CCU_GATE(ac_dig_clk,	"ac-dig",	"pll-audio",
 		      0x140, BIT(31), CLK_SET_RATE_PARENT);
 static SUNXI_CCU_GATE(ac_dig_4x_clk,	"ac-dig-4x",	"pll-audio-4x",
-		      0x140, BIT(30), 0);
+		      0x140, BIT(30), CLK_SET_RATE_PARENT);
 static SUNXI_CCU_GATE(avs_clk,		"avs",		"osc24M",
 		      0x144, BIT(31), 0);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 117/352] media: imx274: select REGMAP_I2C
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 116/352] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 118/352] mac80211: fix deauth TX when we disconnect Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luca Ceresoli, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f9d7225c70dd9d3f406b79e60f8dbd2cd5ae743 ]

The imx274 driver uses regmap and the build will fail without it.

Fixes:

  drivers/media/i2c/imx274.c:142:21: error: variable ‘imx274_regmap_config’ has initializer but incomplete type
   static const struct regmap_config imx274_regmap_config = {
                       ^~~~~~~~~~~~~
  drivers/media/i2c/imx274.c:1869:19: error: implicit declaration of function ‘devm_regmap_init_i2c’ [-Werror=implicit-function-declaration]
    imx274->regmap = devm_regmap_init_i2c(client, &imx274_regmap_config);
                     ^~~~~~~~~~~~~~~~~~~~

and others.

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index f4714bd6fef0..421e2fd2481d 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -611,6 +611,7 @@ config VIDEO_IMX274
 	tristate "Sony IMX274 sensor support"
 	depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
 	depends on MEDIA_CAMERA_SUPPORT
+	select REGMAP_I2C
 	---help---
 	  This is a V4L2 sensor driver for the Sony IMX274
 	  CMOS image sensor.
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 118/352] mac80211: fix deauth TX when we disconnect
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 117/352] media: imx274: select REGMAP_I2C Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 119/352] pinctrl: nuvoton: check for devm_kasprintf() failure Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach, Johannes Berg,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f6c7f03f69f7422bc237bc79599e152d390b74e0 ]

The iTXQs stop/wake queue mechanism involves a whole bunch
of locks and this is probably why the call to
ieee80211_wake_txqs is deferred to a tasklet when called from
__ieee80211_wake_queue.

Another advantage of that is that ieee80211_wake_txqs might
call the wake_tx_queue() callback and then the driver may
call mac80211 which will call it back in the same context.

The bug I saw is that when we send a deauth frame as a
station we do:

flush(drop=1)
tx deauth
flush(drop=0)

While we flush we stop the queues and wake them up
immediately after we finished flushing. The problem here is
that the tasklet that de-facto enables the queue may not have
run until we send the deauth. Then the deauth frame is sent
to the driver (which is surprising by itself), but the driver
won't get anything useful from ieee80211_tx_dequeue because
the queue is stopped (or more precisely because
vif->txqs_stopped[0] is true).
Then the deauth is not sent. Later on, the tasklet will run,
but that'll be too late. We'll already have removed all the
vif etc...

Fix this by calling ieee80211_wake_txqs synchronously if we
are not waking up the queues from the driver (we check the
reason to determine that). This makes the code really
convoluted because we may call ieee80211_wake_txqs from
__ieee80211_wake_queue. The latter assumes that
queue_stop_reason_lock has been taken by the caller and
ieee80211_wake_txqs may release the lock to send the frames.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/util.c | 49 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 35 insertions(+), 14 deletions(-)

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index bec424316ea4..dddfff7cf44f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -299,16 +299,16 @@ out:
 	spin_unlock_bh(&fq->lock);
 }
 
-void ieee80211_wake_txqs(unsigned long data)
+static void
+__releases(&local->queue_stop_reason_lock)
+__acquires(&local->queue_stop_reason_lock)
+_ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags)
 {
-	struct ieee80211_local *local = (struct ieee80211_local *)data;
 	struct ieee80211_sub_if_data *sdata;
 	int n_acs = IEEE80211_NUM_ACS;
-	unsigned long flags;
 	int i;
 
 	rcu_read_lock();
-	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
 	if (local->hw.queues < IEEE80211_NUM_ACS)
 		n_acs = 1;
@@ -317,7 +317,7 @@ void ieee80211_wake_txqs(unsigned long data)
 		if (local->queue_stop_reasons[i])
 			continue;
 
-		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+		spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags);
 		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 			int ac;
 
@@ -329,13 +329,22 @@ void ieee80211_wake_txqs(unsigned long data)
 					__ieee80211_wake_txqs(sdata, ac);
 			}
 		}
-		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+		spin_lock_irqsave(&local->queue_stop_reason_lock, *flags);
 	}
 
-	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 	rcu_read_unlock();
 }
 
+void ieee80211_wake_txqs(unsigned long data)
+{
+	struct ieee80211_local *local = (struct ieee80211_local *)data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+	_ieee80211_wake_txqs(local, &flags);
+	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 {
 	struct ieee80211_sub_if_data *sdata;
@@ -371,7 +380,8 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 
 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 				   enum queue_stop_reason reason,
-				   bool refcounted)
+				   bool refcounted,
+				   unsigned long *flags)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 
@@ -405,8 +415,19 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 	} else
 		tasklet_schedule(&local->tx_pending_tasklet);
 
-	if (local->ops->wake_tx_queue)
-		tasklet_schedule(&local->wake_txqs_tasklet);
+	/*
+	 * Calling _ieee80211_wake_txqs here can be a problem because it may
+	 * release queue_stop_reason_lock which has been taken by
+	 * __ieee80211_wake_queue's caller. It is certainly not very nice to
+	 * release someone's lock, but it is fine because all the callers of
+	 * __ieee80211_wake_queue call it right before releasing the lock.
+	 */
+	if (local->ops->wake_tx_queue) {
+		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
+			tasklet_schedule(&local->wake_txqs_tasklet);
+		else
+			_ieee80211_wake_txqs(local, flags);
+	}
 }
 
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -417,7 +438,7 @@ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
 	unsigned long flags;
 
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-	__ieee80211_wake_queue(hw, queue, reason, refcounted);
+	__ieee80211_wake_queue(hw, queue, reason, refcounted, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
@@ -514,7 +535,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 			       false);
 	__skb_queue_tail(&local->pending[queue], skb);
 	__ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-			       false);
+			       false, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
@@ -547,7 +568,7 @@ void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 	for (i = 0; i < hw->queues; i++)
 		__ieee80211_wake_queue(hw, i,
 			IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-			false);
+			false, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
@@ -605,7 +626,7 @@ void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
 	for_each_set_bit(i, &queues, hw->queues)
-		__ieee80211_wake_queue(hw, i, reason, refcounted);
+		__ieee80211_wake_queue(hw, i, reason, refcounted, &flags);
 
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 119/352] pinctrl: nuvoton: check for devm_kasprintf() failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 118/352] mac80211: fix deauth TX when we disconnect Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 120/352] drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Linus Walleij,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4be1eaf322f07bb9694618fd2763a3a1f0a3dd25 ]

devm_kasprintf() may return NULL on failure of internal allocation thus
the assignment to  .label  is not safe if not checked. On error
npcm7xx_gpio_of() returns negative values so -ENOMEM in the
(unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
index 7ad50d9268aa..3bda620d18bb 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
@@ -1932,6 +1932,9 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
 			pctrl->gpio_bank[id].gc.label =
 				devm_kasprintf(pctrl->dev, GFP_KERNEL, "%pOF",
 					       np);
+			if (pctrl->gpio_bank[id].gc.label == NULL)
+				return -ENOMEM;
+
 			pctrl->gpio_bank[id].gc.dbg_show = npcmgpio_dbg_show;
 			pctrl->gpio_bank[id].direction_input =
 				pctrl->gpio_bank[id].gc.direction_input;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 120/352] drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 119/352] pinctrl: nuvoton: check for devm_kasprintf() failure Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 121/352] tipc: fix node keep alive interval calculation Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Junwei Zhang, Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit de4aaab5cc9770a8c4dc13d9bfb6a83b06bba57e ]

Adjust limits for newer polaris variants.

v2: fix polaris11 kicker (Jerry)

Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/powerplay/smumgr/polaris10_smumgr.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
index a1e0ac9ae248..90c1215c6f5e 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
@@ -1529,8 +1529,21 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
 	efuse = efuse >> 24;
 
 	if (hwmgr->chip_id == CHIP_POLARIS10) {
-		min = 1000;
-		max = 2300;
+		if (hwmgr->is_kicker) {
+			min = 1200;
+			max = 2500;
+		} else {
+			min = 1000;
+			max = 2300;
+		}
+	} else if (hwmgr->chip_id == CHIP_POLARIS11) {
+		if (hwmgr->is_kicker) {
+			min = 900;
+			max = 2100;
+		} else {
+			min = 1100;
+			max = 2100;
+		}
 	} else {
 		min = 1100;
 		max = 2100;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 121/352] tipc: fix node keep alive interval calculation
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 120/352] drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 122/352] arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Maloy, Hoang Le, David S. Miller,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f5d6c3e5a359c0507800e7ac68d565c21de9b5a1 ]

When setting LINK tolerance, node timer interval will be calculated
base on the LINK with lowest tolerance.

But when calculated, the old node timer interval only updated if current
setting value (tolerance/4) less than old ones regardless of number of
links as well as links' lowest tolerance value.

This caused to two cases missing if tolerance changed as following:
Case 1:
1.1/ There is one link (L1) available in the system
1.2/ Set L1's tolerance from 1500ms => lower (i.e 500ms)
1.3/ Then, fallback to default (1500ms) or higher (i.e 2000ms)

Expected:
    node timer interval is 1500/4=375ms after 1.3

Result:
node timer interval will not being updated after changing tolerance at 1.3
since its value 1500/4=375ms is not less than 500/4=125ms at 1.2.

Case 2:
2.1/ There are two links (L1, L2) available in the system
2.2/ L1 and L2 tolerance value are 2000ms as initial
2.3/ Set L2's tolerance from 2000ms => lower 1500ms
2.4/ Disable link L2 (bring down its bearer)

Expected:
    node timer interval is 2000ms/4=500ms after 2.4

Result:
node timer interval will not being updated after disabling L2 since
its value 2000ms/4=500ms is still not less than 1500/4=375ms at 2.3
although L2 is already not available in the system.

To fix this, we start the node interval calculation by initializing it to
a value larger than any conceivable calculated value. This way, the link
with the lowest tolerance will always determine the calculated value.

Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/node.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 488019766433..32556f480a60 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -624,6 +624,12 @@ static void tipc_node_timeout(struct timer_list *t)
 
 	__skb_queue_head_init(&xmitq);
 
+	/* Initial node interval to value larger (10 seconds), then it will be
+	 * recalculated with link lowest tolerance
+	 */
+	tipc_node_read_lock(n);
+	n->keepalive_intv = 10000;
+	tipc_node_read_unlock(n);
 	for (bearer_id = 0; remains && (bearer_id < MAX_BEARERS); bearer_id++) {
 		tipc_node_read_lock(n);
 		le = &n->links[bearer_id];
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 122/352] arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 121/352] tipc: fix node keep alive interval calculation Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 123/352] driver core: Move async_synchronize_full call Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oskari Lemmela, Akash Gajjar,
	Heiko Stuebner, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 690e16bada6029694740d5501025faf483d14339 ]

Rockpro64 is not able boot if GPIO1_C1 pin is pulled high
before loading linux kernel.

In rockpro64 GPIO1_C1 pin is connected vdd_cpu_b regulator
VSEL pin. Pin should be pulled down in normal operation and
pulled high in suspend.

PMIC LDO_REG2 is connected to touch panel connector.
Rename regulator and set it to correct voltage.

PCIe power is controller by GPIO1_D0.

Schematics can be downloaded from:
http://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf

Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
Acked-by: Akash Gajjar <Akash_Gajjar@mentor.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/rockchip/rk3399-rockpro64.dts    | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
index 1d35f5406b5e..5bd4d69914bd 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
@@ -97,7 +97,7 @@
 	vcc3v3_pcie: vcc3v3-pcie-regulator {
 		compatible = "regulator-fixed";
 		enable-active-high;
-		gpio = <&gpio1 RK_PC1 GPIO_ACTIVE_HIGH>;
+		gpio = <&gpio1 RK_PD0 GPIO_ACTIVE_HIGH>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pcie_pwr_en>;
 		regulator-name = "vcc3v3_pcie";
@@ -293,12 +293,12 @@
 				};
 			};
 
-			vcc2v8_dvp: LDO_REG2 {
-				regulator-name = "vcc2v8_dvp";
+			vcc3v0_touch: LDO_REG2 {
+				regulator-name = "vcc3v0_touch";
 				regulator-always-on;
 				regulator-boot-on;
-				regulator-min-microvolt = <2800000>;
-				regulator-max-microvolt = <2800000>;
+				regulator-min-microvolt = <3000000>;
+				regulator-max-microvolt = <3000000>;
 				regulator-state-mem {
 					regulator-off-in-suspend;
 				};
@@ -397,7 +397,9 @@
 	vdd_cpu_b: regulator@40 {
 		compatible = "silergy,syr827";
 		reg = <0x40>;
-		fcs,suspend-voltage-selector = <0>;
+		fcs,suspend-voltage-selector = <1>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&vsel1_gpio>;
 		regulator-name = "vdd_cpu_b";
 		regulator-min-microvolt = <712500>;
 		regulator-max-microvolt = <1500000>;
@@ -415,6 +417,8 @@
 		compatible = "silergy,syr828";
 		reg = <0x41>;
 		fcs,suspend-voltage-selector = <1>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&vsel2_gpio>;
 		regulator-name = "vdd_gpu";
 		regulator-min-microvolt = <712500>;
 		regulator-max-microvolt = <1500000>;
@@ -519,7 +523,7 @@
 
 	pcie {
 		pcie_pwr_en: pcie-pwr-en {
-			rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_none>;
+			rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>;
 		};
 	};
 
@@ -529,7 +533,7 @@
 		};
 
 		vsel1_gpio: vsel1-gpio {
-			rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>;
+			rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>;
 		};
 
 		vsel2_gpio: vsel2-gpio {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 123/352] driver core: Move async_synchronize_full call
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 122/352] arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 124/352] kobject: return error code if writing /sys/.../uevent fails Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Dan Williams,
	Alexander Duyck, Luis Chamberlain, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c37d721c68ad88925ba0e72f6e14acb829a8c6bb ]

Move the async_synchronize_full call out of __device_release_driver and
into driver_detach.

The idea behind this is that the async_synchronize_full call will only
guarantee that any existing async operations are flushed. This doesn't do
anything to guarantee that a hotplug event that may occur while we are
doing the release of the driver will not be asynchronously scheduled.

By moving this into the driver_detach path we can avoid potential deadlocks
as we aren't holding the device lock at this point and we should not have
the driver we want to flush loaded so the flush will take care of any
asynchronous events the driver we are detaching might have scheduled.

Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/dd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index dbba123e058d..9d6604b50d75 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -928,9 +928,6 @@ static void __device_release_driver(struct device *dev, struct device *parent)
 
 	drv = dev->driver;
 	if (drv) {
-		if (driver_allows_async_probing(drv))
-			async_synchronize_full();
-
 		while (device_links_busy(dev)) {
 			device_unlock(dev);
 			if (parent && dev->bus->need_parent_lock)
@@ -1036,6 +1033,9 @@ void driver_detach(struct device_driver *drv)
 	struct device_private *dev_prv;
 	struct device *dev;
 
+	if (driver_allows_async_probing(drv))
+		async_synchronize_full();
+
 	for (;;) {
 		spin_lock(&drv->p->klist_devices.k_lock);
 		if (list_empty(&drv->p->klist_devices.k_list)) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 124/352] kobject: return error code if writing /sys/.../uevent fails
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 123/352] driver core: Move async_synchronize_full call Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 125/352] IB/hfi1: Unreserve a reserved request when it is completed Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Rajnoha, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit df44b479654f62b478c18ee4d8bc4e9f897a9844 ]

Propagate error code back to userspace if writing the /sys/.../uevent
file fails. Before, the write operation always returned with success,
even if we failed to recognize the input string or if we failed to
generate the uevent itself.

With the error codes properly propagated back to userspace, we are
able to react in userspace accordingly by not assuming and awaiting
a uevent that is not delivered.

Signed-off-by: Peter Rajnoha <prajnoha@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/bus.c  | 12 ++++++++----
 drivers/base/core.c |  8 +++++++-
 kernel/module.c     |  6 ++++--
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 585e2e1c9c8f..e06a57936cc9 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -614,8 +614,10 @@ static void remove_probe_files(struct bus_type *bus)
 static ssize_t uevent_store(struct device_driver *drv, const char *buf,
 			    size_t count)
 {
-	kobject_synth_uevent(&drv->p->kobj, buf, count);
-	return count;
+	int rc;
+
+	rc = kobject_synth_uevent(&drv->p->kobj, buf, count);
+	return rc ? rc : count;
 }
 static DRIVER_ATTR_WO(uevent);
 
@@ -831,8 +833,10 @@ static void klist_devices_put(struct klist_node *n)
 static ssize_t bus_uevent_store(struct bus_type *bus,
 				const char *buf, size_t count)
 {
-	kobject_synth_uevent(&bus->p->subsys.kobj, buf, count);
-	return count;
+	int rc;
+
+	rc = kobject_synth_uevent(&bus->p->subsys.kobj, buf, count);
+	return rc ? rc : count;
 }
 static BUS_ATTR(uevent, S_IWUSR, NULL, bus_uevent_store);
 
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 04bbcd779e11..92e2c32c2227 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1067,8 +1067,14 @@ out:
 static ssize_t uevent_store(struct device *dev, struct device_attribute *attr,
 			    const char *buf, size_t count)
 {
-	if (kobject_synth_uevent(&dev->kobj, buf, count))
+	int rc;
+
+	rc = kobject_synth_uevent(&dev->kobj, buf, count);
+
+	if (rc) {
 		dev_err(dev, "uevent: failed to send synthetic uevent\n");
+		return rc;
+	}
 
 	return count;
 }
diff --git a/kernel/module.c b/kernel/module.c
index 49a405891587..0812a7f80fa7 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1207,8 +1207,10 @@ static ssize_t store_uevent(struct module_attribute *mattr,
 			    struct module_kobject *mk,
 			    const char *buffer, size_t count)
 {
-	kobject_synth_uevent(&mk->kobj, buffer, count);
-	return count;
+	int rc;
+
+	rc = kobject_synth_uevent(&mk->kobj, buffer, count);
+	return rc ? rc : count;
 }
 
 struct module_attribute module_uevent =
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 125/352] IB/hfi1: Unreserve a reserved request when it is completed
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 124/352] kobject: return error code if writing /sys/.../uevent fails Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 126/352] usb: dwc3: trace: add missing break statement to make compiler happy Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Marciniszyn, Kaike Wan,
	Dennis Dalessandro, Jason Gunthorpe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ca95f802ef5139722acc8d30aeaab6fe5bbe939e ]

Currently, When a reserved operation is completed, its entry in the send
queue will not be unreserved, which leads to the miscalculation of
qp->s_avail and thus the triggering of a WARN_ON call trace. This patch
fixes the problem by unreserving the reserved operation when it is
completed.

Fixes: 856cc4c237ad ("IB/hfi1: Add the capability for reserved operations")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Kaike Wan <kaike.wan@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/rc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 188aa4f686a0..ea3aac264df9 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -1157,6 +1157,7 @@ void hfi1_rc_send_complete(struct rvt_qp *qp, struct hfi1_opa_header *opah)
 		if (cmp_psn(wqe->lpsn, qp->s_sending_psn) >= 0 &&
 		    cmp_psn(qp->s_sending_psn, qp->s_sending_hpsn) <= 0)
 			break;
+		rvt_qp_wqe_unreserve(qp, wqe);
 		s_last = qp->s_last;
 		trace_hfi1_qp_send_completion(qp, wqe, s_last);
 		if (++s_last >= qp->s_size)
@@ -1209,6 +1210,7 @@ static struct rvt_swqe *do_rc_completion(struct rvt_qp *qp,
 		u32 s_last;
 
 		rvt_put_swqe(wqe);
+		rvt_qp_wqe_unreserve(qp, wqe);
 		s_last = qp->s_last;
 		trace_hfi1_qp_send_completion(qp, wqe, s_last);
 		if (++s_last >= qp->s_size)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 126/352] usb: dwc3: trace: add missing break statement to make compiler happy
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 125/352] IB/hfi1: Unreserve a reserved request when it is completed Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 127/352] gpio: mt7621: report failure of devm_kasprintf() Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Andy Shevchenko, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 54d48183d21e03f780053d7129312049cb5dd591 ]

The missed break statement in the outer switch makes the code fall through
always and thus always same value will be printed.

Besides that, compiler warns about missed fall through marker:

drivers/usb/dwc3/./trace.h: In function ‘trace_raw_output_dwc3_log_trb’:
drivers/usb/dwc3/./trace.h:246:4: warning: this statement may fall through [-Wimplicit-fallthrough=]
    switch (pcm) {
    ^~~~~~

Add the missing break statement to work correctly without compilation
warnings.

Fixes: fa8d965d736b ("usb: dwc3: trace: pretty print high-bandwidth transfers too")
Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/trace.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h
index f22714cce070..f27c5cbe285c 100644
--- a/drivers/usb/dwc3/trace.h
+++ b/drivers/usb/dwc3/trace.h
@@ -251,9 +251,11 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
 				s = "2x ";
 				break;
 			case 3:
+			default:
 				s = "3x ";
 				break;
 			}
+			break;
 		default:
 			s = "";
 		} s; }),
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 127/352] gpio: mt7621: report failure of devm_kasprintf()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 126/352] usb: dwc3: trace: add missing break statement to make compiler happy Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 128/352] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire,
	Bartosz Golaszewski, Sean Wang, Linus Walleij, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 59d646c775d6ae688ee90fda9f2a4270c47b7490 ]

kasprintf() may return NULL on failure of internal allocation thus the
assigned  label  is not safe if not explicitly checked. On error
mediatek_gpio_bank_probe() returns negative values so -ENOMEM in the
(unlikely) failure case should be fine here.

Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Acked-by: Sean Wang <sean.wang@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mt7621.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
index d72af6f6cdbd..1ec95bc18f5b 100644
--- a/drivers/gpio/gpio-mt7621.c
+++ b/drivers/gpio/gpio-mt7621.c
@@ -244,6 +244,8 @@ mediatek_gpio_bank_probe(struct device *dev,
 	rg->chip.of_xlate = mediatek_gpio_xlate;
 	rg->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%s-bank%d",
 					dev_name(dev), bank);
+	if (!rg->chip.label)
+		return -ENOMEM;
 
 	ret = devm_gpiochip_add_data(dev, &rg->chip, mtk);
 	if (ret < 0) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 128/352] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 127/352] gpio: mt7621: report failure of devm_kasprintf() Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 129/352] pinctrl: sx150x: handle failure case of devm_kstrdup Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sean Wang,
	Linus Walleij, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a109c2dbb571b10bb9969285b646f57309c98251 ]

The error cases of mediatek_gpio_bank_probe() would go unnoticed (except
for the dev_err() messages). The probe function should return an error
if one of the banks failed to initialize properly indicated by
not returning non-0.

Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Acked-by: Sean Wang <sean.wang@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mt7621.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
index 1ec95bc18f5b..00e954f22bc9 100644
--- a/drivers/gpio/gpio-mt7621.c
+++ b/drivers/gpio/gpio-mt7621.c
@@ -297,6 +297,7 @@ mediatek_gpio_probe(struct platform_device *pdev)
 	struct device_node *np = dev->of_node;
 	struct mtk *mtk;
 	int i;
+	int ret;
 
 	mtk = devm_kzalloc(dev, sizeof(*mtk), GFP_KERNEL);
 	if (!mtk)
@@ -311,8 +312,11 @@ mediatek_gpio_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, mtk);
 	mediatek_gpio_irq_chip.name = dev_name(dev);
 
-	for (i = 0; i < MTK_BANK_CNT; i++)
-		mediatek_gpio_bank_probe(dev, np, i);
+	for (i = 0; i < MTK_BANK_CNT; i++) {
+		ret = mediatek_gpio_bank_probe(dev, np, i);
+		if (ret)
+			return ret;
+	}
 
 	return 0;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 129/352] pinctrl: sx150x: handle failure case of devm_kstrdup
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 128/352] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 130/352] iommu/amd: Fix amd_iommu=force_isolation Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Linus Walleij,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a9d9f6b83f1bb05da849b3540e6d1f70ef1c2343 ]

devm_kstrdup() may return NULL if internal allocation failed.
Thus using  label, name  is unsafe without checking. Therefor
in the unlikely case of allocation failure, sx150x_probe() simply
returns -ENOMEM.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 9e80f9064e73 ("pinctrl: Add SX150X GPIO Extender Pinctrl Driver")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-sx150x.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-sx150x.c b/drivers/pinctrl/pinctrl-sx150x.c
index cbf58a10113d..4d87d75b9c6e 100644
--- a/drivers/pinctrl/pinctrl-sx150x.c
+++ b/drivers/pinctrl/pinctrl-sx150x.c
@@ -1166,7 +1166,6 @@ static int sx150x_probe(struct i2c_client *client,
 	}
 
 	/* Register GPIO controller */
-	pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
 	pctl->gpio.base = -1;
 	pctl->gpio.ngpio = pctl->data->npins;
 	pctl->gpio.get_direction = sx150x_gpio_get_direction;
@@ -1180,6 +1179,10 @@ static int sx150x_probe(struct i2c_client *client,
 	pctl->gpio.of_node = dev->of_node;
 #endif
 	pctl->gpio.can_sleep = true;
+	pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
+	if (!pctl->gpio.label)
+		return -ENOMEM;
+
 	/*
 	 * Setting multiple pins is not safe when all pins are not
 	 * handled by the same regmap register. The oscio pin (present
@@ -1200,13 +1203,15 @@ static int sx150x_probe(struct i2c_client *client,
 
 	/* Add Interrupt support if an irq is specified */
 	if (client->irq > 0) {
-		pctl->irq_chip.name = devm_kstrdup(dev, client->name,
-						   GFP_KERNEL);
 		pctl->irq_chip.irq_mask = sx150x_irq_mask;
 		pctl->irq_chip.irq_unmask = sx150x_irq_unmask;
 		pctl->irq_chip.irq_set_type = sx150x_irq_set_type;
 		pctl->irq_chip.irq_bus_lock = sx150x_irq_bus_lock;
 		pctl->irq_chip.irq_bus_sync_unlock = sx150x_irq_bus_sync_unlock;
+		pctl->irq_chip.name = devm_kstrdup(dev, client->name,
+						   GFP_KERNEL);
+		if (!pctl->irq_chip.name)
+			return -ENOMEM;
 
 		pctl->irq.masked = ~0;
 		pctl->irq.sense = 0;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 130/352] iommu/amd: Fix amd_iommu=force_isolation
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 129/352] pinctrl: sx150x: handle failure case of devm_kstrdup Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 131/352] media: v4l2-device: Link subdevices to their parent devices if available Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Zhao, Joerg Roedel, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c12b08ebbe16f0d3a96a116d86709b04c1ee8e74 ]

The parameter is still there but it's ignored. We need to check its
value before deciding to go into passthrough mode for AMD IOMMU v2
capable device.

We occasionally use this parameter to force v2 capable device into
translation mode to debug memory corruption that we suspect is
caused by DMA writes.

To address the following comment from Joerg Roedel on the first
version, v2 capability of device is completely ignored.
> This breaks the iommu_v2 use-case, as it needs a direct mapping for the
> devices that support it.

And from Documentation/admin-guide/kernel-parameters.txt:
  This option does not override iommu=pt

Fixes: aafd8ba0ca74 ("iommu/amd: Implement add_device and remove_device")

Signed-off-by: Yu Zhao <yuzhao@google.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 1167ff0416cf..325f3bad118b 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -438,7 +438,14 @@ static int iommu_init_device(struct device *dev)
 
 	dev_data->alias = get_alias(dev);
 
-	if (dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
+	/*
+	 * By default we use passthrough mode for IOMMUv2 capable device.
+	 * But if amd_iommu=force_isolation is set (e.g. to debug DMA to
+	 * invalid address), we ignore the capability for the device so
+	 * it'll be forced to go into translation mode.
+	 */
+	if ((iommu_pass_through || !amd_iommu_force_isolation) &&
+	    dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
 		struct amd_iommu *iommu;
 
 		iommu = amd_iommu_rlookup_table[dev_data->devid];
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 131/352] media: v4l2-device: Link subdevices to their parent devices if available
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 130/352] iommu/amd: Fix amd_iommu=force_isolation Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:15 ` [PATCH 4.20 132/352] ARM: OMAP1: ams-delta: Fix audio permanently muted Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tomasz Figa, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ee494cf377e142f65f202fadf0d859f8e12119fb ]

Currently v4l2_device_register_subdev_nodes() does not initialize the
dev_parent field of the video_device structs it creates for subdevices
being registered. This leads to __video_register_device() falling back
to the parent device of associated v4l2_device struct, which often does
not match the physical device the subdevice is registered for.

Due to the problem above, the links between real devices and v4l-subdev
nodes cannot be obtained from sysfs, which might be confusing for the
userspace trying to identify the hardware.

Fix this by initializing the dev_parent field of the video_device struct
with the value of dev field of the v4l2_subdev struct. In case of
subdevices without a parent struct device, the field will be NULL and the
old behavior will be preserved by the semantics of
__video_register_device().

Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c
index df0ac38c4050..e0ddb9a52bd1 100644
--- a/drivers/media/v4l2-core/v4l2-device.c
+++ b/drivers/media/v4l2-core/v4l2-device.c
@@ -247,6 +247,7 @@ int v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev)
 
 		video_set_drvdata(vdev, sd);
 		strscpy(vdev->name, sd->name, sizeof(vdev->name));
+		vdev->dev_parent = sd->dev;
 		vdev->v4l2_dev = v4l2_dev;
 		vdev->fops = &v4l2_subdev_fops;
 		vdev->release = v4l2_device_release_subdev_node;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 132/352] ARM: OMAP1: ams-delta: Fix audio permanently muted
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 131/352] media: v4l2-device: Link subdevices to their parent devices if available Greg Kroah-Hartman
@ 2019-02-11 14:15 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 133/352] ARM: dts: Fix OMAP4430 SDP Ethernet startup Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Janusz Krzysztofik, Tony Lindgren,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2afdb4c41d7876e430b9bc6e2d7e2fe28609fd6a ]

Since commit 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused
GPIOs"), on-board audio has appeared muted.  Believed to be unused GPIO
pin "hookflash1", apparently set high regardless of the corresponding
bit of "latch2" port attempted to be set low during .init_machine(),
has been identified as the reason.

According to Amstrad E3 wiki, the purpose of the pin hasn't been
clearly identified.  Original Amstrad software used to produce a high
pulse on it when the phone was taken off hook or recall was pressed.
With the current finding, we can assume the pin provides a kind of
audio mute function.

Proper resolution of the issue should be done in two steps:
- resolution of an issue with the pin state not reflecting the value
  the corresponding bit of the port was attempted to be initialized
  with,
- extension of on-board audio driver with a new control.

For now, rename the pin to "audio_mute" to reflect its function and,
as a quick fix, hogg it as output low so on-board audio can produce
audible sound again.

Fixes: 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused GPIOs")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap1/board-ams-delta.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index 17886744dbe6..55bf73710a59 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -247,8 +247,8 @@ static struct platform_device latch2_gpio_device = {
 #define LATCH2_PIN_SCARD_CMDVCC		11
 #define LATCH2_PIN_MODEM_NRESET		12
 #define LATCH2_PIN_MODEM_CODEC		13
-#define LATCH2_PIN_HOOKFLASH1		14
-#define LATCH2_PIN_HOOKFLASH2		15
+#define LATCH2_PIN_AUDIO_MUTE		14
+#define LATCH2_PIN_HOOKFLASH		15
 
 static struct regulator_consumer_supply modem_nreset_consumers[] = {
 	REGULATOR_SUPPLY("RESET#", "serial8250.1"),
@@ -588,6 +588,8 @@ static int gpiochip_match_by_label(struct gpio_chip *chip, void *data)
 static struct gpiod_hog ams_delta_gpio_hogs[] = {
 	GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_KEYBRD_DATAOUT, "keybrd_dataout",
 		 GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW),
+	GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_AUDIO_MUTE, "audio_mute",
+		 GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW),
 	{},
 };
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 133/352] ARM: dts: Fix OMAP4430 SDP Ethernet startup
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2019-02-11 14:15 ` [PATCH 4.20 132/352] ARM: OMAP1: ams-delta: Fix audio permanently muted Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 134/352] mips: bpf: fix encoding bug for mm_srlv32_op Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Peter Ujfalusi,
	Tony Lindgren, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 84fb6c7feb1494ebb7d1ec8b95cfb7ada0264465 ]

It was noticed that unbinding and rebinding the KSZ8851 ethernet
resulted in the driver reporting "failed to read device ID" at probe.
Probing the reset line with a 'scope while repeatedly attempting to
bind the driver in a shell loop revealed that the KSZ8851 RSTN pin is
constantly held at zero, meaning the device is held in reset, and
does not respond on the SPI bus.

Experimentation with the startup delay on the regulator set to 50ms
shows that the reset is positively released after 20ms.

Schematics for this board are not available, and the traces are buried
in the inner layers of the board which makes tracing where the RSTN pin
extremely difficult.  We can only guess that the RSTN pin is wired to a
reset generator chip driven off the ethernet supply, which fits the
observed behaviour.

Include this delay in the regulator startup delay - effectively
treating the reset as a "supply stable" indicator.

This can not be modelled as a delay in the KSZ8851 driver since the
reset generation is board specific - if the RSTN pin had been wired to
a GPIO, reset could be released earlier via the already provided support
in the KSZ8851 driver.

This also got confirmed by Peter Ujfalusi <peter.ujfalusi@ti.com> based
on Blaze schematics that should be very close to SDP4430:

TPS22902YFPR is used as the regulator switch (gpio48 controlled):
Convert arm boot_lock to raw The VOUT is routed to TPS3808G01DBV.
(SCH Note: Threshold set at 90%. Vsense: 0.405V).

According to the TPS3808 data sheet the RESET delay time when Ct is
open (this is the case in the schema): MIN/TYP/MAX: 12/20/28 ms.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
[tony@atomide.com: updated with notes from schematics from Peter]
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap4-sdp.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts
index 490726b52216..9dc7ec7655cb 100644
--- a/arch/arm/boot/dts/omap4-sdp.dts
+++ b/arch/arm/boot/dts/omap4-sdp.dts
@@ -33,6 +33,7 @@
 		gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>;  /* gpio line 48 */
 		enable-active-high;
 		regulator-boot-on;
+		startup-delay-us = <25000>;
 	};
 
 	vbat: fixedregulator-vbat {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 134/352] mips: bpf: fix encoding bug for mm_srlv32_op
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 133/352] ARM: dts: Fix OMAP4430 SDP Ethernet startup Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 135/352] media: coda: fix H.264 deblocking filter controls Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Markos Chandras, Paul Burton,
	linux-mips, Jakub Kicinski, Song Liu, Jiong Wang,
	Alexei Starovoitov, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 17f6c83fb5ebf7db4fcc94a5be4c22d5a7bfe428 ]

For micro-mips, srlv inside POOL32A encoding space should use 0x50
sub-opcode, NOT 0x90.

Some early version ISA doc describes the encoding as 0x90 for both srlv and
srav, this looks to me was a typo. I checked Binutils libopcode
implementation which is using 0x50 for srlv and 0x90 for srav.

v1->v2:
  - Keep mm_srlv32_op sorted by value.

Fixes: f31318fdf324 ("MIPS: uasm: Add srlv uasm instruction")
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/uapi/asm/inst.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index c05dcf5ab414..273ef58f4d43 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -369,8 +369,8 @@ enum mm_32a_minor_op {
 	mm_ext_op = 0x02c,
 	mm_pool32axf_op = 0x03c,
 	mm_srl32_op = 0x040,
+	mm_srlv32_op = 0x050,
 	mm_sra_op = 0x080,
-	mm_srlv32_op = 0x090,
 	mm_rotr_op = 0x0c0,
 	mm_lwxs_op = 0x118,
 	mm_addu32_op = 0x150,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 135/352] media: coda: fix H.264 deblocking filter controls
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 134/352] mips: bpf: fix encoding bug for mm_srlv32_op Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 136/352] arm64: dts: meson: Fix IRQ trigger type for macirq Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Philipp Zabel, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 75fa6e4f83a0923fe753827d354998d448b4fd6a ]

Add support for the third loop filter mode
V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY,
and fix V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA and
V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA controls.

The filter offset controls are signed values in the -6 to 6 range and
are stored into the slice header fields slice_alpha_c0_offset_div2 and
slice_beta_offset_div2. The actual filter offsets FilterOffsetA/B are
double their value, in range of -12 to 12.

Rename variables to more closely match the nomenclature in the H.264
specification.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/coda/coda-bit.c    | 19 +++++++++----------
 drivers/media/platform/coda/coda-common.c | 15 +++++++--------
 drivers/media/platform/coda/coda.h        |  6 +++---
 drivers/media/platform/coda/coda_regs.h   |  2 +-
 4 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index d26c2d85a009..d20d3df5778b 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -991,16 +991,15 @@ static int coda_start_encoding(struct coda_ctx *ctx)
 		else
 			coda_write(dev, CODA_STD_H264,
 				   CODA_CMD_ENC_SEQ_COD_STD);
-		if (ctx->params.h264_deblk_enabled) {
-			value = ((ctx->params.h264_deblk_alpha &
-				  CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) <<
-				 CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) |
-				((ctx->params.h264_deblk_beta &
-				  CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) <<
-				 CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET);
-		} else {
-			value = 1 << CODA_264PARAM_DISABLEDEBLK_OFFSET;
-		}
+		value = ((ctx->params.h264_disable_deblocking_filter_idc &
+			  CODA_264PARAM_DISABLEDEBLK_MASK) <<
+			 CODA_264PARAM_DISABLEDEBLK_OFFSET) |
+			((ctx->params.h264_slice_alpha_c0_offset_div2 &
+			  CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) <<
+			 CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) |
+			((ctx->params.h264_slice_beta_offset_div2 &
+			  CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) <<
+			 CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET);
 		coda_write(dev, value, CODA_CMD_ENC_SEQ_264_PARA);
 		break;
 	case V4L2_PIX_FMT_JPEG:
diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
index 2848ea5f464d..d0b36d6eb86e 100644
--- a/drivers/media/platform/coda/coda-common.c
+++ b/drivers/media/platform/coda/coda-common.c
@@ -1792,14 +1792,13 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl)
 		ctx->params.h264_max_qp = ctrl->val;
 		break;
 	case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA:
-		ctx->params.h264_deblk_alpha = ctrl->val;
+		ctx->params.h264_slice_alpha_c0_offset_div2 = ctrl->val;
 		break;
 	case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA:
-		ctx->params.h264_deblk_beta = ctrl->val;
+		ctx->params.h264_slice_beta_offset_div2 = ctrl->val;
 		break;
 	case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE:
-		ctx->params.h264_deblk_enabled = (ctrl->val ==
-				V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
+		ctx->params.h264_disable_deblocking_filter_idc = ctrl->val;
 		break;
 	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
 		/* TODO: switch between baseline and constrained baseline */
@@ -1881,13 +1880,13 @@ static void coda_encode_ctrls(struct coda_ctx *ctx)
 	v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
 		V4L2_CID_MPEG_VIDEO_H264_MAX_QP, 0, 51, 1, 51);
 	v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
-		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, 0, 15, 1, 0);
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, -6, 6, 1, 0);
 	v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
-		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, 0, 15, 1, 0);
+		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, -6, 6, 1, 0);
 	v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
 		V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE,
-		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED, 0x0,
-		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
+		V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY,
+		0x0, V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
 	v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
 		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
 		V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE, 0x0,
diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
index 19ac0b9dc6eb..2469ca1dc598 100644
--- a/drivers/media/platform/coda/coda.h
+++ b/drivers/media/platform/coda/coda.h
@@ -115,9 +115,9 @@ struct coda_params {
 	u8			h264_inter_qp;
 	u8			h264_min_qp;
 	u8			h264_max_qp;
-	u8			h264_deblk_enabled;
-	u8			h264_deblk_alpha;
-	u8			h264_deblk_beta;
+	u8			h264_disable_deblocking_filter_idc;
+	s8			h264_slice_alpha_c0_offset_div2;
+	s8			h264_slice_beta_offset_div2;
 	u8			h264_profile_idc;
 	u8			h264_level_idc;
 	u8			mpeg4_intra_qp;
diff --git a/drivers/media/platform/coda/coda_regs.h b/drivers/media/platform/coda/coda_regs.h
index 5e7b00a97671..e675e38f3475 100644
--- a/drivers/media/platform/coda/coda_regs.h
+++ b/drivers/media/platform/coda/coda_regs.h
@@ -292,7 +292,7 @@
 #define		CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET	8
 #define		CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK	0x0f
 #define		CODA_264PARAM_DISABLEDEBLK_OFFSET		6
-#define		CODA_264PARAM_DISABLEDEBLK_MASK		0x01
+#define		CODA_264PARAM_DISABLEDEBLK_MASK		0x03
 #define		CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_OFFSET	5
 #define		CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_MASK	0x01
 #define		CODA_264PARAM_CHROMAQPOFFSET_OFFSET		0
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 136/352] arm64: dts: meson: Fix IRQ trigger type for macirq
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 135/352] media: coda: fix H.264 deblocking filter controls Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 137/352] ARM: dts: Fix up the D-Link DIR-685 MTD partition info Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Neil Armstrong,
	Carlo Caione, Kevin Hilman, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8b3e6f8999f8d704fccce225b9455b3fa639d1c9 ]

A long running stress test on a custom board shipping an AXG SoCs and a
Realtek RTL8211F PHY revealed that after a few hours the connection
speed would drop drastically, from ~1000Mbps to ~3Mbps. At the same time
the 'macirq' (eth0) IRQ would stop being triggered at all and as
consequence the GMAC IRQs never ACKed.

After a painful investigation the problem seemed to be due to a wrong
defined IRQ type for the GMAC IRQ that should be LEVEL_HIGH instead of
EDGE_RISING.

The change in the macirq IRQ type also solved another long standing
issue affecting this SoC/PHY where EEE was causing the network
connection to die after stressing it with iperf3 (even though much
sooner). It's now possible to remove the 'eee-broken-1000t' quirk as
well.

Fixes: feb3cbea0946 ("ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage")
Fixes: 6d28d577510f ("ARM64: dts: meson-axg: fix ethernet stability issue")
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Jerome Brunet <jbrunet@baylibre.com>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi          | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gx.dtsi           | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 1 -
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi   | 1 -
 4 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index df017dbd2e57..b1a42e99cb67 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -143,7 +143,7 @@
 			compatible = "amlogic,meson-axg-dwmac", "snps,dwmac";
 			reg = <0x0 0xff3f0000 0x0 0x10000
 			       0x0 0xff634540 0x0 0x8>;
-			interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "macirq";
 			clocks = <&clkc CLKID_ETH>,
 				 <&clkc CLKID_FCLK_DIV2>,
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index f1e5cdbade5e..58e6bcaac1d8 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -462,7 +462,7 @@
 			compatible = "amlogic,meson-gx-dwmac", "amlogic,meson-gxbb-dwmac", "snps,dwmac";
 			reg = <0x0 0xc9410000 0x0 0x10000
 			       0x0 0xc8834540 0x0 0x4>;
-			interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "macirq";
 			status = "disabled";
 		};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 54954b314a45..f8d1cedbe600 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -143,7 +143,6 @@
 			interrupt-parent = <&gpio_intc>;
 			/* MAC_INTR on GPIOZ_15 */
 			interrupts = <29 IRQ_TYPE_LEVEL_LOW>;
-			eee-broken-1000t;
 		};
 	};
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index 70325b273bd2..ec09bb5792b7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -142,7 +142,6 @@
 		eth_phy0: ethernet-phy@0 {
 			/* Realtek RTL8211F (0x001cc916) */
 			reg = <0>;
-			eee-broken-1000t;
 		};
 	};
 };
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 137/352] ARM: dts: Fix up the D-Link DIR-685 MTD partition info
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 136/352] arm64: dts: meson: Fix IRQ trigger type for macirq Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Walleij, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 738a05e673435afb986b53da43befd83ad87ec3b ]

The vendor firmware was analyzed to get the right idea about
this flash layout. /proc/mtd contains:

dev:    size   erasesize  name
mtd0: 01e7ff40 00020000 "rootfs"
mtd1: 01f40000 00020000 "upgrade"
mtd2: 00040000 00020000 "rgdb"
mtd3: 00020000 00020000 "nvram"
mtd4: 00040000 00020000 "RedBoot"
mtd5: 00020000 00020000 "LangPack"
mtd6: 02000000 00020000 "flash"

Here "flash" is obviously the whole device and we know "rootfs"
is a bogus hack to point to a squashfs rootfs inside of the main
"upgrade partition". We know "RedBoot" is the first 0x40000 of
the flash and the "upgrade" partition follows from 0x40000 to
0x1f8000. So we have mtd0, 1, 4 and 6 covered.

Remains:
mtd2: 00040000 00020000 "rgdb"
mtd3: 00020000 00020000 "nvram"
mtd5: 00020000 00020000 "LangPack"

Inspecting the flash at 0x1f8000 and 0x1fa000 reveals each of
these starting with "RGCFG1" so we assume 0x1f8000-1fbfff is
"rgdb" of 0x40000.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/gemini-dlink-dir-685.dts | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
index 6f258b50eb44..502a361d1fe9 100644
--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
@@ -274,20 +274,16 @@
 				read-only;
 			};
 			/*
-			 * Between the boot loader and the rootfs is the kernel
-			 * in a custom Storlink format flashed from the boot
-			 * menu. The rootfs is in squashfs format.
+			 * This firmware image contains the kernel catenated
+			 * with the squashfs root filesystem. For some reason
+			 * this is called "upgrade" on the vendor system.
 			 */
-			partition@1800c0 {
-				label = "rootfs";
-				reg = <0x001800c0 0x01dbff40>;
-				read-only;
-			};
-			partition@1f40000 {
+			partition@40000 {
 				label = "upgrade";
-				reg = <0x01f40000 0x00040000>;
+				reg = <0x00040000 0x01f40000>;
 				read-only;
 			};
+			/* RGDB, Residental Gateway Database? */
 			partition@1f80000 {
 				label = "rgdb";
 				reg = <0x01f80000 0x00040000>;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 137/352] ARM: dts: Fix up the D-Link DIR-685 MTD partition info Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:49   ` Steven Rostedt
  2019-02-11 14:16 ` [PATCH 4.20 139/352] watchdog: renesas_wdt: dont set divider while watchdog is running Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter,
	Steven Rostedt (VMware),
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ca16b0fbb05242f18da9d810c07d3882ffed831c ]

Dan Carpenter reviewed the trace_stack.c code and figured he found an off by
one bug.

 "From reviewing the code, it seems possible for
  stack_trace_max.nr_entries to be set to .max_entries and in that case we
  would be reading one element beyond the end of the stack_dump_trace[]
  array.  If it's not set to .max_entries then the bug doesn't affect
  runtime."

Although it looks to be the case, it is not. Because we have:

 static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
	 { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };

 struct stack_trace stack_trace_max = {
	.max_entries		= STACK_TRACE_ENTRIES - 1,
	.entries		= &stack_dump_trace[0],
 };

And:

	stack_trace_max.nr_entries = x;
	for (; x < i; x++)
		stack_dump_trace[x] = ULONG_MAX;

Even if nr_entries equals max_entries, indexing with it into the
stack_dump_trace[] array will not overflow the array. But if it is the case,
the second part of the conditional that tests stack_dump_trace[nr_entries]
to ULONG_MAX will always be true.

By applying Dan's patch, it removes the subtle aspect of it and makes the if
conditional slightly more efficient.

Link: http://lkml.kernel.org/r/20180620110758.crunhd5bfep7zuiz@kili.mountain

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_stack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 2b0d1ee3241c..e2a153fc1afc 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -286,7 +286,7 @@ __next(struct seq_file *m, loff_t *pos)
 {
 	long n = *pos - 1;
 
-	if (n > stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
+	if (n >= stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
 		return NULL;
 
 	m->private = (void *)n;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 139/352] watchdog: renesas_wdt: dont set divider while watchdog is running
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 140/352] ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Fabrizio Castro,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e990e12741877e9bfac402ca468f4007a75f6e2a ]

The datasheet says we must stop the timer before changing the clock
divider. This can happen when the restart handler is called while the
watchdog is running.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/renesas_wdt.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/watchdog/renesas_wdt.c b/drivers/watchdog/renesas_wdt.c
index 0d74c3e48979..55c9eb6c6e51 100644
--- a/drivers/watchdog/renesas_wdt.c
+++ b/drivers/watchdog/renesas_wdt.c
@@ -74,12 +74,17 @@ static int rwdt_init_timeout(struct watchdog_device *wdev)
 static int rwdt_start(struct watchdog_device *wdev)
 {
 	struct rwdt_priv *priv = watchdog_get_drvdata(wdev);
+	u8 val;
 
 	pm_runtime_get_sync(wdev->parent);
 
-	rwdt_write(priv, 0, RWTCSRB);
-	rwdt_write(priv, priv->cks, RWTCSRA);
+	/* Stop the timer before we modify any register */
+	val = readb_relaxed(priv->base + RWTCSRA) & ~RWTCSRA_TME;
+	rwdt_write(priv, val, RWTCSRA);
+
 	rwdt_init_timeout(wdev);
+	rwdt_write(priv, priv->cks, RWTCSRA);
+	rwdt_write(priv, 0, RWTCSRB);
 
 	while (readb_relaxed(priv->base + RWTCSRA) & RWTCSRA_WRFLG)
 		cpu_relax();
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 140/352] ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 139/352] watchdog: renesas_wdt: dont set divider while watchdog is running Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 141/352] usb: dwc3: gadget: Disable CSP for stream OUT ep Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrey Smirnov, Fabio Estevam,
	Chris Healy, Shawn Guo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 79da07dec740a42c70963ebacbd2bf8866af9e20 ]

TPA6130A2 SD pin on RDU1 is not really controlled by SoC and instead
is only meant to notify the system that audio was "muted" by external
actors. To accommodate that, drop "power-gpio" property of hpa1 node as
well as specify a name for that GPIO so that userspace can access it.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Tested-by: Chris Healy <cphealy@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx51-zii-rdu1.dts | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
index 69d753cac89a..44985f61c0ba 100644
--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
+++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
@@ -477,6 +477,15 @@
 };
 
 &gpio1 {
+	gpio-line-names = "", "", "", "",
+			  "", "", "", "",
+			  "", "hp-amp-shutdown-b", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "";
+
 	unused-sd3-wp-gpio {
 		/*
 		 * See pinctrl_esdhc1 below for more details on this
@@ -495,9 +504,6 @@
 	hpa1: amp@60 {
 		compatible = "ti,tpa6130a2";
 		reg = <0x60>;
-		pinctrl-names = "default";
-		pinctrl-0 = <&pinctrl_ampgpio>;
-		power-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
 		Vdd-supply = <&reg_3p3v>;
 	};
 
@@ -671,7 +677,10 @@
 };
 
 &iomuxc {
-	pinctrl_ampgpio: ampgpiogrp {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_hog>;
+
+	pinctrl_hog: hoggrp {
 		fsl,pins = <
 			MX51_PAD_GPIO1_9__GPIO1_9		0x5e
 		>;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 141/352] usb: dwc3: gadget: Disable CSP for stream OUT ep
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 140/352] ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 142/352] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tejas Joglekar, Felipe Balbi, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 244add8ebfb231c39db9e33b204bd0ce8f24f782 ]

In stream mode, when fast-forwarding TRBs, the stream number
is not cleared causing the new stream to not get assigned. So
we don't want controller to carry on transfers when short packet
is received. So disable the CSP for stream capable endpoint.

This is based on the 3.30a Programming guide, where table 3-1
device descriptor structure field definitions says for CSP bit
If this bit is 0, the controller generates an XferComplete event
and remove the stream. So if we keep CSP as 1 then switching between
streams would not happen as in stream mode, when fast-forwarding
TRBs, the stream number is not cleared causing the new stream to not get
assigned.

Signed-off-by: Tejas Joglekar <joglekar@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/gadget.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 88f69d823be5..357a2b330137 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -990,9 +990,13 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 				usb_endpoint_type(dep->endpoint.desc));
 	}
 
-	/* always enable Continue on Short Packet */
+	/*
+	 * Enable Continue on Short Packet
+	 * when endpoint is not a stream capable
+	 */
 	if (usb_endpoint_dir_out(dep->endpoint.desc)) {
-		trb->ctrl |= DWC3_TRB_CTRL_CSP;
+		if (!dep->stream_capable)
+			trb->ctrl |= DWC3_TRB_CTRL_CSP;
 
 		if (short_not_ok)
 			trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 142/352] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 141/352] usb: dwc3: gadget: Disable CSP for stream OUT ep Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 143/352] iommu/arm-smmu: Add support for qcom,smmu-v2 variant Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Zhen Lei, Will Deacon,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 84a9a75774961612d0c7dd34a1777e8f98a65abd ]

The GITS_TRANSLATER MMIO doorbell register in the ITS hardware is
architected to be 4 bytes in size, yet on hi1620 and earlier, Hisilicon
have allocated the adjacent 4 bytes to carry some IMPDEF sideband
information which results in an 8-byte MSI payload being delivered when
signalling an interrupt:

MSIAddr:
	 |----4bytes----|----4bytes----|
	 |    MSIData   |    IMPDEF    |

This poses no problem for the ITS hardware because the adjacent 4 bytes
are reserved in the memory map. However, when delivering MSIs to memory,
as we do in the SMMUv3 driver for signalling the completion of a SYNC
command, the extended payload will corrupt the 4 bytes adjacent to the
"sync_count" member in struct arm_smmu_device. Fortunately, the current
layout allocates these bytes to padding, but this is fragile and we
should make this explicit.

Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
[will: Rewrote commit message and comment]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm-smmu-v3.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 71eda422c926..62ef4afc9ee5 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -576,7 +576,11 @@ struct arm_smmu_device {
 
 	struct arm_smmu_strtab_cfg	strtab_cfg;
 
-	u32				sync_count;
+	/* Hi16xx adds an extra 32 bits of goodness to its MSI payload */
+	union {
+		u32			sync_count;
+		u64			padding;
+	};
 
 	/* IOMMU core code handle */
 	struct iommu_device		iommu;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 143/352] iommu/arm-smmu: Add support for qcom,smmu-v2 variant
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 142/352] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 144/352] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vivek Gautam, Rob Herring,
	Tomasz Figa, Srinivas Kandagatla, Robin Murphy, Will Deacon,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 89cddc563743cb1e0068867ac97013b2a5bf86aa ]

qcom,smmu-v2 is an arm,smmu-v2 implementation with specific
clock and power requirements.
On msm8996, multiple cores, viz. mdss, video, etc. use this
smmu. On sdm845, this smmu is used with gpu.
Add bindings for the same.

Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm-smmu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 5a28ae892504..e23aa7f6c4ad 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -119,6 +119,7 @@ enum arm_smmu_implementation {
 	GENERIC_SMMU,
 	ARM_MMU500,
 	CAVIUM_SMMUV2,
+	QCOM_SMMUV2,
 };
 
 struct arm_smmu_s2cr {
@@ -1954,6 +1955,7 @@ ARM_SMMU_MATCH_DATA(smmu_generic_v2, ARM_SMMU_V2, GENERIC_SMMU);
 ARM_SMMU_MATCH_DATA(arm_mmu401, ARM_SMMU_V1_64K, GENERIC_SMMU);
 ARM_SMMU_MATCH_DATA(arm_mmu500, ARM_SMMU_V2, ARM_MMU500);
 ARM_SMMU_MATCH_DATA(cavium_smmuv2, ARM_SMMU_V2, CAVIUM_SMMUV2);
+ARM_SMMU_MATCH_DATA(qcom_smmuv2, ARM_SMMU_V2, QCOM_SMMUV2);
 
 static const struct of_device_id arm_smmu_of_match[] = {
 	{ .compatible = "arm,smmu-v1", .data = &smmu_generic_v1 },
@@ -1962,6 +1964,7 @@ static const struct of_device_id arm_smmu_of_match[] = {
 	{ .compatible = "arm,mmu-401", .data = &arm_mmu401 },
 	{ .compatible = "arm,mmu-500", .data = &arm_mmu500 },
 	{ .compatible = "cavium,smmu-v2", .data = &cavium_smmuv2 },
+	{ .compatible = "qcom,smmu-v2", .data = &qcom_smmuv2 },
 	{ },
 };
 MODULE_DEVICE_TABLE(of, arm_smmu_of_match);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 144/352] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 143/352] iommu/arm-smmu: Add support for qcom,smmu-v2 variant Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 145/352] sata_rcar: fix deferred probing Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Will Deacon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a868e8530441286342f90c1fd9c5f24de3aa2880 ]

After removing an entry from a queue (e.g. reading an event in
arm_smmu_evtq_thread()) it is necessary to advance the MMIO consumer
pointer to free the queue slot back to the SMMU. A memory barrier is
required here so that all reads targetting the queue entry have
completed before the consumer pointer is updated.

The implementation of queue_inc_cons() relies on a writel() to complete
the previous reads, but this is incorrect because writel() is only
guaranteed to complete prior writes. This patch replaces the call to
writel() with an mb(); writel_relaxed() sequence, which gives us the
read->write ordering which we require.

Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm-smmu-v3.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 62ef4afc9ee5..11f528e727a1 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -679,7 +679,13 @@ static void queue_inc_cons(struct arm_smmu_queue *q)
 	u32 cons = (Q_WRP(q, q->cons) | Q_IDX(q, q->cons)) + 1;
 
 	q->cons = Q_OVF(q, q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons);
-	writel(q->cons, q->cons_reg);
+
+	/*
+	 * Ensure that all CPU accesses (reads and writes) to the queue
+	 * are complete before we update the cons pointer.
+	 */
+	mb();
+	writel_relaxed(q->cons, q->cons_reg);
 }
 
 static int queue_sync_prod(struct arm_smmu_queue *q)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 145/352] sata_rcar: fix deferred probing
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 144/352] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 146/352] clk: imx6sl: ensure MMDC CH0 handshake is bypassed Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Horman, Geert Uytterhoeven,
	Sergei Shtylyov, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9f83cfdb1ace3ef268ecc6fda50058d2ec37d603 ]

The driver overrides the error codes returned by platform_get_irq() to
-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing. Switch to propagating the
error code upstream, still checking/overriding IRQ0 as libata regards it
as "no IRQ" (thus polling) anyway...

Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/sata_rcar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 4b1ff5bc256a..59b2317acea9 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -891,7 +891,9 @@ static int sata_rcar_probe(struct platform_device *pdev)
 	int ret = 0;
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0)
+	if (irq < 0)
+		return irq;
+	if (!irq)
 		return -EINVAL;
 
 	priv = devm_kzalloc(dev, sizeof(struct sata_rcar_priv), GFP_KERNEL);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 146/352] clk: imx6sl: ensure MMDC CH0 handshake is bypassed
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 145/352] sata_rcar: fix deferred probing Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 147/352] platform/x86: mlx-platform: Fix tachometer registers Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anson Huang, Stephen Boyd, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0efcc2c0fd2001a83240a8c3d71f67770484917e ]

Same as other i.MX6 SoCs, ensure unused MMDC channel's
handshake is bypassed, this is to make sure no request
signal will be generated when periphe_clk_sel is changed
or SRC warm reset is triggered.

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6sl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c
index 6fcfbbd907a5..e13d8814cfa4 100644
--- a/drivers/clk/imx/clk-imx6sl.c
+++ b/drivers/clk/imx/clk-imx6sl.c
@@ -17,6 +17,8 @@
 
 #include "clk.h"
 
+#define CCDR				0x4
+#define BM_CCM_CCDR_MMDC_CH0_MASK	(1 << 17)
 #define CCSR			0xc
 #define BM_CCSR_PLL1_SW_CLK_SEL	(1 << 2)
 #define CACRR			0x10
@@ -411,6 +413,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
 	clks[IMX6SL_CLK_USDHC3]       = imx_clk_gate2("usdhc3",       "usdhc3_podf",       base + 0x80, 6);
 	clks[IMX6SL_CLK_USDHC4]       = imx_clk_gate2("usdhc4",       "usdhc4_podf",       base + 0x80, 8);
 
+	/* Ensure the MMDC CH0 handshake is bypassed */
+	writel_relaxed(readl_relaxed(base + CCDR) |
+		BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR);
+
 	imx_check_clocks(clks, ARRAY_SIZE(clks));
 
 	clk_data.clks = clks;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 147/352] platform/x86: mlx-platform: Fix tachometer registers
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 146/352] clk: imx6sl: ensure MMDC CH0 handshake is bypassed Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 148/352] cpuidle: big.LITTLE: fix refcount leak Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Darren Hart (VMware),
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit edd45cba5ed7f53974475ddc9a1453c2c87b3328 ]

Shift by one the registers for tachometers (7 - 12).

This fix is relevant for the same new systems MQMB7, MSN37, MSN34,
which are about to be released to the customers.
At the moment, none of them is at customers sites. The customers will
not suffer from this change.
This fix is necessary, because register used before for tachometer 7
has been than reserved for the second PWM for newer systems, which are
not supported yet in mlx-platform driver. So registers of tachometers
7-12 have been shifted by one.

Fixes: 0378123c5800 ("platform/x86: mlx-platform: Add mlxreg-fan platform driver activation")
Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index c2c3a1a19879..14f88bfabd5d 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -83,12 +83,12 @@
 #define MLXPLAT_CPLD_LPC_REG_TACHO4_OFFSET	0xe7
 #define MLXPLAT_CPLD_LPC_REG_TACHO5_OFFSET	0xe8
 #define MLXPLAT_CPLD_LPC_REG_TACHO6_OFFSET	0xe9
-#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET	0xea
-#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET	0xeb
-#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET	0xec
-#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET	0xed
-#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET	0xee
-#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET	0xef
+#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET	0xeb
+#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET	0xec
+#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET	0xed
+#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET	0xee
+#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET	0xef
+#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET	0xf0
 #define MLXPLAT_CPLD_LPC_IO_RANGE		0x100
 #define MLXPLAT_CPLD_LPC_I2C_CH1_OFF		0xdb
 #define MLXPLAT_CPLD_LPC_I2C_CH2_OFF		0xda
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 148/352] cpuidle: big.LITTLE: fix refcount leak
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 147/352] platform/x86: mlx-platform: Fix tachometer registers Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 149/352] OPP: Use opp_table->regulators to verify no regulator case Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Daniel Lezcano,
	Rafael J. Wysocki, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9456823c842f346c74265fcd98d008d87a7eb6f5 ]

of_find_node_by_path() acquires a reference to the node
returned by it and that reference needs to be dropped by its caller.
bl_idle_init() doesn't do that, so fix it.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpuidle/cpuidle-big_little.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c
index db2ede565f1a..b44476a1b7ad 100644
--- a/drivers/cpuidle/cpuidle-big_little.c
+++ b/drivers/cpuidle/cpuidle-big_little.c
@@ -167,6 +167,7 @@ static int __init bl_idle_init(void)
 {
 	int ret;
 	struct device_node *root = of_find_node_by_path("/");
+	const struct of_device_id *match_id;
 
 	if (!root)
 		return -ENODEV;
@@ -174,7 +175,11 @@ static int __init bl_idle_init(void)
 	/*
 	 * Initialize the driver just for a compliant set of machines
 	 */
-	if (!of_match_node(compatible_machine_match, root))
+	match_id = of_match_node(compatible_machine_match, root);
+
+	of_node_put(root);
+
+	if (!match_id)
 		return -ENODEV;
 
 	if (!mcpm_is_available())
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 149/352] OPP: Use opp_table->regulators to verify no regulator case
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 148/352] cpuidle: big.LITTLE: fix refcount leak Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 150/352] tee: optee: avoid possible double list_del() Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Perret, Viresh Kumar, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 90e3577b5feb42bac1269e16bb3d2bdd8f6df40f ]

The value of opp_table->regulator_count is not very consistent right now
and it may end up being 0 while we do have a "opp-microvolt" property in
the OPP table. It was kept that way as we used to check if any
regulators are set with the OPP core for a device or not using value of
regulator_count.

Lets use opp_table->regulators for that purpose as the meaning of
regulator_count is going to change in the later patches.

Reported-by: Quentin Perret <quentin.perret@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/core.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 9280f51f1ce6..82baed4b80d4 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -196,12 +196,12 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev)
 	if (IS_ERR(opp_table))
 		return 0;
 
-	count = opp_table->regulator_count;
-
 	/* Regulator may not be required for the device */
-	if (!count)
+	if (!opp_table->regulators)
 		goto put_opp_table;
 
+	count = opp_table->regulator_count;
+
 	uV = kmalloc_array(count, sizeof(*uV), GFP_KERNEL);
 	if (!uV)
 		goto put_opp_table;
@@ -1102,6 +1102,9 @@ static bool _opp_supported_by_regulators(struct dev_pm_opp *opp,
 	struct regulator *reg;
 	int i;
 
+	if (!opp_table->regulators)
+		return true;
+
 	for (i = 0; i < opp_table->regulator_count; i++) {
 		reg = opp_table->regulators[i];
 
@@ -1386,7 +1389,7 @@ static int _allocate_set_opp_data(struct opp_table *opp_table)
 	struct dev_pm_set_opp_data *data;
 	int len, count = opp_table->regulator_count;
 
-	if (WARN_ON(!count))
+	if (WARN_ON(!opp_table->regulators))
 		return -EINVAL;
 
 	/* space for set_opp_data */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 150/352] tee: optee: avoid possible double list_del()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 149/352] OPP: Use opp_table->regulators to verify no regulator case Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 151/352] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhizhou Zhang, Jens Wiklander, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b2d102bd0146d9eb1fa630ca0cd19a15ef2f74c8 ]

This bug occurs when:

- a new request arrives, one thread(let's call it A) is pending in
  optee_supp_req() with req->busy is initial value false.

- tee-supplicant is killed, then optee_supp_release() is called, this
  function calls list_del(&req->link), and set supp->ctx to NULL. And
  it also wake up process A.

- process A continues, it firstly checks supp->ctx which is NULL,
  then checks req->busy which is false, at last run list_del(&req->link).
  This triggers double list_del() and results kernel panic.

For solve this problem, we rename req->busy to req->in_queue, and
associate it with state of whether req is linked to supp->reqs. So we
can just only check req->in_queue to make decision calling list_del()
or not.

Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tee/optee/supp.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c
index df35fc01fd3e..43626e15703a 100644
--- a/drivers/tee/optee/supp.c
+++ b/drivers/tee/optee/supp.c
@@ -19,7 +19,7 @@
 struct optee_supp_req {
 	struct list_head link;
 
-	bool busy;
+	bool in_queue;
 	u32 func;
 	u32 ret;
 	size_t num_params;
@@ -54,7 +54,6 @@ void optee_supp_release(struct optee_supp *supp)
 
 	/* Abort all request retrieved by supplicant */
 	idr_for_each_entry(&supp->idr, req, id) {
-		req->busy = false;
 		idr_remove(&supp->idr, id);
 		req->ret = TEEC_ERROR_COMMUNICATION;
 		complete(&req->c);
@@ -63,6 +62,7 @@ void optee_supp_release(struct optee_supp *supp)
 	/* Abort all queued requests */
 	list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
 		list_del(&req->link);
+		req->in_queue = false;
 		req->ret = TEEC_ERROR_COMMUNICATION;
 		complete(&req->c);
 	}
@@ -103,6 +103,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
 	/* Insert the request in the request list */
 	mutex_lock(&supp->mutex);
 	list_add_tail(&req->link, &supp->reqs);
+	req->in_queue = true;
 	mutex_unlock(&supp->mutex);
 
 	/* Tell an eventual waiter there's a new request */
@@ -130,9 +131,10 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
 			 * will serve all requests in a timely manner and
 			 * interrupting then wouldn't make sense.
 			 */
-			interruptable = !req->busy;
-			if (!req->busy)
+			if (req->in_queue) {
 				list_del(&req->link);
+				req->in_queue = false;
+			}
 		}
 		mutex_unlock(&supp->mutex);
 
@@ -176,7 +178,7 @@ static struct optee_supp_req  *supp_pop_entry(struct optee_supp *supp,
 		return ERR_PTR(-ENOMEM);
 
 	list_del(&req->link);
-	req->busy = true;
+	req->in_queue = false;
 
 	return req;
 }
@@ -318,7 +320,6 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
 	if ((num_params - nm) != req->num_params)
 		return ERR_PTR(-EINVAL);
 
-	req->busy = false;
 	idr_remove(&supp->idr, id);
 	supp->req_id = -1;
 	*num_meta = nm;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 151/352] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 150/352] tee: optee: avoid possible double list_del() Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 152/352] drm/msm: dpu: Only check flush register against pending flushes Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Paul, Abhinav Kumar, Rob Clark,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c1866d44d149a1ea5c303632114fb6aa08cfd263 ]

Fix the dsi clock names in the DSI 10nm PLL driver to
match the names in the dispcc driver as those are
according to the clock plan of the chipset.

Changes in v2:
- Update the clock diagram with the new clock name

Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index 41bec570c518..31205625c734 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -17,7 +17,7 @@
  *                              |                |
  *                              |                |
  *                 +---------+  |  +----------+  |  +----+
- *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0pllbyte
+ *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk
  *                 +---------+  |  +----------+  |  +----+
  *                              |                |
  *                              |                |         dsi0_pll_by_2_bit_clk
@@ -25,7 +25,7 @@
  *                              |                |  +----+  |  |\  dsi0_pclk_mux
  *                              |                |--| /2 |--o--| \   |
  *                              |                |  +----+     |  \  |  +---------+
- *                              |                --------------|  |--o--| div_7_4 |-- dsi0pll
+ *                              |                --------------|  |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk
  *                              |------------------------------|  /     +---------+
  *                              |          +-----+             | /
  *                              -----------| /4? |--o----------|/
@@ -690,7 +690,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
 
 	hws[num++] = hw;
 
-	snprintf(clk_name, 32, "dsi%dpllbyte", pll_10nm->id);
+	snprintf(clk_name, 32, "dsi%d_phy_pll_out_byteclk", pll_10nm->id);
 	snprintf(parent, 32, "dsi%d_pll_bit_clk", pll_10nm->id);
 
 	/* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */
@@ -739,7 +739,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
 
 	hws[num++] = hw;
 
-	snprintf(clk_name, 32, "dsi%dpll", pll_10nm->id);
+	snprintf(clk_name, 32, "dsi%d_phy_pll_out_dsiclk", pll_10nm->id);
 	snprintf(parent, 32, "dsi%d_pclk_mux", pll_10nm->id);
 
 	/* PIX CLK DIV : DIV_CTRL_7_4*/
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 152/352] drm/msm: dpu: Only check flush register against pending flushes
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 151/352] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 153/352] lightnvm: pblk: fix resubmission of overwritten write err lbas Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeykumar Sankaran, Sean Paul,
	Rob Clark, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5f79e03b1f7c1b2cf0019ce6365fe5d52629813d ]

There exists a case where a flush of a plane/dma may have been triggered
& started from an async commit. If that plane/dma is subsequently disabled
by the next commit, the flush register will continue to hold the flush
bit for the disabled plane. Since the bit remains active,
pending_kickoff_cnt will never decrement and we'll miss frame_done
events.

This patch limits the check of flush_register to include only those bits
which have been updated with the latest commit.

Changes in v2:
- None

Reviewed-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
index 84de385a9f62..60f146f02b77 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
@@ -331,7 +331,7 @@ static void dpu_encoder_phys_vid_vblank_irq(void *arg, int irq_idx)
 	if (hw_ctl && hw_ctl->ops.get_flush_register)
 		flush_register = hw_ctl->ops.get_flush_register(hw_ctl);
 
-	if (flush_register == 0)
+	if (!(flush_register & hw_ctl->ops.get_pending_flush(hw_ctl)))
 		new_cnt = atomic_add_unless(&phys_enc->pending_kickoff_cnt,
 				-1, 0);
 	spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 153/352] lightnvm: pblk: fix resubmission of overwritten write err lbas
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 152/352] drm/msm: dpu: Only check flush register against pending flushes Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 154/352] lightnvm: pblk: add lock protection to list operations Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Holmberg, Javier González,
	Matias Bjørling, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c12fa401ac8c94a74aff68bb5736b3f1dc695fa8 ]

Make sure we only look up valid lba addresses on the resubmission path.

If an lba is invalidated in the write buffer, that sector will be
submitted to disk (as it is already mapped to a ppa), and that write
might fail, resulting in a crash when trying to look up the lba in the
mapping table (as the lba is marked as invalid).

Signed-off-by: Hans Holmberg <hans.holmberg@cnexlabs.com>
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/pblk-write.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c
index fa8726493b39..3ddd16f47106 100644
--- a/drivers/lightnvm/pblk-write.c
+++ b/drivers/lightnvm/pblk-write.c
@@ -148,9 +148,11 @@ static void pblk_prepare_resubmit(struct pblk *pblk, unsigned int sentry,
 		w_ctx = &entry->w_ctx;
 
 		/* Check if the lba has been overwritten */
-		ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
-		if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
-			w_ctx->lba = ADDR_EMPTY;
+		if (w_ctx->lba != ADDR_EMPTY) {
+			ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
+			if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
+				w_ctx->lba = ADDR_EMPTY;
+		}
 
 		/* Mark up the entry as submittable again */
 		flags = READ_ONCE(w_ctx->flags);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 154/352] lightnvm: pblk: add lock protection to list operations
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 153/352] lightnvm: pblk: fix resubmission of overwritten write err lbas Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 155/352] i2c-axxia: check for error conditions first Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hua Su, Javier González,
	Matias Bjørling, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit fde201a466c6ad5efd72cb54fdf2cefa8b6c6ad7 ]

Protect the list_add on the pblk_line_init_bb() error
path in case this code is used for some other purpose
in the future.

Signed-off-by: Hua Su <suhua.tanke@gmail.com>
Reviewed-by: Javier González <javier@cnexlabs.com>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/pblk-core.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
index 6944aac43b01..247112e1db94 100644
--- a/drivers/lightnvm/pblk-core.c
+++ b/drivers/lightnvm/pblk-core.c
@@ -1295,15 +1295,22 @@ int pblk_line_recov_alloc(struct pblk *pblk, struct pblk_line *line)
 
 	ret = pblk_line_alloc_bitmaps(pblk, line);
 	if (ret)
-		return ret;
+		goto fail;
 
 	if (!pblk_line_init_bb(pblk, line, 0)) {
-		list_add(&line->list, &l_mg->free_list);
-		return -EINTR;
+		ret = -EINTR;
+		goto fail;
 	}
 
 	pblk_rl_free_lines_dec(&pblk->rl, line, true);
 	return 0;
+
+fail:
+	spin_lock(&l_mg->free_lock);
+	list_add(&line->list, &l_mg->free_list);
+	spin_unlock(&l_mg->free_lock);
+
+	return ret;
 }
 
 void pblk_line_recov_close(struct pblk *pblk, struct pblk_line *line)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 155/352] i2c-axxia: check for error conditions first
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 154/352] lightnvm: pblk: add lock protection to list operations Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 156/352] lightnvm: Fix uninitialized return value in nvm_get_chunk_meta() Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Adamski,
	Alexander Sverdlin, Wolfram Sang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f5c85fe3a60ace555d09898166af372547f97fc ]

It was observed that when using seqentional mode contrary to the
documentation, the SS bit (which is supposed to only be set if
automatic/sequence command completed normally), is sometimes set
together with NA (NAK in address phase) causing transfer to falsely be
considered successful.

My assumption is that this does not happen during manual mode since the
controller is stopping its work the moment it sets NA/ND bit in status
register. This is not the case in Automatic/Sequentional mode where it
is still working to send STOP condition and the actual status we get
depends on the time when the ISR is run.

This patch changes the order of checking status bits in ISR - error
conditions are checked first and only if none of them occurred, the
transfer may be considered successful. This is required to introduce
using of sequentional mode in next patch.

Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-axxia.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
index 51d34959709b..fb5bac079e83 100644
--- a/drivers/i2c/busses/i2c-axxia.c
+++ b/drivers/i2c/busses/i2c-axxia.c
@@ -296,22 +296,7 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
 			i2c_int_disable(idev, MST_STATUS_TFL);
 	}
 
-	if (status & MST_STATUS_SCC) {
-		/* Stop completed */
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		complete(&idev->msg_complete);
-	} else if (status & MST_STATUS_SNS) {
-		/* Transfer done */
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
-			axxia_i2c_empty_rx_fifo(idev);
-		complete(&idev->msg_complete);
-	} else if (status & MST_STATUS_TSS) {
-		/* Transfer timeout */
-		idev->msg_err = -ETIMEDOUT;
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		complete(&idev->msg_complete);
-	} else if (unlikely(status & MST_STATUS_ERR)) {
+	if (unlikely(status & MST_STATUS_ERR)) {
 		/* Transfer error */
 		i2c_int_disable(idev, ~0);
 		if (status & MST_STATUS_AL)
@@ -328,6 +313,21 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
 			readl(idev->base + MST_TX_BYTES_XFRD),
 			readl(idev->base + MST_TX_XFER));
 		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_SCC) {
+		/* Stop completed */
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_SNS) {
+		/* Transfer done */
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+			axxia_i2c_empty_rx_fifo(idev);
+		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_TSS) {
+		/* Transfer timeout */
+		idev->msg_err = -ETIMEDOUT;
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		complete(&idev->msg_complete);
 	}
 
 out:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 156/352] lightnvm: Fix uninitialized return value in nvm_get_chunk_meta()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 155/352] i2c-axxia: check for error conditions first Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 157/352] phy: sun4i-usb: add support for missing USB PHY index Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
	Matias Bjørling, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 55e58c5e78aad9d3246f57e7718cf5ee7adde9e3 ]

With gcc 4.1:

    drivers/lightnvm/core.c: In function ‘nvm_get_bb_meta’:
    drivers/lightnvm/core.c:977: warning: ‘ret’ may be used uninitialized in this function

and

    drivers/nvme/host/lightnvm.c: In function ‘nvme_nvm_get_chk_meta’:
    drivers/nvme/host/lightnvm.c:580: warning: ‘ret’ may be used uninitialized in this function

Indeed, if (for the former) the number of channels or LUNs is zero, or
(for both) the passed number of chunks is zero, ret will be returned
uninitialized.

Fix this by preinitializing ret to zero.

Fixes: aff3fb18f957de93 ("lightnvm: move bad block and chunk state logic to core")
Fixes: a294c199455187d1 ("lightnvm: implement get log report chunk helpers")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/core.c      | 2 +-
 drivers/nvme/host/lightnvm.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index efb976a863d2..73ab3cf26868 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -974,7 +974,7 @@ static int nvm_get_bb_meta(struct nvm_dev *dev, sector_t slba,
 	struct ppa_addr ppa;
 	u8 *blks;
 	int ch, lun, nr_blks;
-	int ret;
+	int ret = 0;
 
 	ppa.ppa = slba;
 	ppa = dev_to_generic_addr(dev, ppa);
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index a4f3b263cd6c..d64805dc8efb 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -577,7 +577,8 @@ static int nvme_nvm_get_chk_meta(struct nvm_dev *ndev,
 	struct ppa_addr ppa;
 	size_t left = nchks * sizeof(struct nvme_nvm_chk_meta);
 	size_t log_pos, offset, len;
-	int ret, i, max_len;
+	int i, max_len;
+	int ret = 0;
 
 	/*
 	 * limit requests to maximum 256K to avoid issuing arbitrary large
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 157/352] phy: sun4i-usb: add support for missing USB PHY index
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 156/352] lightnvm: Fix uninitialized return value in nvm_get_chunk_meta() Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 158/352] mlxsw: spectrum_acl: Limit priority value Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Icenowy Zheng, Chen-Yu Tsai,
	Kishon Vijay Abraham I, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2659392e5c08dff626e6db1d739adff58a94604d ]

The new Allwinner H6 SoC's USB2 PHY has two holes -- USB1 (which is a
3.0 port with dedicated PHY) and USB2 (which doesn't exist at all).

Add support for this kind of missing USB PHY index.

Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/allwinner/phy-sun4i-usb.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
index d4dcd39b8d76..881078ff73f6 100644
--- a/drivers/phy/allwinner/phy-sun4i-usb.c
+++ b/drivers/phy/allwinner/phy-sun4i-usb.c
@@ -126,6 +126,7 @@ struct sun4i_usb_phy_cfg {
 	bool dedicated_clocks;
 	bool enable_pmu_unk1;
 	bool phy0_dual_route;
+	int missing_phys;
 };
 
 struct sun4i_usb_phy_data {
@@ -646,6 +647,9 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
 	if (args->args[0] >= data->cfg->num_phys)
 		return ERR_PTR(-ENODEV);
 
+	if (data->cfg->missing_phys & BIT(args->args[0]))
+		return ERR_PTR(-ENODEV);
+
 	return data->phys[args->args[0]].phy;
 }
 
@@ -741,6 +745,9 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
 		struct sun4i_usb_phy *phy = data->phys + i;
 		char name[16];
 
+		if (data->cfg->missing_phys & BIT(i))
+			continue;
+
 		snprintf(name, sizeof(name), "usb%d_vbus", i);
 		phy->vbus = devm_regulator_get_optional(dev, name);
 		if (IS_ERR(phy->vbus)) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 158/352] mlxsw: spectrum_acl: Limit priority value
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 157/352] phy: sun4i-usb: add support for missing USB PHY index Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 159/352] udf: Fix BUG on corrupted inode Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nir Dotan, Jiri Pirko, Ido Schimmel,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d7263ab35be25505ab57ebecd93cbc5dba8be717 ]

In Spectrum-2, higher priority value wins and priority valid values are in
the range of {1,cap_kvd_size-1}. mlxsw_sp_acl_tcam_priority_get converts
from lower-bound priorities alike tc flower to Spectrum-2 HW range. Up
until now tc flower did not provide priority 0 or reached the maximal
value, however multicast routing does provide priority 0.

Therefore, Change mlxsw_sp_acl_tcam_priority_get to verify priority is in
the correct range. Make sure priority is never set to zero and never
exceeds the maximal allowed value.

Signed-off-by: Nir Dotan <nird@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index e171513bb32a..30931a2c025b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -95,8 +95,9 @@ int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
 	if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, KVD_SIZE))
 		return -EIO;
 
-	max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE);
-	if (rulei->priority > max_priority)
+	/* Priority range is 1..cap_kvd_size-1. */
+	max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE) - 1;
+	if (rulei->priority >= max_priority)
 		return -EINVAL;
 
 	/* Unlike in TC, in HW, higher number means higher priority. */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 159/352] udf: Fix BUG on corrupted inode
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 158/352] mlxsw: spectrum_acl: Limit priority value Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 160/352] switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, Jan Kara, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ]

When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 5df554a9f9c9..ae796e10f68b 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1357,6 +1357,12 @@ reread:
 
 	iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
 							ICBTAG_FLAG_AD_MASK;
+	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+		ret = -EIO;
+		goto out;
+	}
 	iinfo->i_unique = 0;
 	iinfo->i_lenEAttr = 0;
 	iinfo->i_lenExtents = 0;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 160/352] switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 159/352] udf: Fix BUG on corrupted inode Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 161/352] selftests/bpf: use __bpf_constant_htons in test_prog.c Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joey Zhang, Wesley Sheng,
	Bjorn Helgaas, Logan Gunthorpe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e4a7dca5de625018b29417ecc39dc5037d9a5a36 ]

In the ioctl_event_ctl() SWITCHTEC_IOCTL_EVENT_IDX_ALL case, we call
event_ctl() several times with the same "ctl" struct.  Each call clobbers
ctl.flags, which leads to the problem that we may not actually enable or
disable all events as the user requested.

Preserve the event flag value with a temporary variable.

Fixes: 52eabba5bcdb ("switchtec: Add IOCTLs to the Switchtec driver")
Signed-off-by: Joey Zhang <joey.zhang@microchip.com>
Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/switch/switchtec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 54a8b30dda38..37d0c15c9eeb 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -800,6 +800,7 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
 {
 	int ret;
 	int nr_idxs;
+	unsigned int event_flags;
 	struct switchtec_ioctl_event_ctl ctl;
 
 	if (copy_from_user(&ctl, uctl, sizeof(ctl)))
@@ -821,7 +822,9 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
 		else
 			return -EINVAL;
 
+		event_flags = ctl.flags;
 		for (ctl.index = 0; ctl.index < nr_idxs; ctl.index++) {
+			ctl.flags = event_flags;
 			ret = event_ctl(stdev, &ctl);
 			if (ret < 0)
 				return ret;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 161/352] selftests/bpf: use __bpf_constant_htons in test_prog.c
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 160/352] switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 162/352] ARM: pxa: avoid section mismatch warning Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stanislav Fomichev, Daniel Borkmann,
	Alexei Starovoitov, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a0517a0f7ef23550b4484c37e2b9c2d32abebf64 ]

For some reason, my older GCC (< 4.8) isn't smart enough to optimize the
!__builtin_constant_p() branch in bpf_htons, I see:
  error: implicit declaration of function '__builtin_bswap16'

Let's use __bpf_constant_htons as suggested by Daniel Borkmann.

I tried to use simple htons, but it produces the following:
  test_progs.c:54:17: error: braced-group within expression allowed only
  inside a function
    .eth.h_proto = htons(ETH_P_IP),

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_progs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 2d3c04f45530..6ac7232b0fde 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -51,10 +51,10 @@ static struct {
 	struct iphdr iph;
 	struct tcphdr tcp;
 } __packed pkt_v4 = {
-	.eth.h_proto = bpf_htons(ETH_P_IP),
+	.eth.h_proto = __bpf_constant_htons(ETH_P_IP),
 	.iph.ihl = 5,
 	.iph.protocol = 6,
-	.iph.tot_len = bpf_htons(MAGIC_BYTES),
+	.iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
 	.tcp.urg_ptr = 123,
 };
 
@@ -64,9 +64,9 @@ static struct {
 	struct ipv6hdr iph;
 	struct tcphdr tcp;
 } __packed pkt_v6 = {
-	.eth.h_proto = bpf_htons(ETH_P_IPV6),
+	.eth.h_proto = __bpf_constant_htons(ETH_P_IPV6),
 	.iph.nexthdr = 6,
-	.iph.payload_len = bpf_htons(MAGIC_BYTES),
+	.iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
 	.tcp.urg_ptr = 123,
 };
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 162/352] ARM: pxa: avoid section mismatch warning
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 161/352] selftests/bpf: use __bpf_constant_htons in test_prog.c Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 163/352] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Olof Johansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 88af3209aa0881aa5ffd99664b6080a4be5f24e5 ]

WARNING: vmlinux.o(.text+0x19f90): Section mismatch in reference from the function littleton_init_lcd() to the function .init.text:pxa_set_fb_info()
The function littleton_init_lcd() references
the function __init pxa_set_fb_info().
This is often because littleton_init_lcd lacks a __init
annotation or the annotation of pxa_set_fb_info is wrong.

WARNING: vmlinux.o(.text+0xf824): Section mismatch in reference from the function zeus_register_ohci() to the function .init.text:pxa_set_ohci_info()
The function zeus_register_ohci() references
the function __init pxa_set_ohci_info().
This is often because zeus_register_ohci lacks a __init
annotation or the annotation of pxa_set_ohci_info is wrong.

WARNING: vmlinux.o(.text+0xf95c): Section mismatch in reference from the function cm_x300_init_u2d() to the function .init.text:pxa3xx_set_u2d_info()
The function cm_x300_init_u2d() references
the function __init pxa3xx_set_u2d_info().
This is often because cm_x300_init_u2d lacks a __init
annotation or the annotation of pxa3xx_set_u2d_info is wrong.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-pxa/cm-x300.c   | 2 +-
 arch/arm/mach-pxa/littleton.c | 2 +-
 arch/arm/mach-pxa/zeus.c      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
index c5c0ab8ac9f9..024c1fbcc55a 100644
--- a/arch/arm/mach-pxa/cm-x300.c
+++ b/arch/arm/mach-pxa/cm-x300.c
@@ -558,7 +558,7 @@ static struct pxa3xx_u2d_platform_data cm_x300_u2d_platform_data = {
 	.exit		= cm_x300_u2d_exit,
 };
 
-static void cm_x300_init_u2d(void)
+static void __init cm_x300_init_u2d(void)
 {
 	pxa3xx_set_u2d_info(&cm_x300_u2d_platform_data);
 }
diff --git a/arch/arm/mach-pxa/littleton.c b/arch/arm/mach-pxa/littleton.c
index 9e132b3e48c6..9960ea158829 100644
--- a/arch/arm/mach-pxa/littleton.c
+++ b/arch/arm/mach-pxa/littleton.c
@@ -184,7 +184,7 @@ static struct pxafb_mach_info littleton_lcd_info = {
 	.lcd_conn		= LCD_COLOR_TFT_16BPP,
 };
 
-static void littleton_init_lcd(void)
+static void __init littleton_init_lcd(void)
 {
 	pxa_set_fb_info(NULL, &littleton_lcd_info);
 }
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index d53ea12fc766..54a32f0433a2 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -576,7 +576,7 @@ static struct pxaohci_platform_data zeus_ohci_platform_data = {
 	.flags		= ENABLE_PORT_ALL | POWER_SENSE_LOW,
 };
 
-static void zeus_register_ohci(void)
+static void __init zeus_register_ohci(void)
 {
 	/* Port 2 is shared between host and client interface. */
 	UP2OCR = UP2OCR_HXOE | UP2OCR_HXS | UP2OCR_DMPDE | UP2OCR_DPPDE;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 163/352] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 162/352] ARM: pxa: avoid section mismatch warning Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 164/352] ARM: mmp: fix timer_init calls Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Fabio Estevam,
	Shawn Guo, Mark Brown, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit add6883619a9e3bf9658eaff1a547354131bbcd9 ]

eukrea-tlv320.c machine driver runs on non-DT platforms
and include <asm/mach-types.h> header file in order to be able
to use some machine_is_eukrea_xxx() macros.

Building it for ARM64 causes the following build error:

sound/soc/fsl/eukrea-tlv320.c:28:10: fatal error: asm/mach-types.h: No such file or directory

Avoid this error by not allowing to build the SND_SOC_EUKREA_TLV320
driver when ARM64 is selected.

This is needed in preparation for the i.MX8M support.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
index 6ec19fb4a934..2e75b5bc5f1d 100644
--- a/sound/soc/fsl/Kconfig
+++ b/sound/soc/fsl/Kconfig
@@ -221,7 +221,7 @@ config SND_SOC_PHYCORE_AC97
 
 config SND_SOC_EUKREA_TLV320
 	tristate "Eukrea TLV320"
-	depends on ARCH_MXC && I2C
+	depends on ARCH_MXC && !ARM64 && I2C
 	select SND_SOC_TLV320AIC23_I2C
 	select SND_SOC_IMX_AUDMUX
 	select SND_SOC_IMX_SSI
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 164/352] ARM: mmp: fix timer_init calls
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 163/352] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 165/352] fix dma-buf/udmabuf selftest Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Olof Johansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 12d3a30db4a3b3df5fbadf5974b9cf50544a9950 ]

The change to passing the timer frequency as a function argument
was a good idea, but caused a build failure for one user that
was missed in the update:

arch/arm/mach-mmp/time.c: In function 'mmp_dt_init_timer':
arch/arm/mach-mmp/time.c:242:2: error: implicit declaration of function 'timer_init'; did you mean 'hrtimer_init'? [-Werror=implicit-function-declaration]

Change that as well to fix the build error, and rename the
function to put it into a proper namespace and make it clearer
what is actually going on.

I saw that the high 6500000 HZ frequency was previously only
set with CONFIG_MMP2, but is now also used with MMP (pxa910),
so I'm changing that back here. Please make sure that the
frequencies are all correct now.

Fixes: f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-mmp/common.h | 2 +-
 arch/arm/mach-mmp/mmp2.c   | 2 +-
 arch/arm/mach-mmp/pxa168.c | 2 +-
 arch/arm/mach-mmp/pxa910.c | 2 +-
 arch/arm/mach-mmp/time.c   | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm/mach-mmp/common.h b/arch/arm/mach-mmp/common.h
index 5ac2851ef5d3..483b8b6d3005 100644
--- a/arch/arm/mach-mmp/common.h
+++ b/arch/arm/mach-mmp/common.h
@@ -2,7 +2,7 @@
 #include <linux/reboot.h>
 #define ARRAY_AND_SIZE(x)	(x), ARRAY_SIZE(x)
 
-extern void timer_init(int irq, unsigned long rate);
+extern void mmp_timer_init(int irq, unsigned long rate);
 
 extern void __init mmp_map_io(void);
 extern void mmp_restart(enum reboot_mode, const char *);
diff --git a/arch/arm/mach-mmp/mmp2.c b/arch/arm/mach-mmp/mmp2.c
index fb3e7e32c882..726c1a642dea 100644
--- a/arch/arm/mach-mmp/mmp2.c
+++ b/arch/arm/mach-mmp/mmp2.c
@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void)
 	clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1);
 	__raw_writel(clk_rst, APBC_TIMERS);
 
-	timer_init(IRQ_MMP2_TIMER1, 6500000);
+	mmp_timer_init(IRQ_MMP2_TIMER1, 6500000);
 }
 
 /* on-chip devices */
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 77a358165a56..cdcf65ace3f9 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void)
 	/* 3.25MHz, bus/functional clock enabled, release reset */
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA168_TIMER1, 6500000);
+	mmp_timer_init(IRQ_PXA168_TIMER1, 3250000);
 }
 
 void pxa168_clear_keypad_wakeup(void)
diff --git a/arch/arm/mach-mmp/pxa910.c b/arch/arm/mach-mmp/pxa910.c
index 1ccbba9ac495..d30a7d12bc98 100644
--- a/arch/arm/mach-mmp/pxa910.c
+++ b/arch/arm/mach-mmp/pxa910.c
@@ -116,7 +116,7 @@ void __init pxa910_timer_init(void)
 	__raw_writel(APBC_APBCLK | APBC_RST, APBC_TIMERS);
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA910_AP1_TIMER1);
+	mmp_timer_init(IRQ_PXA910_AP1_TIMER1, 3250000);
 }
 
 /* on-chip devices */
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index eab0fd8a7343..f9c295154b94 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -184,7 +184,7 @@ static struct irqaction timer_irq = {
 	.dev_id		= &ckevt,
 };
 
-void __init timer_init(int irq, unsigned long rate)
+void __init mmp_timer_init(int irq, unsigned long rate)
 {
 	timer_config();
 
@@ -239,7 +239,7 @@ void __init mmp_dt_init_timer(void)
 		ret = -ENOMEM;
 		goto out;
 	}
-	timer_init(irq, rate);
+	mmp_timer_init(irq, rate);
 	return;
 out:
 	pr_err("Failed to get timer from device tree with error:%d\n", ret);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 165/352] fix dma-buf/udmabuf selftest
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 164/352] ARM: mmp: fix timer_init calls Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 166/352] clk: qcom: Leave mmss noc on for 8998 Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Murphy, Gerd Hoffmann,
	Shuah Khan, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6edf2e3710f4ef2555ad7a2681dbeb4a69092b2d ]

This patch fixes the udmabuf selftest. Currently the selftest is broken.
I fixed the selftest by setting the F_SEAL_SHRINK seal on the memfd
file descriptor which is required by udmabuf and added the test to
the selftest Makefile.

Signed-off-by: Tom Murphy <murphyt7@tcd.ie>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Shuah Khan <shuah@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/Makefile                  |  1 +
 tools/testing/selftests/drivers/dma-buf/Makefile  |  2 ++
 tools/testing/selftests/drivers/dma-buf/udmabuf.c | 11 +++++++++--
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index f0017c831e57..a43a07a09a98 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -6,6 +6,7 @@ TARGETS += capabilities
 TARGETS += cgroup
 TARGETS += cpufreq
 TARGETS += cpu-hotplug
+TARGETS += drivers/dma-buf
 TARGETS += efivarfs
 TARGETS += exec
 TARGETS += filesystems
diff --git a/tools/testing/selftests/drivers/dma-buf/Makefile b/tools/testing/selftests/drivers/dma-buf/Makefile
index 4154c3d7aa58..f22c3f7cf612 100644
--- a/tools/testing/selftests/drivers/dma-buf/Makefile
+++ b/tools/testing/selftests/drivers/dma-buf/Makefile
@@ -2,4 +2,6 @@ CFLAGS += -I../../../../../usr/include/
 
 TEST_GEN_PROGS := udmabuf
 
+top_srcdir ?=../../../../..
+
 include ../../lib.mk
diff --git a/tools/testing/selftests/drivers/dma-buf/udmabuf.c b/tools/testing/selftests/drivers/dma-buf/udmabuf.c
index 376b1d6730bd..4de902ea14d8 100644
--- a/tools/testing/selftests/drivers/dma-buf/udmabuf.c
+++ b/tools/testing/selftests/drivers/dma-buf/udmabuf.c
@@ -4,7 +4,7 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
-#include <fcntl.h>
+#include <linux/fcntl.h>
 #include <malloc.h>
 
 #include <sys/ioctl.h>
@@ -33,12 +33,19 @@ int main(int argc, char *argv[])
 		exit(77);
 	}
 
-	memfd = memfd_create("udmabuf-test", MFD_CLOEXEC);
+	memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
 	if (memfd < 0) {
 		printf("%s: [skip,no-memfd]\n", TEST_PREFIX);
 		exit(77);
 	}
 
+	ret = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK);
+	if (ret < 0) {
+		printf("%s: [skip,fcntl-add-seals]\n", TEST_PREFIX);
+		exit(77);
+	}
+
+
 	size = getpagesize() * NUM_PAGES;
 	ret = ftruncate(memfd, size);
 	if (ret == -1) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 166/352] clk: qcom: Leave mmss noc on for 8998
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 165/352] fix dma-buf/udmabuf selftest Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 167/352] f2fs: fix to reorder set_page_dirty and wait_on_page_writeback Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeffrey Hugo, Stephen Boyd, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 12eced09cd301aa7b1868a67c50a651c2aacd363 ]

Similar to other qcom targets, gcc_mmss_noc_cfg_ahb_clk should not be
disabled.  Any mmss access depends on this clock, and its been observed
that enabling mmssnoc_axi_rpm_clk with rpmcc results in an implicit
access to mmss and will crash the system if gcc_mmss_noc_cfg_ahb_clk is
disabled.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Fixes: 4807c71cc688 (arm64: dts: Add msm8998 SoC and MTP board support)
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-msm8998.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
index 9f0ae403d5f5..cb714c3e2924 100644
--- a/drivers/clk/qcom/gcc-msm8998.c
+++ b/drivers/clk/qcom/gcc-msm8998.c
@@ -2042,6 +2042,12 @@ static struct clk_branch gcc_mmss_noc_cfg_ahb_clk = {
 		.hw.init = &(struct clk_init_data){
 			.name = "gcc_mmss_noc_cfg_ahb_clk",
 			.ops = &clk_branch2_ops,
+			/*
+			 * Any access to mmss depends on this clock.
+			 * Gating this clock has been shown to crash the system
+			 * when mmssnoc_axi_rpm_clk is inited in rpmcc.
+			 */
+			.flags = CLK_IS_CRITICAL,
 		},
 	},
 };
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 167/352] f2fs: fix to reorder set_page_dirty and wait_on_page_writeback
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 166/352] clk: qcom: Leave mmss noc on for 8998 Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 168/352] ipv6: Fix handling of LLA with VRF and sockets bound to VRF Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8d64d365aed355b2e2465d19ba61df02462fff4d ]

This patch reorders flow from

- update page
- set_page_dirty
- wait_on_page_writeback

to

- wait_on_page_writeback
- update page
- set_page_dirty

The reason is:
- set_page_dirty will increase reference of dirty page, the reference
should be cleared before wait_on_page_writeback to keep its consistency.
- some devices need stable page during page writebacking, so we
should not change page's data.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/checkpoint.c | 7 ++++---
 fs/f2fs/gc.c         | 5 +++--
 fs/f2fs/node.c       | 5 +++--
 fs/f2fs/segment.c    | 3 ++-
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 9c28ea439e0b..e5719fcac47d 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1290,11 +1290,12 @@ static void commit_checkpoint(struct f2fs_sb_info *sbi,
 	struct page *page = f2fs_grab_meta_page(sbi, blk_addr);
 	int err;
 
-	memcpy(page_address(page), src, PAGE_SIZE);
-	set_page_dirty(page);
-
 	f2fs_wait_on_page_writeback(page, META, true);
 	f2fs_bug_on(sbi, PageWriteback(page));
+
+	memcpy(page_address(page), src, PAGE_SIZE);
+
+	set_page_dirty(page);
 	if (unlikely(!clear_page_dirty_for_io(page)))
 		f2fs_bug_on(sbi, 1);
 
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index c96e7c6354ef..74f72dccab57 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -812,8 +812,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
 	}
 
 write_page:
-	set_page_dirty(fio.encrypted_page);
 	f2fs_wait_on_page_writeback(fio.encrypted_page, DATA, true);
+	set_page_dirty(fio.encrypted_page);
 	if (clear_page_dirty_for_io(fio.encrypted_page))
 		dec_page_count(fio.sbi, F2FS_DIRTY_META);
 
@@ -907,8 +907,9 @@ static int move_data_page(struct inode *inode, block_t bidx, int gc_type,
 		bool is_dirty = PageDirty(page);
 
 retry:
-		set_page_dirty(page);
 		f2fs_wait_on_page_writeback(page, DATA, true);
+
+		set_page_dirty(page);
 		if (clear_page_dirty_for_io(page)) {
 			inode_dec_dirty_pages(inode);
 			f2fs_remove_dirty_inode(inode);
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 88be946dedd4..33fb3f8aeafa 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1598,10 +1598,11 @@ int f2fs_move_node_page(struct page *node_page, int gc_type)
 			.for_reclaim = 0,
 		};
 
-		set_page_dirty(node_page);
 		f2fs_wait_on_page_writeback(node_page, NODE, true);
-
 		f2fs_bug_on(F2FS_P_SB(node_page), PageWriteback(node_page));
+
+		set_page_dirty(node_page);
+
 		if (!clear_page_dirty_for_io(node_page)) {
 			err = -EAGAIN;
 			goto out_page;
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 6edcf8391dd3..8f3578c5230e 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -387,8 +387,9 @@ static int __f2fs_commit_inmem_pages(struct inode *inode)
 		if (page->mapping == inode->i_mapping) {
 			trace_f2fs_commit_inmem_page(page, INMEM);
 
-			set_page_dirty(page);
 			f2fs_wait_on_page_writeback(page, DATA, true);
+
+			set_page_dirty(page);
 			if (clear_page_dirty_for_io(page)) {
 				inode_dec_dirty_pages(inode);
 				f2fs_remove_dirty_inode(inode);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 168/352] ipv6: Fix handling of LLA with VRF and sockets bound to VRF
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 167/352] f2fs: fix to reorder set_page_dirty and wait_on_page_writeback Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 169/352] tools: bpftool: fix -Wmissing declaration warnings Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Donald Sharp, Mike Manning,
	David Ahern, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c2027d1e17582903e368abf5d4838b22a98f2b7b ]

A recent commit allows sockets bound to a VRF to receive ipv6 link local
packets. However, it only works for UDP and worse TCP connection attempts
to the LLA with the only listener bound to the VRF just hang where as
before the client gets a reset and connection refused. Fix by adjusting
ir_iif for LL addresses and packets received through a device enslaved
to a VRF.

Fixes: 6f12fa775530 ("vrf: mark skb for multicast or link-local as enslaved to VRF")
Reported-by: Donald Sharp <sharpd@cumulusnetworks.com>
Cc: Mike Manning <mmanning@vyatta.att-mail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/tcp_ipv6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 03e6b7a2bc53..f5c213001b05 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -734,6 +734,7 @@ static void tcp_v6_init_req(struct request_sock *req,
 			    const struct sock *sk_listener,
 			    struct sk_buff *skb)
 {
+	bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
 	struct inet_request_sock *ireq = inet_rsk(req);
 	const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 
@@ -741,7 +742,7 @@ static void tcp_v6_init_req(struct request_sock *req,
 	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 
 	/* So that link locals have meaning */
-	if (!sk_listener->sk_bound_dev_if &&
+	if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
 	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 		ireq->ir_iif = tcp_v6_iif(skb);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 169/352] tools: bpftool: fix -Wmissing declaration warnings
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 168/352] ipv6: Fix handling of LLA with VRF and sockets bound to VRF Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 170/352] KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Jakub Kicinski,
	Daniel Borkmann, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c101189bc9680675a2686bafe908015a07a0da51 ]

Help compiler check arguments for several utility functions used to
print items to the console by adding the "printf" attribute when
declaring those functions.

Also, declare as "static" two functions that are only used in prog.c.

All of them discovered by compiling bpftool with
-Wmissing-format-attribute -Wmissing-declarations.

Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/common.c        | 4 ++--
 tools/bpf/bpftool/json_writer.c   | 6 ++++--
 tools/bpf/bpftool/prog.c          | 4 ++--
 tools/bpf/bpftool/xlated_dumper.c | 7 ++++---
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 70fd48d79f61..05d715e6b128 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -58,7 +58,7 @@
 #define BPF_FS_MAGIC		0xcafe4a11
 #endif
 
-void p_err(const char *fmt, ...)
+void __printf(1, 2) p_err(const char *fmt, ...)
 {
 	va_list ap;
 
@@ -76,7 +76,7 @@ void p_err(const char *fmt, ...)
 	va_end(ap);
 }
 
-void p_info(const char *fmt, ...)
+void __printf(1, 2) p_info(const char *fmt, ...)
 {
 	va_list ap;
 
diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
index c6eef76322ae..4e4149421d07 100644
--- a/tools/bpf/bpftool/json_writer.c
+++ b/tools/bpf/bpftool/json_writer.c
@@ -19,6 +19,7 @@
 #include <malloc.h>
 #include <inttypes.h>
 #include <stdint.h>
+#include <linux/compiler.h>
 
 #include "json_writer.h"
 
@@ -156,7 +157,8 @@ void jsonw_name(json_writer_t *self, const char *name)
 		putc(' ', self->out);
 }
 
-void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
+void __printf(2, 0)
+jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
 {
 	jsonw_eor(self);
 	putc('"', self->out);
@@ -164,7 +166,7 @@ void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
 	putc('"', self->out);
 }
 
-void jsonw_printf(json_writer_t *self, const char *fmt, ...)
+void __printf(2, 3) jsonw_printf(json_writer_t *self, const char *fmt, ...)
 {
 	va_list ap;
 
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index ccee180dfb76..69b01a6158bd 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -84,7 +84,7 @@ static const char * const attach_type_strings[] = {
 	[__MAX_BPF_ATTACH_TYPE] = NULL,
 };
 
-enum bpf_attach_type parse_attach_type(const char *str)
+static enum bpf_attach_type parse_attach_type(const char *str)
 {
 	enum bpf_attach_type type;
 
@@ -713,7 +713,7 @@ struct map_replace {
 	char *name;
 };
 
-int map_replace_compar(const void *p1, const void *p2)
+static int map_replace_compar(const void *p1, const void *p2)
 {
 	const struct map_replace *a = p1, *b = p2;
 
diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
index 3284759df98a..98083e4dc0f9 100644
--- a/tools/bpf/bpftool/xlated_dumper.c
+++ b/tools/bpf/bpftool/xlated_dumper.c
@@ -114,7 +114,7 @@ struct kernel_sym *kernel_syms_search(struct dump_data *dd,
 		       sizeof(*dd->sym_mapping), kernel_syms_cmp) : NULL;
 }
 
-static void print_insn(void *private_data, const char *fmt, ...)
+static void __printf(2, 3) print_insn(void *private_data, const char *fmt, ...)
 {
 	va_list args;
 
@@ -123,7 +123,7 @@ static void print_insn(void *private_data, const char *fmt, ...)
 	va_end(args);
 }
 
-static void
+static void __printf(2, 3)
 print_insn_for_graph(void *private_data, const char *fmt, ...)
 {
 	char buf[64], *p;
@@ -154,7 +154,8 @@ print_insn_for_graph(void *private_data, const char *fmt, ...)
 	printf("%s", buf);
 }
 
-static void print_insn_json(void *private_data, const char *fmt, ...)
+static void __printf(2, 3)
+print_insn_json(void *private_data, const char *fmt, ...)
 {
 	unsigned int l = strlen(fmt);
 	char chomped_fmt[l];
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 170/352] KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 169/352] tools: bpftool: fix -Wmissing declaration warnings Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 171/352] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Suraj Jitindar Singh, Paul Mackerras,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 693ac10a88a2219bde553b2e8460dbec97e594e6 ]

The kvm capability KVM_CAP_SPAPR_TCE_VFIO is used to indicate the
availability of in kernel tce acceleration for vfio. However it is
currently the case that this is only available on a powernv machine,
not for a pseries machine.

Thus make this capability dependent on having the cpu feature
CPU_FTR_HVMODE.

[paulus@ozlabs.org - fixed compilation for Book E.]

Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/powerpc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 2869a299c4ed..75e2e471442f 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -543,8 +543,11 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 #ifdef CONFIG_PPC_BOOK3S_64
 	case KVM_CAP_SPAPR_TCE:
 	case KVM_CAP_SPAPR_TCE_64:
-		/* fallthrough */
+		r = 1;
+		break;
 	case KVM_CAP_SPAPR_TCE_VFIO:
+		r = !!cpu_has_feature(CPU_FTR_HVMODE);
+		break;
 	case KVM_CAP_PPC_RTAS:
 	case KVM_CAP_PPC_FIXUP_HCALL:
 	case KVM_CAP_PPC_ENABLE_HCALL:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 171/352] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 170/352] KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 172/352] mmc: bcm2835: reset host on timeout Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Phil Elwell, Stefan Wahren,
	Eric Anholt, Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 07d405769afea5718529fc9e341f0b13b3189b6f ]

If the user issues an "mmc extcsd read", the SD controller receives
what it thinks is a SEND_IF_COND command with an unexpected data block.
The resulting operations leave the FSM stuck in READWAIT, a state which
persists until the MMC framework resets the controller, by which point
the root filesystem is likely to have been unmounted.

A less heavyweight solution is to detect the condition and nudge the
FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.

Link: https://github.com/raspberrypi/linux/issues/2728
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/bcm2835.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 0d3b7473bc21..abf1f3c8b0c3 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -772,6 +772,8 @@ static void bcm2835_finish_command(struct bcm2835_host *host)
 
 		if (!(sdhsts & SDHSTS_CRC7_ERROR) ||
 		    (host->cmd->opcode != MMC_SEND_OP_COND)) {
+			u32 edm, fsm;
+
 			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
 				host->cmd->error = -ETIMEDOUT;
 			} else {
@@ -780,6 +782,13 @@ static void bcm2835_finish_command(struct bcm2835_host *host)
 				bcm2835_dumpregs(host);
 				host->cmd->error = -EILSEQ;
 			}
+			edm = readl(host->ioaddr + SDEDM);
+			fsm = edm & SDEDM_FSM_MASK;
+			if (fsm == SDEDM_FSM_READWAIT ||
+			    fsm == SDEDM_FSM_WRITESTART1)
+				/* Kick the FSM out of its wait */
+				writel(edm | SDEDM_FORCE_DATA_MODE,
+				       host->ioaddr + SDEDM);
 			bcm2835_finish_request(host);
 			return;
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 172/352] mmc: bcm2835: reset host on timeout
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 171/352] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 173/352] mmc: meson-mx-sdio: check devm_kasprintf for failure Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michal Suchanek, Stefan Wahren,
	Eric Anholt, Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f6000a4eb34e6462bc0dd39809c1bb99f9633269 ]

The bcm2835 mmc host tends to lock up for unknown reason so reset it on
timeout. The upper mmc block layer tries retransimitting with single
blocks which tends to work out after a long wait.

This is better than giving up and leaving the machine broken for no
obvious reason.

Fixes: 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.")
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/bcm2835.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index abf1f3c8b0c3..5301302fb531 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -286,6 +286,7 @@ static void bcm2835_reset(struct mmc_host *mmc)
 
 	if (host->dma_chan)
 		dmaengine_terminate_sync(host->dma_chan);
+	host->dma_chan = NULL;
 	bcm2835_reset_internal(host);
 }
 
@@ -846,6 +847,8 @@ static void bcm2835_timeout(struct work_struct *work)
 		dev_err(dev, "timeout waiting for hardware interrupt.\n");
 		bcm2835_dumpregs(host);
 
+		bcm2835_reset(host->mmc);
+
 		if (host->data) {
 			host->data->error = -ETIMEDOUT;
 			bcm2835_finish_data(host);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 173/352] mmc: meson-mx-sdio: check devm_kasprintf for failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 172/352] mmc: bcm2835: reset host on timeout Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 174/352] memstick: Prevent memstick host from getting runtime suspended during card detection Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire,
	Martin Blumenstingl, Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b0d06f1cb0e2079a3c64fb6e27c19d9a55c723a1 ]

devm_kasprintf() may return NULL on failure of internal allocation thus
the assignments to  init.name  are not safe if not checked. On error
meson_mx_mmc_register_clks() returns negative values so -ENOMEM in the
(unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meson8 and Meson8b SoCs")
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/meson-mx-sdio.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
index abe253c262a2..ec980bda071c 100644
--- a/drivers/mmc/host/meson-mx-sdio.c
+++ b/drivers/mmc/host/meson-mx-sdio.c
@@ -596,6 +596,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
 	init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
 				   "%s#fixed_factor",
 				   dev_name(host->controller_dev));
+	if (!init.name)
+		return -ENOMEM;
+
 	init.ops = &clk_fixed_factor_ops;
 	init.flags = 0;
 	init.parent_names = &clk_fixed_factor_parent;
@@ -612,6 +615,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
 	clk_div_parent = __clk_get_name(host->fixed_factor_clk);
 	init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
 				   "%s#div", dev_name(host->controller_dev));
+	if (!init.name)
+		return -ENOMEM;
+
 	init.ops = &clk_divider_ops;
 	init.flags = CLK_SET_RATE_PARENT;
 	init.parent_names = &clk_div_parent;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 174/352] memstick: Prevent memstick host from getting runtime suspended during card detection
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 173/352] mmc: meson-mx-sdio: check devm_kasprintf for failure Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 175/352] mmc: sdhci-of-esdhc: Fix timeout checks Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Oleksandr Natalenko,
	Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e03e303edf1c63e6dd455ccd568c74e93ef3ba8c ]

We can use MEMSTICK_POWER_{ON,OFF} along with pm_runtime_{get,put}
helpers to let memstick host support runtime pm.

The rpm count may go down to zero before the memstick host powers on, so
the host can be runtime suspended.

So before doing card detection, increment the rpm count to avoid the
host gets runtime suspended. Balance the rpm count after card detection
is done.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index 76382c858c35..1246d69ba187 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -18,6 +18,7 @@
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/pm_runtime.h>
 
 #define DRIVER_NAME "memstick"
 
@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work)
 	struct memstick_dev *card;
 
 	dev_dbg(&host->dev, "memstick_check started\n");
+	pm_runtime_get_noresume(host->dev.parent);
 	mutex_lock(&host->lock);
 	if (!host->card) {
 		if (memstick_power_on(host))
@@ -479,6 +481,7 @@ out_power_off:
 		host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
 
 	mutex_unlock(&host->lock);
+	pm_runtime_put(host->dev.parent);
 	dev_dbg(&host->dev, "memstick_check finished\n");
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 175/352] mmc: sdhci-of-esdhc: Fix timeout checks
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 174/352] memstick: Prevent memstick host from getting runtime suspended during card detection Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 176/352] mmc: sdhci-omap: " Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Yangbo Lu,
	Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ea6d027312111c6d96309ad1a684b33cb37e6764 ]

Always check the wait condition before returning timeout.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Yangbo Lu <yangbo.lu@nxp.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-of-esdhc.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index 86fc9f022002..d111bf62acd9 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -528,8 +528,12 @@ static void esdhc_clock_enable(struct sdhci_host *host, bool enable)
 	/* Wait max 20 ms */
 	timeout = ktime_add_ms(ktime_get(), 20);
 	val = ESDHC_CLOCK_STABLE;
-	while (!(sdhci_readl(host, ESDHC_PRSSTAT) & val)) {
-		if (ktime_after(ktime_get(), timeout)) {
+	while  (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		if (sdhci_readl(host, ESDHC_PRSSTAT) & val)
+			break;
+		if (timedout) {
 			pr_err("%s: Internal clock never stabilised.\n",
 				mmc_hostname(host->mmc));
 			break;
@@ -594,8 +598,12 @@ static void esdhc_of_set_clock(struct sdhci_host *host, unsigned int clock)
 
 	/* Wait max 20 ms */
 	timeout = ktime_add_ms(ktime_get(), 20);
-	while (!(sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE)) {
-		if (ktime_after(ktime_get(), timeout)) {
+	while (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		if (sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE)
+			break;
+		if (timedout) {
 			pr_err("%s: Internal clock never stabilised.\n",
 				mmc_hostname(host->mmc));
 			return;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 176/352] mmc: sdhci-omap: Fix timeout checks
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 175/352] mmc: sdhci-of-esdhc: Fix timeout checks Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 177/352] mmc: sdhci-xenon: " Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter,
	Kishon Vijay Abraham I, Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9f0ea0bda1d06120b053bb0c283f54afec59293d ]

Always check the wait condition before returning timeout.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-omap.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index d264391616f9..d02f5cf76b3d 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -220,8 +220,12 @@ static void sdhci_omap_conf_bus_power(struct sdhci_omap_host *omap_host,
 
 	/* wait 1ms */
 	timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT);
-	while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP)) {
-		if (WARN_ON(ktime_after(ktime_get(), timeout)))
+	while (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		if (sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP)
+			break;
+		if (WARN_ON(timedout))
 			return;
 		usleep_range(5, 10);
 	}
@@ -653,8 +657,12 @@ static void sdhci_omap_init_74_clocks(struct sdhci_host *host, u8 power_mode)
 
 	/* wait 1ms */
 	timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT);
-	while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN)) {
-		if (WARN_ON(ktime_after(ktime_get(), timeout)))
+	while (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		if (sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN)
+			break;
+		if (WARN_ON(timedout))
 			return;
 		usleep_range(5, 10);
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 177/352] mmc: sdhci-xenon: Fix timeout checks
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 176/352] mmc: sdhci-omap: " Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 178/352] mmc: jz4740: Get CD/WP GPIOs from descriptors Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Zhoujie Wu,
	Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0e6e7c2ff397e1bbebc882ca3132148aaaef1ddd ]

Always check the wait condition before returning timeout.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Zhoujie Wu <zjwu@marvell.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-xenon-phy.c | 10 +++++++---
 drivers/mmc/host/sdhci-xenon.c     | 10 +++++++---
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
index 5956e90380e8..5b5eb53a63d2 100644
--- a/drivers/mmc/host/sdhci-xenon-phy.c
+++ b/drivers/mmc/host/sdhci-xenon-phy.c
@@ -357,9 +357,13 @@ static int xenon_emmc_phy_enable_dll(struct sdhci_host *host)
 
 	/* Wait max 32 ms */
 	timeout = ktime_add_ms(ktime_get(), 32);
-	while (!(sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) &
-		XENON_DLL_LOCK_STATE)) {
-		if (ktime_after(ktime_get(), timeout)) {
+	while (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		if (sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) &
+		    XENON_DLL_LOCK_STATE)
+			break;
+		if (timedout) {
 			dev_err(mmc_dev(host->mmc), "Wait for DLL Lock time-out\n");
 			return -ETIMEDOUT;
 		}
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 4d0791f6ec23..a0b5089b3274 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -34,9 +34,13 @@ static int xenon_enable_internal_clk(struct sdhci_host *host)
 	sdhci_writel(host, reg, SDHCI_CLOCK_CONTROL);
 	/* Wait max 20 ms */
 	timeout = ktime_add_ms(ktime_get(), 20);
-	while (!((reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
-			& SDHCI_CLOCK_INT_STABLE)) {
-		if (ktime_after(ktime_get(), timeout)) {
+	while (1) {
+		bool timedout = ktime_after(ktime_get(), timeout);
+
+		reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+		if (reg & SDHCI_CLOCK_INT_STABLE)
+			break;
+		if (timedout) {
 			dev_err(mmc_dev(host->mmc), "Internal clock never stabilised.\n");
 			return -ETIMEDOUT;
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 178/352] mmc: jz4740: Get CD/WP GPIOs from descriptors
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 177/352] mmc: sdhci-xenon: " Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 179/352] usb: renesas_usbhs: add support for RZ/G2E Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Cercueil, linux-mips,
	Linus Walleij, Paul Burton, Ulf Hansson, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0c901c0566fb4edc2631c3786e5085a037be91f8 ]

Modifty the JZ4740 driver to retrieve card detect and write
protect GPIO pins from GPIO descriptors instead of hard-coded
global numbers. Augment the only board file using this in the
process and cut down on passed in platform data.

Preserve the code setting the caps2 flags for CD and WP
as active low or high since the slot GPIO code currently
ignores the gpiolib polarity inversion semantice and uses
the raw accessors to read the GPIO lines, but set the right
polarity flags in the descriptor table for jz4740.

Cc: Paul Cercueil <paul@crapouillou.net>
Cc: linux-mips@linux-mips.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Paul Burton <paul.burton@mips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../mips/include/asm/mach-jz4740/jz4740_mmc.h |  2 --
 arch/mips/jz4740/board-qi_lb60.c              | 12 ++++++++---
 drivers/mmc/host/jz4740_mmc.c                 | 20 +++++++++----------
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
index e9cc62cfac99..ff50aeb1a933 100644
--- a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
+++ b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
@@ -4,8 +4,6 @@
 
 struct jz4740_mmc_platform_data {
 	int gpio_power;
-	int gpio_card_detect;
-	int gpio_read_only;
 	unsigned card_detect_active_low:1;
 	unsigned read_only_active_low:1;
 	unsigned power_active_low:1;
diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
index af0c8ace0141..705593d40d12 100644
--- a/arch/mips/jz4740/board-qi_lb60.c
+++ b/arch/mips/jz4740/board-qi_lb60.c
@@ -43,7 +43,6 @@
 #include "clock.h"
 
 /* GPIOs */
-#define QI_LB60_GPIO_SD_CD		JZ_GPIO_PORTD(0)
 #define QI_LB60_GPIO_SD_VCC_EN_N	JZ_GPIO_PORTD(2)
 
 #define QI_LB60_GPIO_KEYOUT(x)		(JZ_GPIO_PORTC(10) + (x))
@@ -386,12 +385,18 @@ static struct platform_device qi_lb60_gpio_keys = {
 };
 
 static struct jz4740_mmc_platform_data qi_lb60_mmc_pdata = {
-	.gpio_card_detect	= QI_LB60_GPIO_SD_CD,
-	.gpio_read_only		= -1,
 	.gpio_power		= QI_LB60_GPIO_SD_VCC_EN_N,
 	.power_active_low	= 1,
 };
 
+static struct gpiod_lookup_table qi_lb60_mmc_gpio_table = {
+	.dev_id = "jz4740-mmc.0",
+	.table = {
+		GPIO_LOOKUP("GPIOD", 0, "cd", GPIO_ACTIVE_HIGH),
+		{ },
+	},
+};
+
 /* beeper */
 static struct pwm_lookup qi_lb60_pwm_lookup[] = {
 	PWM_LOOKUP("jz4740-pwm", 4, "pwm-beeper", NULL, 0,
@@ -500,6 +505,7 @@ static int __init qi_lb60_init_platform_devices(void)
 	gpiod_add_lookup_table(&qi_lb60_audio_gpio_table);
 	gpiod_add_lookup_table(&qi_lb60_nand_gpio_table);
 	gpiod_add_lookup_table(&qi_lb60_spigpio_gpio_table);
+	gpiod_add_lookup_table(&qi_lb60_mmc_gpio_table);
 
 	spi_register_board_info(qi_lb60_spi_board_info,
 				ARRAY_SIZE(qi_lb60_spi_board_info));
diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
index 0c1efd5100b7..44ea452add8e 100644
--- a/drivers/mmc/host/jz4740_mmc.c
+++ b/drivers/mmc/host/jz4740_mmc.c
@@ -983,17 +983,17 @@ static int jz4740_mmc_request_gpios(struct mmc_host *mmc,
 	if (!pdata->read_only_active_low)
 		mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 
-	if (gpio_is_valid(pdata->gpio_card_detect)) {
-		ret = mmc_gpio_request_cd(mmc, pdata->gpio_card_detect, 0);
-		if (ret)
-			return ret;
-	}
+	/*
+	 * Get optional card detect and write protect GPIOs,
+	 * only back out on probe deferral.
+	 */
+	ret = mmc_gpiod_request_cd(mmc, "cd", 0, false, 0, NULL);
+	if (ret == -EPROBE_DEFER)
+		return ret;
 
-	if (gpio_is_valid(pdata->gpio_read_only)) {
-		ret = mmc_gpio_request_ro(mmc, pdata->gpio_read_only);
-		if (ret)
-			return ret;
-	}
+	ret = mmc_gpiod_request_ro(mmc, "wp", 0, false, 0, NULL);
+	if (ret == -EPROBE_DEFER)
+		return ret;
 
 	return jz4740_mmc_request_gpio(&pdev->dev, pdata->gpio_power,
 			"MMC read only", true, pdata->power_active_low);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 179/352] usb: renesas_usbhs: add support for RZ/G2E
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 178/352] mmc: jz4740: Get CD/WP GPIOs from descriptors Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 180/352] btrfs: harden agaist duplicate fsid on scanned devices Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabrizio Castro, Simon Horman,
	Yoshihiro Shimoda, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1d6e81a288e28d8d0e38e0501a324216f79bba35 ]

HS-USB found in RZ/G2E (a.k.a. r8a774c0) is very similar to the
one found in R-Car E3 (a.k.a. r8a77990), as it needs to release
the PLL reset by the UGCTRL register like R-Car E3, therefore add
r8a774c0 support in a similar fashion to what was done for the
r8a77990.

Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/renesas_usbhs/common.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index a3e1290d682d..1de333be9353 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -539,6 +539,10 @@ static int usbhsc_drvcllbck_notify_hotplug(struct platform_device *pdev)
  *		platform functions
  */
 static const struct of_device_id usbhs_of_match[] = {
+	{
+		.compatible = "renesas,usbhs-r8a774c0",
+		.data = (void *)USBHS_TYPE_RCAR_GEN3_WITH_PLL,
+	},
 	{
 		.compatible = "renesas,usbhs-r8a7790",
 		.data = (void *)USBHS_TYPE_RCAR_GEN2,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 180/352] btrfs: harden agaist duplicate fsid on scanned devices
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 179/352] usb: renesas_usbhs: add support for RZ/G2E Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 181/352] btrfs: reada: reorder dev-replace locks before radix tree preload Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anand Jain, David Sterba, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a9261d4125c97ce8624e9941b75dee1b43ad5df9 ]

It's not that impossible to imagine that a device OR a btrfs image is
copied just by using the dd or the cp command. Which in case both the
copies of the btrfs will have the same fsid. If on the system with
automount enabled, the copied FS gets scanned.

We have a known bug in btrfs, that we let the device path be changed
after the device has been mounted. So using this loop hole the new
copied device would appears as if its mounted immediately after it's
been copied.

For example:

Initially.. /dev/mmcblk0p4 is mounted as /

  $ lsblk
  NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
  mmcblk0     179:0    0 29.2G  0 disk
  |-mmcblk0p4 179:4    0    4G  0 part /
  |-mmcblk0p2 179:2    0  500M  0 part /boot
  |-mmcblk0p3 179:3    0  256M  0 part [SWAP]
  `-mmcblk0p1 179:1    0  256M  0 part /boot/efi

  $ btrfs fi show
     Label: none  uuid: 07892354-ddaa-4443-90ea-f76a06accaba
     Total devices 1 FS bytes used 1.40GiB
     devid    1 size 4.00GiB used 3.00GiB path /dev/mmcblk0p4

Copy mmcblk0 to sda

  $ dd if=/dev/mmcblk0 of=/dev/sda

And immediately after the copy completes the change in the device
superblock is notified which the automount scans using btrfs device scan
and the new device sda becomes the mounted root device.

  $ lsblk
  NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
  sda           8:0    1 14.9G  0 disk
  |-sda4        8:4    1    4G  0 part /
  |-sda2        8:2    1  500M  0 part
  |-sda3        8:3    1  256M  0 part
  `-sda1        8:1    1  256M  0 part
  mmcblk0     179:0    0 29.2G  0 disk
  |-mmcblk0p4 179:4    0    4G  0 part
  |-mmcblk0p2 179:2    0  500M  0 part /boot
  |-mmcblk0p3 179:3    0  256M  0 part [SWAP]
  `-mmcblk0p1 179:1    0  256M  0 part /boot/efi

  $ btrfs fi show /
    Label: none  uuid: 07892354-ddaa-4443-90ea-f76a06accaba
    Total devices 1 FS bytes used 1.40GiB
    devid    1 size 4.00GiB used 3.00GiB path /dev/sda4

The bug is quite nasty that you can't either unmount /dev/sda4 or
/dev/mmcblk0p4. And the problem does not get solved until you take sda
out of the system on to another system to change its fsid using the
'btrfstune -u' command.

Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index ea5fa9df9405..6f09f6032db3 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -850,6 +850,35 @@ static noinline struct btrfs_device *device_list_add(const char *path,
 			return ERR_PTR(-EEXIST);
 		}
 
+		/*
+		 * We are going to replace the device path for a given devid,
+		 * make sure it's the same device if the device is mounted
+		 */
+		if (device->bdev) {
+			struct block_device *path_bdev;
+
+			path_bdev = lookup_bdev(path);
+			if (IS_ERR(path_bdev)) {
+				mutex_unlock(&fs_devices->device_list_mutex);
+				return ERR_CAST(path_bdev);
+			}
+
+			if (device->bdev != path_bdev) {
+				bdput(path_bdev);
+				mutex_unlock(&fs_devices->device_list_mutex);
+				btrfs_warn_in_rcu(device->fs_info,
+			"duplicate device fsid:devid for %pU:%llu old:%s new:%s",
+					disk_super->fsid, devid,
+					rcu_str_deref(device->name), path);
+				return ERR_PTR(-EEXIST);
+			}
+			bdput(path_bdev);
+			btrfs_info_in_rcu(device->fs_info,
+				"device fsid %pU devid %llu moved old:%s new:%s",
+				disk_super->fsid, devid,
+				rcu_str_deref(device->name), path);
+		}
+
 		name = rcu_string_strdup(path, GFP_NOFS);
 		if (!name) {
 			mutex_unlock(&fs_devices->device_list_mutex);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 181/352] btrfs: reada: reorder dev-replace locks before radix tree preload
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 180/352] btrfs: harden agaist duplicate fsid on scanned devices Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 182/352] serial: sh-sci: Fix locking in sci_submit_rx() Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Sterba, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ceb21a8db48559fd0809e03c4df9eb37743d9170 ]

The device-replace read lock is going to use rw semaphore in followup
commits. The semaphore might sleep which is not possible in the radix
tree preload section. The lock nesting is now:

* device replace
  * radix tree preload
    * readahead spinlock

Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/reada.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index dec14b739b10..6f81f3e88b6d 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -376,26 +376,28 @@ static struct reada_extent *reada_find_extent(struct btrfs_fs_info *fs_info,
 		goto error;
 	}
 
+	/* Insert extent in reada tree + all per-device trees, all or nothing */
+	btrfs_dev_replace_read_lock(&fs_info->dev_replace);
 	ret = radix_tree_preload(GFP_KERNEL);
-	if (ret)
+	if (ret) {
+		btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
 		goto error;
+	}
 
-	/* insert extent in reada_tree + all per-device trees, all or nothing */
-	btrfs_dev_replace_read_lock(&fs_info->dev_replace);
 	spin_lock(&fs_info->reada_lock);
 	ret = radix_tree_insert(&fs_info->reada_tree, index, re);
 	if (ret == -EEXIST) {
 		re_exist = radix_tree_lookup(&fs_info->reada_tree, index);
 		re_exist->refcnt++;
 		spin_unlock(&fs_info->reada_lock);
-		btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
 		radix_tree_preload_end();
+		btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
 		goto error;
 	}
 	if (ret) {
 		spin_unlock(&fs_info->reada_lock);
-		btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
 		radix_tree_preload_end();
+		btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
 		goto error;
 	}
 	radix_tree_preload_end();
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 182/352] serial: sh-sci: Fix locking in sci_submit_rx()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 181/352] btrfs: reada: reorder dev-replace locks before radix tree preload Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 183/352] serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit dd1f2250da95e87cb3e612858f94b14f99445a7c ]

Some callers of sci_submit_rx() hold the port spinlock, others don't.
During fallback to PIO, the driver needs to obtain the port spinlock.
If the lock was already held, spinlock recursion is detected, causing a
deadlock: BUG: spinlock recursion on CPU#0.

Fix this by adding a flag parameter to sci_submit_rx() for the caller to
indicate the port spinlock is already held, so spinlock recursion can be
avoided.

Move the spin_lock_irqsave() up, so all DMA disable steps are protected,
which is safe as the recently introduced dmaengine_terminate_async() can
be called in atomic context.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/sh-sci.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index cc56cb3b3eca..613007d7165e 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1331,7 +1331,7 @@ static void sci_tx_dma_release(struct sci_port *s)
 	dma_release_channel(chan);
 }
 
-static void sci_submit_rx(struct sci_port *s)
+static void sci_submit_rx(struct sci_port *s, bool port_lock_held)
 {
 	struct dma_chan *chan = s->chan_rx;
 	struct uart_port *port = &s->port;
@@ -1362,16 +1362,18 @@ static void sci_submit_rx(struct sci_port *s)
 	return;
 
 fail:
+	/* Switch to PIO */
+	if (!port_lock_held)
+		spin_lock_irqsave(&port->lock, flags);
 	if (i)
 		dmaengine_terminate_async(chan);
 	for (i = 0; i < 2; i++)
 		s->cookie_rx[i] = -EINVAL;
 	s->active_rx = -EINVAL;
-	/* Switch to PIO */
-	spin_lock_irqsave(&port->lock, flags);
 	s->chan_rx = NULL;
 	sci_start_rx(port);
-	spin_unlock_irqrestore(&port->lock, flags);
+	if (!port_lock_held)
+		spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static void work_fn_tx(struct work_struct *work)
@@ -1491,7 +1493,7 @@ static enum hrtimer_restart rx_timer_fn(struct hrtimer *t)
 	}
 
 	if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
-		sci_submit_rx(s);
+		sci_submit_rx(s, true);
 
 	/* Direct new serial port interrupts back to CPU */
 	scr = serial_port_in(port, SCSCR);
@@ -1617,7 +1619,7 @@ static void sci_request_dma(struct uart_port *port)
 		s->chan_rx_saved = s->chan_rx = chan;
 
 		if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
-			sci_submit_rx(s);
+			sci_submit_rx(s, false);
 	}
 }
 
@@ -1667,7 +1669,7 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
 			scr |= SCSCR_RDRQE;
 		} else {
 			scr &= ~SCSCR_RIE;
-			sci_submit_rx(s);
+			sci_submit_rx(s, false);
 		}
 		serial_port_out(port, SCSCR, scr);
 		/* Clear current interrupt */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 183/352] serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 182/352] serial: sh-sci: Fix locking in sci_submit_rx() Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 184/352] tty: serial: samsung: Properly set flags in autoCTS mode Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Wolfram Sang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 71ab1c0336c71ace5725740f200beca9667a339f ]

On (H)SCIF, sci_submit_rx() is called in the receive interrupt handler.
Hence if DMA submission fails, the interrupt handler should resume
handling reception using PIO, else no more data is received.

Make sci_submit_rx() return an error indicator, so the receive interrupt
handler can act appropriately.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/sh-sci.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 613007d7165e..21fd3f6ad28e 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1331,7 +1331,7 @@ static void sci_tx_dma_release(struct sci_port *s)
 	dma_release_channel(chan);
 }
 
-static void sci_submit_rx(struct sci_port *s, bool port_lock_held)
+static int sci_submit_rx(struct sci_port *s, bool port_lock_held)
 {
 	struct dma_chan *chan = s->chan_rx;
 	struct uart_port *port = &s->port;
@@ -1359,7 +1359,7 @@ static void sci_submit_rx(struct sci_port *s, bool port_lock_held)
 	s->active_rx = s->cookie_rx[0];
 
 	dma_async_issue_pending(chan);
-	return;
+	return 0;
 
 fail:
 	/* Switch to PIO */
@@ -1374,6 +1374,7 @@ fail:
 	sci_start_rx(port);
 	if (!port_lock_held)
 		spin_unlock_irqrestore(&port->lock, flags);
+	return -EAGAIN;
 }
 
 static void work_fn_tx(struct work_struct *work)
@@ -1668,8 +1669,10 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
 			disable_irq_nosync(irq);
 			scr |= SCSCR_RDRQE;
 		} else {
+			if (sci_submit_rx(s, false) < 0)
+				goto handle_pio;
+
 			scr &= ~SCSCR_RIE;
-			sci_submit_rx(s, false);
 		}
 		serial_port_out(port, SCSCR, scr);
 		/* Clear current interrupt */
@@ -1681,6 +1684,8 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
 
 		return IRQ_HANDLED;
 	}
+
+handle_pio:
 #endif
 
 	if (s->rx_trigger > 1 && s->rx_fifo_timeout > 0) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 184/352] tty: serial: samsung: Properly set flags in autoCTS mode
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 183/352] serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 185/352] perf stat: Fix CSV mode column output for non-cgroup events Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Beomho Seo, Marek Szyprowski, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 31e933645742ee6719d37573a27cce0761dcf92b ]

Commit 391f93f2ec9f ("serial: core: Rework hw-assited flow control support")
has changed the way the autoCTS mode is handled.

According to that change, serial drivers which enable H/W autoCTS mode must
set UPSTAT_AUTOCTS to prevent the serial core from inadvertently disabling
TX. This patch adds proper handling of UPSTAT_AUTOCTS flag.

Signed-off-by: Beomho Seo <beomho.seo@samsung.com>
[mszyprow: rephrased commit message]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/samsung.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index da1bd4bba8a9..2a49b6d876b8 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1365,11 +1365,14 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
 	wr_regl(port, S3C2410_ULCON, ulcon);
 	wr_regl(port, S3C2410_UBRDIV, quot);
 
+	port->status &= ~UPSTAT_AUTOCTS;
+
 	umcon = rd_regl(port, S3C2410_UMCON);
 	if (termios->c_cflag & CRTSCTS) {
 		umcon |= S3C2410_UMCOM_AFC;
 		/* Disable RTS when RX FIFO contains 63 bytes */
 		umcon &= ~S3C2412_UMCON_AFC_8;
+		port->status = UPSTAT_AUTOCTS;
 	} else {
 		umcon &= ~S3C2410_UMCOM_AFC;
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 185/352] perf stat: Fix CSV mode column output for non-cgroup events
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 184/352] tty: serial: samsung: Properly set flags in autoCTS mode Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 186/352] perf test: Fix perf_event_attr test failure Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephane Eranian, Jiri Olsa,
	Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit bc4da38a4789e7819fca4c7723ded0b86aea27c0 ]

When using the -x option, perf stat prints CSV-style output with one
event per line.  For each event, it prints the count, the unit, the
event name, the cgroup, and a bunch of other event specific fields (such
as insn per cycles).

When you use CSV-style mode, you expect a normalized output where each
event is printed with the same number of fields regardless of what it is
so it can easily be imported into a spreadsheet or parsed.

For instance, if an event does not have a unit, then print an empty
field for it.

Although this approach was implemented for the unit, it was not for the
cgroup.

When mixing cgroup and non-cgroup events, then non-cgroup events would
not show an empty field, instead the next field was printed, make
columns not line up correctly.

This patch fixes the cgroup output issues by forcing an empty field
for non-cgroup events as soon as one event has cgroup.

Before:

  <not counted> @ @cycles @foo    @ 0    @100.00@@
  2531614       @ @cycles @6420922@100.00@    @

foo cgroup lines up with time_running!

After:

  <not counted> @ @cycles @foo @0       @100.00@@
  2594834       @ @cycles @    @5287372 @100.00@@

Fields line up.

Signed-off-by: Stephane Eranian <eranian@google.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1541587845-9150-1-git-send-email-eranian@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/stat-display.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
index e7b4c44ebb62..665ee374fc01 100644
--- a/tools/perf/util/stat-display.c
+++ b/tools/perf/util/stat-display.c
@@ -59,6 +59,15 @@ static void print_noise(struct perf_stat_config *config,
 	print_noise_pct(config, stddev_stats(&ps->res_stats[0]), avg);
 }
 
+static void print_cgroup(struct perf_stat_config *config, struct perf_evsel *evsel)
+{
+	if (nr_cgroups) {
+		const char *cgrp_name = evsel->cgrp ? evsel->cgrp->name  : "";
+		fprintf(config->output, "%s%s", config->csv_sep, cgrp_name);
+	}
+}
+
+
 static void aggr_printout(struct perf_stat_config *config,
 			  struct perf_evsel *evsel, int id, int nr)
 {
@@ -336,8 +345,7 @@ static void abs_printout(struct perf_stat_config *config,
 
 	fprintf(output, "%-*s", config->csv_output ? 0 : 25, perf_evsel__name(evsel));
 
-	if (evsel->cgrp)
-		fprintf(output, "%s%s", config->csv_sep, evsel->cgrp->name);
+	print_cgroup(config, evsel);
 }
 
 static bool is_mixed_hw_group(struct perf_evsel *counter)
@@ -431,9 +439,7 @@ static void printout(struct perf_stat_config *config, int id, int nr,
 			config->csv_output ? 0 : -25,
 			perf_evsel__name(counter));
 
-		if (counter->cgrp)
-			fprintf(config->output, "%s%s",
-				config->csv_sep, counter->cgrp->name);
+		print_cgroup(config, counter);
 
 		if (!config->csv_output)
 			pm(config, &os, NULL, NULL, "", 0);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 186/352] perf test: Fix perf_event_attr test failure
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 185/352] perf stat: Fix CSV mode column output for non-cgroup events Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 187/352] perf dso: Fix unchecked usage of strncpy() Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 741dad88dde296999da30332157ca47f0543747d ]

Fix inconsistent use of tabs and spaces error:

  # perf test 16 -v
  16: Setup struct perf_event_attr                          :
  --- start ---
  test child forked, pid 20224
    File "/usr/libexec/perf-core/tests/attr.py", line 119
      log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
                                                                 ^
  TabError: inconsistent use of tabs and spaces in indentation
  test child finished with -1
  ---- end ----
  Setup struct perf_event_attr: FAILED!

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: http://lkml.kernel.org/r/20181122140456.16817-1-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/attr.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
index ff9b60b99f52..44090a9a19f3 100644
--- a/tools/perf/tests/attr.py
+++ b/tools/perf/tests/attr.py
@@ -116,7 +116,7 @@ class Event(dict):
             if not self.has_key(t) or not other.has_key(t):
                 continue
             if not data_equal(self[t], other[t]):
-		log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
+                log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
 
 # Test file description needs to have following sections:
 # [config]
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 187/352] perf dso: Fix unchecked usage of strncpy()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 186/352] perf test: Fix perf_event_attr test failure Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 188/352] perf header: " Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit fca5085c15255bbde203b7322c15f07ebb12f63e ]

The strncpy() function may leave the destination string buffer
unterminated, better use strlcpy() that we have a __weak fallback
implementation for systems without it.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

  In function 'decompress_kmodule',
      inlined from 'dso__decompress_kmodule_fd' at util/dso.c:305:9:
  util/dso.c:298:3: error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation]
     strncpy(pathname, tmpbuf, len);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    CC       /tmp/build/perf/util/values.o
    CC       /tmp/build/perf/util/debug.o
  cc1: all warnings being treated as errors

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Fixes: c9a8a6131fb6 ("perf tools: Move the temp file processing into decompress_kmodule")
Link: https://lkml.kernel.org/n/tip-tl2hdxj64tt4k8btbi6a0ugw@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/dso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index bbed90e5d9bb..cee717a3794f 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -295,7 +295,7 @@ static int decompress_kmodule(struct dso *dso, const char *name,
 		unlink(tmpbuf);
 
 	if (pathname && (fd >= 0))
-		strncpy(pathname, tmpbuf, len);
+		strlcpy(pathname, tmpbuf, len);
 
 	return fd;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 188/352] perf header: Fix unchecked usage of strncpy()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 187/352] perf dso: Fix unchecked usage of strncpy() Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 189/352] btrfs: use tagged writepage to mitigate livelock of snapshot Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7572588085a13d5db02bf159542189f52fdb507e ]

The strncpy() function may leave the destination string buffer
unterminated, better use strlcpy() that we have a __weak fallback
implementation for systems without it.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

  util/header.c: In function 'perf_event__synthesize_event_update_unit':
  util/header.c:3586:2: error: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]
    strncpy(ev->data, evsel->unit, size);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  util/header.c:3579:16: note: length computed here
    size_t size = strlen(evsel->unit);
                  ^~~~~~~~~~~~~~~~~~~

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Fixes: a6e5281780d1 ("perf tools: Add event_update event unit type")
Link: https://lkml.kernel.org/n/tip-fiikh5nay70bv4zskw2aa858@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 4fd45be95a43..13a2251a37c5 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3544,7 +3544,7 @@ perf_event__synthesize_event_update_unit(struct perf_tool *tool,
 	if (ev == NULL)
 		return -ENOMEM;
 
-	strncpy(ev->data, evsel->unit, size);
+	strlcpy(ev->data, evsel->unit, size + 1);
 	err = process(tool, (union perf_event *)ev, NULL, NULL);
 	free(ev);
 	return err;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 189/352] btrfs: use tagged writepage to mitigate livelock of snapshot
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 188/352] perf header: " Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 190/352] perf probe: Fix unchecked usage of strncpy() Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Ethan Lien,
	David Sterba, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 3cd24c698004d2f7668e0eb9fc1f096f533c791b ]

Snapshot is expected to be fast. But if there are writers steadily
creating dirty pages in our subvolume, the snapshot may take a very long
time to complete. To fix the problem, we use tagged writepage for
snapshot flusher as we do in the generic write_cache_pages(), so we can
omit pages dirtied after the snapshot command.

This does not change the semantics regarding which data get to the
snapshot, if there are pages being dirtied during the snapshotting
operation.  There's a sync called before snapshot is taken in old/new
case, any IO in flight just after that may be in the snapshot but this
depends on other system effects that might still sync the IO.

We do a simple snapshot speed test on a Intel D-1531 box:

fio --ioengine=libaio --iodepth=32 --bs=4k --rw=write --size=64G
--direct=0 --thread=1 --numjobs=1 --time_based --runtime=120
--filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5;
time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio

original: 1m58sec
patched:  6.54sec

This is the best case for this patch since for a sequential write case,
we omit nearly all pages dirtied after the snapshot command.

For a multi writers, random write test:

fio --ioengine=libaio --iodepth=32 --bs=4k --rw=randwrite --size=64G
--direct=0 --thread=1 --numjobs=4 --time_based --runtime=120
--filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5;
time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio

original: 15.83sec
patched:  10.35sec

The improvement is smaller compared to the sequential write case,
since we omit only half of the pages dirtied after snapshot command.

Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Ethan Lien <ethanlien@synology.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/btrfs_inode.h |  1 +
 fs/btrfs/ctree.h       |  2 +-
 fs/btrfs/extent_io.c   | 17 +++++++++++++++--
 fs/btrfs/inode.c       | 11 +++++++----
 fs/btrfs/ioctl.c       |  2 +-
 5 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index a0e230b31a88..20288b49718f 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -29,6 +29,7 @@ enum {
 	BTRFS_INODE_IN_DELALLOC_LIST,
 	BTRFS_INODE_READDIO_NEED_LOCK,
 	BTRFS_INODE_HAS_PROPS,
+	BTRFS_INODE_SNAPSHOT_FLUSH,
 };
 
 /* in memory btrfs inode */
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 68f322f600a0..131e90aad941 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3141,7 +3141,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
 			       struct inode *inode, u64 new_size,
 			       u32 min_type);
 
-int btrfs_start_delalloc_inodes(struct btrfs_root *root);
+int btrfs_start_delalloc_snapshot(struct btrfs_root *root);
 int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr);
 int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
 			      unsigned int extra_bits,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index d228f706ff3e..c8e886caacd7 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3934,12 +3934,25 @@ static int extent_write_cache_pages(struct address_space *mapping,
 			range_whole = 1;
 		scanned = 1;
 	}
-	if (wbc->sync_mode == WB_SYNC_ALL)
+
+	/*
+	 * We do the tagged writepage as long as the snapshot flush bit is set
+	 * and we are the first one who do the filemap_flush() on this inode.
+	 *
+	 * The nr_to_write == LONG_MAX is needed to make sure other flushers do
+	 * not race in and drop the bit.
+	 */
+	if (range_whole && wbc->nr_to_write == LONG_MAX &&
+	    test_and_clear_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
+			       &BTRFS_I(inode)->runtime_flags))
+		wbc->tagged_writepages = 1;
+
+	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag = PAGECACHE_TAG_TOWRITE;
 	else
 		tag = PAGECACHE_TAG_DIRTY;
 retry:
-	if (wbc->sync_mode == WB_SYNC_ALL)
+	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag_pages_for_writeback(mapping, index, end);
 	done_index = index;
 	while (!done && !nr_to_write_done && (index <= end) &&
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 561bffcb56a0..965a64bde6fd 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9988,7 +9988,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode
  * some fairly slow code that needs optimization. This walks the list
  * of all the inodes with pending delalloc and forces them to disk.
  */
-static int start_delalloc_inodes(struct btrfs_root *root, int nr)
+static int start_delalloc_inodes(struct btrfs_root *root, int nr, bool snapshot)
 {
 	struct btrfs_inode *binode;
 	struct inode *inode;
@@ -10016,6 +10016,9 @@ static int start_delalloc_inodes(struct btrfs_root *root, int nr)
 		}
 		spin_unlock(&root->delalloc_lock);
 
+		if (snapshot)
+			set_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
+				&binode->runtime_flags);
 		work = btrfs_alloc_delalloc_work(inode);
 		if (!work) {
 			iput(inode);
@@ -10049,7 +10052,7 @@ out:
 	return ret;
 }
 
-int btrfs_start_delalloc_inodes(struct btrfs_root *root)
+int btrfs_start_delalloc_snapshot(struct btrfs_root *root)
 {
 	struct btrfs_fs_info *fs_info = root->fs_info;
 	int ret;
@@ -10057,7 +10060,7 @@ int btrfs_start_delalloc_inodes(struct btrfs_root *root)
 	if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state))
 		return -EROFS;
 
-	ret = start_delalloc_inodes(root, -1);
+	ret = start_delalloc_inodes(root, -1, true);
 	if (ret > 0)
 		ret = 0;
 	return ret;
@@ -10086,7 +10089,7 @@ int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr)
 			       &fs_info->delalloc_roots);
 		spin_unlock(&fs_info->delalloc_root_lock);
 
-		ret = start_delalloc_inodes(root, nr);
+		ret = start_delalloc_inodes(root, nr, false);
 		btrfs_put_fs_root(root);
 		if (ret < 0)
 			goto out;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 802a628e9f7d..87f4f0f65dbb 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -777,7 +777,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
 	wait_event(root->subv_writers->wait,
 		   percpu_counter_sum(&root->subv_writers->counter) == 0);
 
-	ret = btrfs_start_delalloc_inodes(root);
+	ret = btrfs_start_delalloc_snapshot(root);
 	if (ret)
 		goto dec_and_free;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 190/352] perf probe: Fix unchecked usage of strncpy()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 189/352] btrfs: use tagged writepage to mitigate livelock of snapshot Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 191/352] i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Masami Hiramatsu, Namhyung Kim, Arnaldo Carvalho de Melo,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit bef0b8970f27da5ca223e522a174d03e2587761d ]

The strncpy() function may leave the destination string buffer
unterminated, better use strlcpy() that we have a __weak fallback
implementation for systems without it.

In this case the 'target' buffer is coming from a list of build-ids that
are expected to have a len of at most (SBUILD_ID_SIZE - 1) chars, so
probably we're safe, but since we're using strncpy() here, use strlcpy()
instead to provide the intended safety checking without the using the
problematic strncpy() function.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

  util/probe-file.c: In function 'probe_cache__open.isra.5':
  util/probe-file.c:427:3: error: 'strncpy' specified bound 41 equals destination size [-Werror=stringop-truncation]
     strncpy(sbuildid, target, SBUILD_ID_SIZE);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  cc1: all warnings being treated as errors

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Fixes: 1f3736c9c833 ("perf probe: Show all cached probes")
Link: https://lkml.kernel.org/n/tip-l7n8ggc9kl38qtdlouke5yp5@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/probe-file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index aac7817d9e14..0b1195cad0e5 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -424,7 +424,7 @@ static int probe_cache__open(struct probe_cache *pcache, const char *target,
 
 	if (target && build_id_cache__cached(target)) {
 		/* This is a cached buildid */
-		strncpy(sbuildid, target, SBUILD_ID_SIZE);
+		strlcpy(sbuildid, target, SBUILD_ID_SIZE);
 		dir_name = build_id_cache__linkname(sbuildid, NULL, 0);
 		goto found;
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 191/352] i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 190/352] perf probe: Fix unchecked usage of strncpy() Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:16 ` [PATCH 4.20 192/352] bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabrizio Castro, Geert Uytterhoeven,
	Simon Horman, Wolfram Sang, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 51243b73455f2d12cb82abffa7bc9028aec656e0 ]

Similarly to R-Car E3, RZ/G2E doesn't come with automatic
transmission registers, as such it is not considered compatible
with the existing fallback bindings.

Add SoC specific binding compatibility to allow for later
support for automatic transmission.

Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-sh_mobile.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 28db6b59c4ca..a64f2ff3cb49 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -800,6 +800,7 @@ static const struct sh_mobile_dt_config r8a7740_dt_config = {
 static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
 	{ .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config },
+	{ .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config },
 	{ .compatible = "renesas,iic-r8a7791", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7792", .data = &fast_clock_dt_config },
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 192/352] bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 191/352] i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) Greg Kroah-Hartman
@ 2019-02-11 14:16 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 36d65be9a88052cdfc8524eb591baf0e6c878408 ]

When bringing up a device, the code checks to see if the number of
MSIX has changed.  pci_disable_msix() should be called first before
changing the number of reserved NQs/CMPL rings.  This ensures that
the MSIX vectors associated with the NQs/CMPL rings are still
properly mapped when pci_disable_msix() masks the vectors.

This patch will prevent errors when RDMA support is added for the new
57500 chips.  When the RDMA driver shuts down, the number of NQs is
decreased and we must use the new sequence to prevent MSIX errors.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 5d21c14853ac..50a4c3ddf977 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7203,23 +7203,26 @@ static void bnxt_clear_int_mode(struct bnxt *bp)
 int bnxt_reserve_rings(struct bnxt *bp)
 {
 	int tcs = netdev_get_num_tc(bp->dev);
+	bool reinit_irq = false;
 	int rc;
 
 	if (!bnxt_need_reserve_rings(bp))
 		return 0;
 
-	rc = __bnxt_reserve_rings(bp);
-	if (rc) {
-		netdev_err(bp->dev, "ring reservation failure rc: %d\n", rc);
-		return rc;
-	}
 	if (BNXT_NEW_RM(bp) && (bnxt_get_num_msix(bp) != bp->total_irqs)) {
 		bnxt_ulp_irq_stop(bp);
 		bnxt_clear_int_mode(bp);
-		rc = bnxt_init_int_mode(bp);
+		reinit_irq = true;
+	}
+	rc = __bnxt_reserve_rings(bp);
+	if (reinit_irq) {
+		if (!rc)
+			rc = bnxt_init_int_mode(bp);
 		bnxt_ulp_irq_restart(bp, rc);
-		if (rc)
-			return rc;
+	}
+	if (rc) {
+		netdev_err(bp->dev, "ring reservation/IRQ init failure rc: %d\n", rc);
+		return rc;
 	}
 	if (tcs && (bp->tx_nr_rings_per_tc * tcs != bp->tx_nr_rings)) {
 		netdev_err(bp->dev, "tx ring reservation failure\n");
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2019-02-11 14:16 ` [PATCH 4.20 192/352] bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:34   ` Christian Borntraeger
  2019-02-11 14:17 ` [PATCH 4.20 194/352] tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Mueller, Cornelia Huck,
	Pierre Morel, David Hildenbrand, Christian Borntraeger,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]

Make sure the debug feature and its allocated resources get
released upon unsuccessful architecture initialization.

A related indication of the issue will be reported as kernel
message.

Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index fe24150ff666..d8d8e0788157 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -417,19 +417,30 @@ static void kvm_s390_cpu_feat_init(void)
 
 int kvm_arch_init(void *opaque)
 {
+	int rc;
+
 	kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
 	if (!kvm_s390_dbf)
 		return -ENOMEM;
 
 	if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
-		debug_unregister(kvm_s390_dbf);
-		return -ENOMEM;
+		rc = -ENOMEM;
+		goto out_debug_unreg;
 	}
 
 	kvm_s390_cpu_feat_init();
 
 	/* Register floating interrupt controller interface. */
-	return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
+	rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
+	if (rc) {
+		pr_err("Failed to register FLIC rc=%d\n", rc);
+		goto out_debug_unreg;
+	}
+	return 0;
+
+out_debug_unreg:
+	debug_unregister(kvm_s390_dbf);
+	return rc;
 }
 
 void kvm_arch_exit(void)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 194/352] tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 195/352] pinctrl: rza1: Handle devm_kasprintf() failure cases Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Smythies, Rafael J. Wysocki,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 663546903c835fe46308b1b1e53d32d1f2b33da9 ]

This script is supposed to be allowed to run with regular user
privileges if a previously captured trace is being post processed.

Commit fbe313884d7d (tools/power/x86/intel_pstate_tracer: Free the
trace buffer memory) introduced a bug that breaks that option.

Commit 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add
optional setting of trace buffer memory allocation) moved the code
but kept the bug.

This patch fixes the issue.

Fixes: 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional ...)
Signed-off-by: Doug Smythies <dsmythies@telus.net>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
index 84e2b648e622..2fa3c5757bcb 100755
--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
@@ -585,9 +585,9 @@ current_max_cpu = 0
 
 read_trace_data(filename)
 
-clear_trace_file()
-# Free the memory
 if interval:
+    clear_trace_file()
+    # Free the memory
     free_trace_buffer()
 
 if graph_data_present == False:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 195/352] pinctrl: rza1: Handle devm_kasprintf() failure cases
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 194/352] tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 196/352] mac80211: Properly handle SKB with radiotap only Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire,
	Geert Uytterhoeven, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit db221412cd2014506642967155698825ad80f6b6 ]

devm_kasprintf() may return NULL on failure of internal allocation
thus the assignments are not safe if not checked. On error
rza1_pinctrl_register() respectively rza1_parse_gpiochip() return
negative values so -ENOMEM in the (unlikely) failure case of
devm_kasprintf() should be fine here.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 5a49b644b307 ("pinctrl: Renesas RZ/A1 pin and gpio controller")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-rza1.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-rza1.c b/drivers/pinctrl/pinctrl-rza1.c
index 14eb576c04a2..9cfe9d0520ac 100644
--- a/drivers/pinctrl/pinctrl-rza1.c
+++ b/drivers/pinctrl/pinctrl-rza1.c
@@ -1225,6 +1225,9 @@ static int rza1_parse_gpiochip(struct rza1_pinctrl *rza1_pctl,
 	chip->base	= -1;
 	chip->label	= devm_kasprintf(rza1_pctl->dev, GFP_KERNEL, "%pOFn",
 					 np);
+	if (!chip->label)
+		return -ENOMEM;
+
 	chip->ngpio	= of_args.args[2];
 	chip->of_node	= np;
 	chip->parent	= rza1_pctl->dev;
@@ -1326,6 +1329,8 @@ static int rza1_pinctrl_register(struct rza1_pinctrl *rza1_pctl)
 		pins[i].number = i;
 		pins[i].name = devm_kasprintf(rza1_pctl->dev, GFP_KERNEL,
 					      "P%u-%u", port, pin);
+		if (!pins[i].name)
+			return -ENOMEM;
 
 		if (i % RZA1_PINS_PER_PORT == 0) {
 			/*
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 196/352] mac80211: Properly handle SKB with radiotap only
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 195/352] pinctrl: rza1: Handle devm_kasprintf() failure cases Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 197/352] livepatch: check kzalloc return values Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilan Peer, Luca Coelho,
	Johannes Berg, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8020919a9b99d6c990dc6a50e8215e291fbbe5a6 ]

The monitor interface Rx handling of SKBs that contain only
radiotap information was buggy as it tried to access the
SKB assuming it contains a frame.

To fix this, check the RX_FLAG_NO_PSDU flag in the Rx status
(indicting that the SKB contains only radiotap information),
and do not perform data path specific processing when the flag
is set.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 428f7ad5f9b5..77d996a60f12 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -753,6 +753,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 	struct ieee80211_sub_if_data *monitor_sdata =
 		rcu_dereference(local->monitor_sdata);
 	bool only_monitor = false;
+	unsigned int min_head_len;
 
 	if (status->flag & RX_FLAG_RADIOTAP_HE)
 		rtap_space += sizeof(struct ieee80211_radiotap_he);
@@ -766,6 +767,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 		rtap_space += sizeof(*rtap) + rtap->len + rtap->pad;
 	}
 
+	min_head_len = rtap_space;
+
 	/*
 	 * First, we may need to make a copy of the skb because
 	 *  (1) we need to modify it for radiotap (if not present), and
@@ -775,18 +778,23 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 	 * the SKB because it has a bad FCS/PLCP checksum.
 	 */
 
-	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
-		if (unlikely(origskb->len <= FCS_LEN)) {
-			/* driver bug */
-			WARN_ON(1);
-			dev_kfree_skb(origskb);
-			return NULL;
+	if (!(status->flag & RX_FLAG_NO_PSDU)) {
+		if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
+			if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
+				/* driver bug */
+				WARN_ON(1);
+				dev_kfree_skb(origskb);
+				return NULL;
+			}
+			present_fcs_len = FCS_LEN;
 		}
-		present_fcs_len = FCS_LEN;
+
+		/* also consider the hdr->frame_control */
+		min_head_len += 2;
 	}
 
-	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
-	if (!pskb_may_pull(origskb, 2 + rtap_space)) {
+	/* ensure that the expected data elements are in skb head */
+	if (!pskb_may_pull(origskb, min_head_len)) {
 		dev_kfree_skb(origskb);
 		return NULL;
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 197/352] livepatch: check kzalloc return values
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 196/352] mac80211: Properly handle SKB with radiotap only Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 198/352] arm64: KVM: Skip MMIO insn after emulation Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Joe Lawrence,
	Petr Mladek, Miroslav Benes, Jiri Kosina, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5f30b2e823484ce6a79f2b59901b6351c15effa6 ]

kzalloc() return should always be checked - notably in example code
where this may be seen as reference. On failure of allocation in
livepatch_fix1_dummy_alloc() respectively dummy_alloc() previous
allocation is freed (thanks to Petr Mladek <pmladek@suse.com> for
catching this) and NULL returned.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 439e7271dc2b ("livepatch: introduce shadow variable API")
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/livepatch/livepatch-shadow-fix1.c | 5 +++++
 samples/livepatch/livepatch-shadow-mod.c  | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/samples/livepatch/livepatch-shadow-fix1.c b/samples/livepatch/livepatch-shadow-fix1.c
index 49b13553eaae..e8f1bd6b29b1 100644
--- a/samples/livepatch/livepatch-shadow-fix1.c
+++ b/samples/livepatch/livepatch-shadow-fix1.c
@@ -89,6 +89,11 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
 	 * pointer to handle resource release.
 	 */
 	leak = kzalloc(sizeof(int), GFP_KERNEL);
+	if (!leak) {
+		kfree(d);
+		return NULL;
+	}
+
 	klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
 			 shadow_leak_ctor, leak);
 
diff --git a/samples/livepatch/livepatch-shadow-mod.c b/samples/livepatch/livepatch-shadow-mod.c
index 4c54b250332d..4aa8a88d3cd6 100644
--- a/samples/livepatch/livepatch-shadow-mod.c
+++ b/samples/livepatch/livepatch-shadow-mod.c
@@ -118,6 +118,10 @@ noinline struct dummy *dummy_alloc(void)
 
 	/* Oops, forgot to save leak! */
 	leak = kzalloc(sizeof(int), GFP_KERNEL);
+	if (!leak) {
+		kfree(d);
+		return NULL;
+	}
 
 	pr_info("%s: dummy @ %p, expires @ %lx\n",
 		__func__, d, d->jiffies_expire);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 198/352] arm64: KVM: Skip MMIO insn after emulation
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 197/352] livepatch: check kzalloc return values Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 199/352] usb: musb: dsps: fix otg state machine Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Maydell, Alex Bennée,
	Christoffer Dall, Mark Rutland, Marc Zyngier, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0d640732dbebed0f10f18526de21652931f0b2f2 ]

When we emulate an MMIO instruction, we advance the CPU state within
decode_hsr(), before emulating the instruction effects.

Having this logic in decode_hsr() is opaque, and advancing the state
before emulation is problematic. It gets in the way of applying
consistent single-step logic, and it prevents us from being able to fail
an MMIO instruction with a synchronous exception.

Clean this up by only advancing the CPU state *after* the effects of the
instruction are emulated.

Cc: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/arm/mmio.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
index dac7ceb1a677..08443a15e6be 100644
--- a/virt/kvm/arm/mmio.c
+++ b/virt/kvm/arm/mmio.c
@@ -117,6 +117,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
 		vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data);
 	}
 
+	/*
+	 * The MMIO instruction is emulated and should not be re-executed
+	 * in the guest.
+	 */
+	kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+
 	return 0;
 }
 
@@ -144,11 +150,6 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len)
 	vcpu->arch.mmio_decode.sign_extend = sign_extend;
 	vcpu->arch.mmio_decode.rt = rt;
 
-	/*
-	 * The MMIO instruction is emulated and should not be re-executed
-	 * in the guest.
-	 */
-	kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
 	return 0;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 199/352] usb: musb: dsps: fix otg state machine
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 198/352] arm64: KVM: Skip MMIO insn after emulation Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 200/352] usb: musb: dsps: fix runtime pm for peripheral mode Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bin Liu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6010abf2c2c0e382d7e8ee44bd11f343aae90cce ]

Due to lack of ID pin interrupt event on AM335x devices, the musb dsps
driver uses polling to detect usb device attach for dual-role port.

But in the case if a micro-A cable adapter is attached without a USB device
attached to the cable, the musb state machine gets stuck in a_wait_vrise
state waiting for the MUSB_CONNECT interrupt which won't happen due to the
usb device is not attached. The state is stuck in a_wait_vrise even after
the micro-A cable is detached, which could cause VBUS retention if then the
dual-role port is attached to a host port.

To fix the problem, make a_wait_vrise as a transient state, then move the
state to either a_wait_bcon for host port or a_idle state for dual-role
port, if no usb device is attached to the port.

Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/musb/musb_dsps.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 23a0df79ef21..1e6d78b1334e 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -227,8 +227,13 @@ static int dsps_check_status(struct musb *musb, void *unused)
 
 	switch (musb->xceiv->otg->state) {
 	case OTG_STATE_A_WAIT_VRISE:
-		dsps_mod_timer_optional(glue);
-		break;
+		if (musb->port_mode == MUSB_HOST) {
+			musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
+			dsps_mod_timer_optional(glue);
+			break;
+		}
+		/* fall through */
+
 	case OTG_STATE_A_WAIT_BCON:
 		/* keep VBUS on for host-only mode */
 		if (musb->port_mode == MUSB_HOST) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 200/352] usb: musb: dsps: fix runtime pm for peripheral mode
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 199/352] usb: musb: dsps: fix otg state machine Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 201/352] perf header: Fix up argument to ctime() Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Bin Liu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 54578ee883e34d2d1c518d48f1c1e2dd3f387188 ]

Since the runtime PM support was added in musb, dsps relies on the timer
calling otg_timer() to activate the usb subsystem. However the driver
doesn't enable the timer for peripheral port, then the peripheral port is
unable to be enumerated by a host if the other usb port is disabled or in
peripheral mode too.

So let's start the timer for peripheral port too.

Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/musb/musb_dsps.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 1e6d78b1334e..403eb97915f8 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -181,9 +181,11 @@ static void dsps_musb_enable(struct musb *musb)
 
 	musb_writel(reg_base, wrp->epintr_set, epmask);
 	musb_writel(reg_base, wrp->coreintr_set, coremask);
-	/* start polling for ID change in dual-role idle mode */
-	if (musb->xceiv->otg->state == OTG_STATE_B_IDLE &&
-			musb->port_mode == MUSB_OTG)
+	/*
+	 * start polling for runtime PM active and idle,
+	 * and for ID change in dual-role idle mode.
+	 */
+	if (musb->xceiv->otg->state == OTG_STATE_B_IDLE)
 		dsps_mod_timer(glue, -1);
 }
 
@@ -254,6 +256,10 @@ static int dsps_check_status(struct musb *musb, void *unused)
 				musb->xceiv->otg->state = OTG_STATE_A_IDLE;
 				MUSB_HST_MODE(musb);
 			}
+
+			if (musb->port_mode == MUSB_PERIPHERAL)
+				skip_session = 1;
+
 			if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
 				musb_writeb(mregs, MUSB_DEVCTL,
 					    MUSB_DEVCTL_SESSION);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 201/352] perf header: Fix up argument to ctime()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 200/352] usb: musb: dsps: fix runtime pm for peripheral mode Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 202/352] perf tools: Cast off_t to s64 to avoid warning on bionic libc Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0afcf29bab35d3785204cd9bd51693b231ad7181 ]

Reducing this noise when cross building to the Android NDK:

  util/header.c: In function 'perf_header__fprintf_info':
  util/header.c:2710:45: warning: pointer targets in passing argument 1 of 'ctime' differ in signedness [-Wpointer-sign]
    fprintf(fp, "# captured on    : %s", ctime(&st.st_ctime));
                                               ^
  In file included from util/../perf.h:5:0,
                   from util/evlist.h:11,
                   from util/header.c:22:
  /opt/android-ndk-r15c/platforms/android-26/arch-arm/usr/include/time.h:81:14: note: expected 'const time_t *' but argument is of type 'long unsigned int *'
   extern char* ctime(const time_t*) __LIBC_ABI_PUBLIC__;
                ^

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lkml.kernel.org/n/tip-6bz74zp080yhmtiwb36enso9@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/header.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 13a2251a37c5..05f40bb51a88 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2659,6 +2659,7 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
 	struct perf_header *header = &session->header;
 	int fd = perf_data__fd(session->data);
 	struct stat st;
+	time_t stctime;
 	int ret, bit;
 
 	hd.fp = fp;
@@ -2668,7 +2669,8 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
 	if (ret == -1)
 		return -1;
 
-	fprintf(fp, "# captured on    : %s", ctime(&st.st_ctime));
+	stctime = st.st_ctime;
+	fprintf(fp, "# captured on    : %s", ctime(&stctime));
 
 	fprintf(fp, "# header version : %u\n", header->version);
 	fprintf(fp, "# data offset    : %" PRIu64 "\n", header->data_offset);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 202/352] perf tools: Cast off_t to s64 to avoid warning on bionic libc
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 201/352] perf header: Fix up argument to ctime() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 203/352] percpu: convert spin_lock_irq to spin_lock_irqsave Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
	Namhyung Kim, Thomas Richter, Arnaldo Carvalho de Melo,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 866053bb644f754d1a93aaa9db9998fecf7a8978 ]

To avoid this warning:

    CC       /tmp/build/perf/util/s390-cpumsf.o
  util/s390-cpumsf.c: In function 's390_cpumsf_samples':
  util/s390-cpumsf.c:508:3: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'off_t' [-Wformat=]
     pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n",
     ^

Now the various Android cross toolchains used in the perf tools
container test builds are all clean and we can remove this:

  export EXTRA_MAKE_ARGS="WERROR=0"

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Link: https://lkml.kernel.org/n/tip-5rav4ccyb0sjciysz2i4p3sx@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/s390-cpumsf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/s390-cpumsf.c b/tools/perf/util/s390-cpumsf.c
index a2eeebbfb25f..68b2570304ec 100644
--- a/tools/perf/util/s390-cpumsf.c
+++ b/tools/perf/util/s390-cpumsf.c
@@ -506,7 +506,7 @@ static int s390_cpumsf_samples(struct s390_cpumsf_queue *sfq, u64 *ts)
 	aux_ts = get_trailer_time(buf);
 	if (!aux_ts) {
 		pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n",
-		       sfq->buffer->data_offset);
+		       (s64)sfq->buffer->data_offset);
 		aux_ts = ~0ULL;
 		goto out;
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 203/352] percpu: convert spin_lock_irq to spin_lock_irqsave.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 202/352] perf tools: Cast off_t to s64 to avoid warning on bionic libc Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 204/352] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tejun Heo, Dennis Zhou, Sasha Levin,
	Michael Cree

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6ab7d47bcbf0144a8cb81536c2cead4cde18acfe ]

>From Michael Cree:
  "Bisection lead to commit b38d08f3181c ("percpu: restructure
   locking") as being the cause of lockups at initial boot on
   the kernel built for generic Alpha.

   On a suggestion by Tejun Heo that:

   So, the only thing I can think of is that it's calling
   spin_unlock_irq() while irq handling isn't set up yet.
   Can you please try the followings?

   1. Convert all spin_[un]lock_irq() to
      spin_lock_irqsave/unlock_irqrestore()."

Fixes: b38d08f3181c ("percpu: restructure locking")
Reported-and-tested-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Dennis Zhou <dennis@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/percpu-km.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/percpu-km.c b/mm/percpu-km.c
index 38de70ab1a0d..0f643dc2dc65 100644
--- a/mm/percpu-km.c
+++ b/mm/percpu-km.c
@@ -50,6 +50,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 	const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
 	struct pcpu_chunk *chunk;
 	struct page *pages;
+	unsigned long flags;
 	int i;
 
 	chunk = pcpu_alloc_chunk(gfp);
@@ -68,9 +69,9 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 	chunk->data = pages;
 	chunk->base_addr = page_address(pages) - pcpu_group_offsets[0];
 
-	spin_lock_irq(&pcpu_lock);
+	spin_lock_irqsave(&pcpu_lock, flags);
 	pcpu_chunk_populated(chunk, 0, nr_pages, false);
-	spin_unlock_irq(&pcpu_lock);
+	spin_unlock_irqrestore(&pcpu_lock, flags);
 
 	pcpu_stats_chunk_alloc();
 	trace_percpu_create_chunk(chunk->base_addr);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 204/352] net: hns3: fix error handling int the hns3_get_vector_ring_chain
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 203/352] percpu: convert spin_lock_irq to spin_lock_irqsave Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 205/352] net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 ]

When hns3_get_vector_ring_chain() failed in the
hns3_nic_init_vector_data(), it should do the error handling instead
of return directly.

Also, cur_chain should be freed instead of chain and head->next should
be set to NULL in error handling of hns3_get_vector_ring_chain.

This patch fixes them.

Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 20fcf0d1c2ce..4aea3f57586e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2783,9 +2783,10 @@ err_free_chain:
 	cur_chain = head->next;
 	while (cur_chain) {
 		chain = cur_chain->next;
-		devm_kfree(&pdev->dev, chain);
+		devm_kfree(&pdev->dev, cur_chain);
 		cur_chain = chain;
 	}
+	head->next = NULL;
 
 	return -ENOMEM;
 }
@@ -2876,7 +2877,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
 		ret = hns3_get_vector_ring_chain(tqp_vector,
 						 &vector_ring_chain);
 		if (ret)
-			return ret;
+			goto map_ring_fail;
 
 		ret = h->ae_algo->ops->map_ring_to_vector(h,
 			tqp_vector->vector_irq, &vector_ring_chain);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 205/352] net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 204/352] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 206/352] drm/amd/display: Add retry to read ddc_clock pin Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ae6017a71115ebc4e5c1a3f0f451319ab3f5c447 ]

In the hns3_nic_uninit_vector_data(), the procedure of uninitializing
the tqp_vector's IRQ has not set affinity_notify to NULL and changes
its init flag. This patch fixes it. And for simplificaton, local
variable tqp_vector is used instead of priv->tqp_vector[i].

Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 4aea3f57586e..85d534a24f2c 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2971,12 +2971,12 @@ static int hns3_nic_uninit_vector_data(struct hns3_nic_priv *priv)
 
 		hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
 
-		if (priv->tqp_vector[i].irq_init_flag == HNS3_VECTOR_INITED) {
-			(void)irq_set_affinity_hint(
-				priv->tqp_vector[i].vector_irq,
-						    NULL);
-			free_irq(priv->tqp_vector[i].vector_irq,
-				 &priv->tqp_vector[i]);
+		if (tqp_vector->irq_init_flag == HNS3_VECTOR_INITED) {
+			irq_set_affinity_notifier(tqp_vector->vector_irq,
+						  NULL);
+			irq_set_affinity_hint(tqp_vector->vector_irq, NULL);
+			free_irq(tqp_vector->vector_irq, tqp_vector);
+			tqp_vector->irq_init_flag = HNS3_VECTOR_NOT_INITED;
 		}
 
 		priv->ring_data[i].ring->irq_init_flag = HNS3_VECTOR_NOT_INITED;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 206/352] drm/amd/display: Add retry to read ddc_clock pin
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 205/352] net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 207/352] drm/amd/display: Wait edp HPD to high in detect_sink Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Hsieh, Eric Yang, Leo Li,
	Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit bd4905a9583c760da31ded7256dca6f71483c3dc ]

[WHY]
On customer board, there is one pluse (1v , < 1ms) on
DDC_CLK pin when plug / unplug DP cable. Driver will read
it and config DP to HDMI/DVI dongle.

[HOW]
If there is a real dongle, DDC_CLK should be always pull high.
Try to read again to recovery this special case. Retry times = 3.
Need additional 3ms to detect DP passive dongle(3 failures)

Signed-off-by: Paul Hsieh <paul.hsieh@amd.com>
Reviewed-by: Eric Yang <eric.yang2@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link.c | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 5141c1401889..ef1b350a45e0 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -332,7 +332,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
 {
 	enum gpio_result gpio_result;
 	uint32_t clock_pin = 0;
-
+	uint8_t retry = 0;
 	struct ddc *ddc;
 
 	enum connector_id connector_id =
@@ -361,11 +361,22 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
 		return present;
 	}
 
-	/* Read GPIO: DP sink is present if both clock and data pins are zero */
-	/* [anaumov] in DAL2, there was no check for GPIO failure */
-
-	gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin);
-	ASSERT(gpio_result == GPIO_RESULT_OK);
+	/*
+	 * Read GPIO: DP sink is present if both clock and data pins are zero
+	 *
+	 * [W/A] plug-unplug DP cable, sometimes customer board has
+	 * one short pulse on clk_pin(1V, < 1ms). DP will be config to HDMI/DVI
+	 * then monitor can't br light up. Add retry 3 times
+	 * But in real passive dongle, it need additional 3ms to detect
+	 */
+	do {
+		gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin);
+		ASSERT(gpio_result == GPIO_RESULT_OK);
+		if (clock_pin)
+			udelay(1000);
+		else
+			break;
+	} while (retry++ < 3);
 
 	present = (gpio_result == GPIO_RESULT_OK) && !clock_pin;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 207/352] drm/amd/display: Wait edp HPD to high in detect_sink
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 206/352] drm/amd/display: Add retry to read ddc_clock pin Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 208/352] Bluetooth: hci_bcm: Handle deferred probing for the clock supply Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dale Zhao, Eric Yang, Leo Li,
	Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0a6414e75d231ee1bb7ffb2f5eb246b682a884cd ]

[Why]
In 99% user case, edp will be post by vbios.
In 1% / current case: Lenovo don't light up edp panel in vbios
post stage, vbios won't be lit up. Thus in dal when we init DCN
10 hw, we power up edp, then we start detect_sink, but internal
time is too short, when we detect it, HPD is still low, so we don't
detect the edp, and edp shows black.

[How]
When we init hw, we wait edp HPD to high after power up edp.

Signed-off-by: Dale Zhao <dale.zhao@amd.com>
Reviewed-by: Eric Yang <eric.yang2@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index ef1b350a45e0..8b69913b6943 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -208,6 +208,9 @@ bool dc_link_detect_sink(struct dc_link *link, enum dc_connection_type *type)
 		return true;
 	}
 
+	if (link->connector_signal == SIGNAL_TYPE_EDP)
+		link->dc->hwss.edp_wait_for_hpd_ready(link, true);
+
 	/* todo: may need to lock gpio access */
 	hpd_pin = get_hpd_gpio(link->ctx->dc_bios, link->link_id, link->ctx->gpio_service);
 	if (hpd_pin == NULL)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 208/352] Bluetooth: hci_bcm: Handle deferred probing for the clock supply
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 207/352] drm/amd/display: Wait edp HPD to high in detect_sink Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 209/352] drm/amd/display: fix YCbCr420 blank color Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Jirman, Chen-Yu Tsai,
	Marcel Holtmann, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 28ac03b9ac3f784c2f048a910c8d0a7a87483b66 ]

On some systems that actually have the bluetooth controller wired up
with an extra clock signal, it's possible the bluetooth controller
probes before the clock provider. clk_get would return a defer probe
error, which was not handled by this driver.

Handle this properly, so that these systems can work reliably.

Tested-by: Ondrej Jirman <megous@megous.com>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_bcm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index ddbd8c6a0ceb..800132369134 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -907,6 +907,10 @@ static int bcm_get_resources(struct bcm_device *dev)
 
 	dev->clk = devm_clk_get(dev->dev, NULL);
 
+	/* Handle deferred probing */
+	if (dev->clk == ERR_PTR(-EPROBE_DEFER))
+		return PTR_ERR(dev->clk);
+
 	dev->device_wakeup = devm_gpiod_get_optional(dev->dev, "device-wakeup",
 						     GPIOD_OUT_LOW);
 	if (IS_ERR(dev->device_wakeup))
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 209/352] drm/amd/display: fix YCbCr420 blank color
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 208/352] Bluetooth: hci_bcm: Handle deferred probing for the clock supply Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 210/352] powerpc/uaccess: fix warning/error with access_ok() Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Yang, Hugo Hu, Leo Li,
	Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 12750d1647f118496f1da727146f255f5e44d500 ]

[Why]
YCbCr420 packing format uses two chanels for luma, and 1
channel for both chroma component. Our previous implementation
did not account for this and results in every other pixel having
very high luma value, showing greyish color instead of black.

YCbCr444 = <Y1, Cb1, Cr1>; <Y2, Cb2, Cr2> .....
YCbCr420 = <Y1, Y2,  Cb1>; <Y3, Y4,  Cr1> .....

[How]
Program the second channel with the black color value for luma
as well.

Signed-off-by: Eric Yang <Eric.Yang2@amd.com>
Reviewed-by: Hugo Hu <Hugo.Hu@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/display/dc/dce110/dce110_hw_sequencer.c   | 11 ++++++++++-
 .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c |  9 +++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index a6bcb90e8419..4443a916a0fb 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1268,10 +1268,19 @@ static void program_scaler(const struct dc *dc,
 		pipe_ctx->plane_res.scl_data.lb_params.depth,
 		&pipe_ctx->stream->bit_depth_params);
 
-	if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color)
+	if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color) {
+		/*
+		 * The way 420 is packed, 2 channels carry Y component, 1 channel
+		 * alternate between Cb and Cr, so both channels need the pixel
+		 * value for Y
+		 */
+		if (pipe_ctx->stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
+			color.color_r_cr = color.color_g_y;
+
 		pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color(
 				pipe_ctx->stream_res.tg,
 				&color);
+	}
 
 	pipe_ctx->plane_res.xfm->funcs->transform_set_scaler(pipe_ctx->plane_res.xfm,
 		&pipe_ctx->plane_res.scl_data);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 32e4c653b1b4..220ba828748d 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2165,6 +2165,15 @@ static void dcn10_blank_pixel_data(
 	color_space = stream->output_color_space;
 	color_space_to_black_color(dc, color_space, &black_color);
 
+	/*
+	 * The way 420 is packed, 2 channels carry Y component, 1 channel
+	 * alternate between Cb and Cr, so both channels need the pixel
+	 * value for Y
+	 */
+	if (stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
+		black_color.color_r_cr = black_color.color_g_y;
+
+
 	if (stream_res->tg->funcs->set_blank_color)
 		stream_res->tg->funcs->set_blank_color(
 				stream_res->tg,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 210/352] powerpc/uaccess: fix warning/error with access_ok()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 209/352] drm/amd/display: fix YCbCr420 blank color Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 211/352] mac80211: fix radiotap vendor presence bitmap handling Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 05a4ab823983d9136a460b7b5e0d49ee709a6f86 ]

With the following piece of code, the following compilation warning
is encountered:

	if (_IOC_DIR(ioc) != _IOC_NONE) {
		int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ;

		if (!access_ok(verify, ioarg, _IOC_SIZE(ioc))) {

drivers/platform/test/dev.c: In function 'my_ioctl':
drivers/platform/test/dev.c:219:7: warning: unused variable 'verify' [-Wunused-variable]
   int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ;

This patch fixes it by referencing 'type' in the macro allthough
doing nothing with it.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/uaccess.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 15bea9a0f260..ebc0b916dcf9 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -63,7 +63,7 @@ static inline int __access_ok(unsigned long addr, unsigned long size,
 #endif
 
 #define access_ok(type, addr, size)		\
-	(__chk_user_ptr(addr),			\
+	(__chk_user_ptr(addr), (void)(type),		\
 	 __access_ok((__force unsigned long)(addr), (size), get_fs()))
 
 /*
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 211/352] mac80211: fix radiotap vendor presence bitmap handling
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 210/352] powerpc/uaccess: fix warning/error with access_ok() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 212/352] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit efc38dd7d5fa5c8cdd0c917c5d00947aa0539443 ]

Due to the alignment handling, it actually matters where in the code
we add the 4 bytes for the presence bitmap to the length; the first
field is the timestamp with 8 byte alignment so we need to add the
space for the extra vendor namespace presence bitmap *before* we do
any alignment for the fields.

Move the presence bitmap length accounting to the right place to fix
the alignment for the data properly.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 77d996a60f12..85c365fc7a0c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -143,6 +143,9 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
 	/* allocate extra bitmaps */
 	if (status->chains)
 		len += 4 * hweight8(status->chains);
+	/* vendor presence bitmap */
+	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
+		len += 4;
 
 	if (ieee80211_have_rx_timestamp(status)) {
 		len = ALIGN(len, 8);
@@ -207,8 +210,6 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
 	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 		struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
 
-		/* vendor presence bitmap */
-		len += 4;
 		/* alignment for fixed 6-byte vendor data header */
 		len = ALIGN(len, 2);
 		/* vendor data header */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 212/352] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 211/352] mac80211: fix radiotap vendor presence bitmap handling Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 213/352] mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Steffen Klassert, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit fa89a4593b927b3f59c3b69379f31d3b22272e4e ]

gcc warn this:

net/ipv6/xfrm6_tunnel.c:143 __xfrm6_tunnel_alloc_spi() warn:
 always true condition '(spi <= 4294967295) => (0-u32max <= u32max)'

'spi' is u32, which always not greater than XFRM6_TUNNEL_SPI_MAX
because of wrap around. So the second forloop will never reach.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/xfrm6_tunnel.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 4a46df8441c9..f5b4febeaa25 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -144,6 +144,9 @@ static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
 		index = __xfrm6_tunnel_spi_check(net, spi);
 		if (index >= 0)
 			goto alloc_spi;
+
+		if (spi == XFRM6_TUNNEL_SPI_MAX)
+			break;
 	}
 	for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) {
 		index = __xfrm6_tunnel_spi_check(net, spi);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 213/352] mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 212/352] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 214/352] scsi: smartpqi: correct host serial num for ssa Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Petr Machata,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit be2d6f421f680e01d58f7cd452646e0d8586d49b ]

When a LAG device or a VLAN device on top of it is enslaved to a bridge,
the driver propagates the CHANGEUPPER event to the LAG's slaves.

This causes each physical port to increase the reference count of the
internal representation of the bridge port by calling
mlxsw_sp_port_bridge_join().

However, when a port is removed from a LAG, the corresponding leave()
function is not called and the reference count is not decremented. This
leads to ugly hacks such as mlxsw_sp_bridge_port_should_destroy() that
try to understand if the bridge port should be destroyed even when its
reference count is not 0.

Instead, make sure that when a port is unlinked from a LAG it would see
the same events as if the LAG (or its uppers) were unlinked from a
bridge.

The above is achieved by walking the LAG's uppers when a port is
unlinked and calling mlxsw_sp_port_bridge_leave() for each upper that is
enslaved to a bridge.

Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlxsw/spectrum.c    | 23 ++++++++++++++++
 .../mellanox/mlxsw/spectrum_switchdev.c       | 27 +------------------
 2 files changed, 24 insertions(+), 26 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 124aee09e953..8f1180fff955 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4298,6 +4298,25 @@ void mlxsw_sp_port_dev_put(struct mlxsw_sp_port *mlxsw_sp_port)
 	dev_put(mlxsw_sp_port->dev);
 }
 
+static void
+mlxsw_sp_port_lag_uppers_cleanup(struct mlxsw_sp_port *mlxsw_sp_port,
+				 struct net_device *lag_dev)
+{
+	struct net_device *br_dev = netdev_master_upper_dev_get(lag_dev);
+	struct net_device *upper_dev;
+	struct list_head *iter;
+
+	if (netif_is_bridge_port(lag_dev))
+		mlxsw_sp_port_bridge_leave(mlxsw_sp_port, lag_dev, br_dev);
+
+	netdev_for_each_upper_dev_rcu(lag_dev, upper_dev, iter) {
+		if (!netif_is_bridge_port(upper_dev))
+			continue;
+		br_dev = netdev_master_upper_dev_get(upper_dev);
+		mlxsw_sp_port_bridge_leave(mlxsw_sp_port, upper_dev, br_dev);
+	}
+}
+
 static int mlxsw_sp_lag_create(struct mlxsw_sp *mlxsw_sp, u16 lag_id)
 {
 	char sldr_pl[MLXSW_REG_SLDR_LEN];
@@ -4490,6 +4509,10 @@ static void mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port,
 
 	/* Any VLANs configured on the port are no longer valid */
 	mlxsw_sp_port_vlan_flush(mlxsw_sp_port);
+	/* Make the LAG and its directly linked uppers leave bridges they
+	 * are memeber in
+	 */
+	mlxsw_sp_port_lag_uppers_cleanup(mlxsw_sp_port, lag_dev);
 
 	if (lag->ref_count == 1)
 		mlxsw_sp_lag_destroy(mlxsw_sp, lag_id);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 69f556ddb934..c514af438fc2 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -292,30 +292,6 @@ mlxsw_sp_bridge_port_destroy(struct mlxsw_sp_bridge_port *bridge_port)
 	kfree(bridge_port);
 }
 
-static bool
-mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port *
-				    bridge_port)
-{
-	struct net_device *dev = bridge_port->dev;
-	struct mlxsw_sp *mlxsw_sp;
-
-	if (is_vlan_dev(dev))
-		mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev));
-	else
-		mlxsw_sp = mlxsw_sp_lower_get(dev);
-
-	/* In case ports were pulled from out of a bridged LAG, then
-	 * it's possible the reference count isn't zero, yet the bridge
-	 * port should be destroyed, as it's no longer an upper of ours.
-	 */
-	if (!mlxsw_sp && list_empty(&bridge_port->vlans_list))
-		return true;
-	else if (bridge_port->ref_count == 0)
-		return true;
-	else
-		return false;
-}
-
 static struct mlxsw_sp_bridge_port *
 mlxsw_sp_bridge_port_get(struct mlxsw_sp_bridge *bridge,
 			 struct net_device *brport_dev)
@@ -353,8 +329,7 @@ static void mlxsw_sp_bridge_port_put(struct mlxsw_sp_bridge *bridge,
 {
 	struct mlxsw_sp_bridge_device *bridge_device;
 
-	bridge_port->ref_count--;
-	if (!mlxsw_sp_bridge_port_should_destroy(bridge_port))
+	if (--bridge_port->ref_count != 0)
 		return;
 	bridge_device = bridge_port->bridge_device;
 	mlxsw_sp_bridge_port_destroy(bridge_port);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 214/352] scsi: smartpqi: correct host serial num for ssa
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 213/352] mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 215/352] scsi: smartpqi: correct volume status Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Scott Benesh, Ajish Koshy,
	Murthy Bhat, Mahesh Rajashekhara, Dave Carroll, Scott Teel,
	Kevin Barnett, Don Brace, Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b2346b5030cf9458f30a84028d9fe904b8c942a7 ]

Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
Reviewed-by: Ajish Koshy <ajish.koshy@microsemi.com>
Reviewed-by: Murthy Bhat <murthy.bhat@microsemi.com>
Reviewed-by: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 6f4cb3be97aa..5a86dddbd8ba 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -640,6 +640,7 @@ struct bmic_host_wellness_driver_version {
 	u8	driver_version_tag[2];
 	__le16	driver_version_length;
 	char	driver_version[32];
+	u8	dont_write_tag[2];
 	u8	end_tag[2];
 };
 
@@ -669,6 +670,8 @@ static int pqi_write_driver_version_to_host_wellness(
 	strncpy(buffer->driver_version, "Linux " DRIVER_VERSION,
 		sizeof(buffer->driver_version) - 1);
 	buffer->driver_version[sizeof(buffer->driver_version) - 1] = '\0';
+	buffer->dont_write_tag[0] = 'D';
+	buffer->dont_write_tag[1] = 'W';
 	buffer->end_tag[0] = 'Z';
 	buffer->end_tag[1] = 'Z';
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 215/352] scsi: smartpqi: correct volume status
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 214/352] scsi: smartpqi: correct host serial num for ssa Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 216/352] scsi: smartpqi: increase fw status register read timeout Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Murthy Bhat, Mahesh Rajashekhara,
	Scott Teel, Kevin Barnett, Dave Carroll, Don Brace,
	Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7ff44499bafbd376115f0bb6b578d980f56ee13b ]

- fix race condition when a unit is deleted after an RLL,
  and before we have gotten the LV_STATUS page of the unit.
  - In this case we will get a standard inquiry, rather than
    the desired page.  This will result in a unit presented
    which no longer exists.
  - If we ask for LV_STATUS, insure we get LV_STATUS

Reviewed-by: Murthy Bhat <murthy.bhat@microsemi.com>
Reviewed-by: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5a86dddbd8ba..489e5cbbcbba 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -1168,6 +1168,9 @@ static void pqi_get_volume_status(struct pqi_ctrl_info *ctrl_info,
 	if (rc)
 		goto out;
 
+	if (vpd->page_code != CISS_VPD_LV_STATUS)
+		goto out;
+
 	page_length = offsetof(struct ciss_vpd_logical_volume_status,
 		volume_status) + vpd->page_length;
 	if (page_length < sizeof(*vpd))
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 216/352] scsi: smartpqi: increase fw status register read timeout
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 215/352] scsi: smartpqi: correct volume status Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 217/352] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Feng Li, Ajish Koshy, Murthy Bhat,
	Dave Carroll, Kevin Barnett, Mahesh Rajashekhara, Don Brace,
	Martin K. Petersen, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 65111785acccb836ec75263b03b0e33f21e74f47 ]

Problem:
 - during the driver initialization, driver will poll fw
   for KERNEL_UP in a 30 seconds timeout.

 - if the firmware is not ready after 30 seconds,
   driver will not be loaded.

Fix:
 - change timeout from 30 seconds to 3 minutes.

Reported-by: Feng Li <lifeng1519@gmail.com>
Reviewed-by: Ajish Koshy <ajish.koshy@microsemi.com>
Reviewed-by: Murthy Bhat <Murthy.Bhat@microsemi.com>
Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/smartpqi/smartpqi_sis.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/smartpqi/smartpqi_sis.c b/drivers/scsi/smartpqi/smartpqi_sis.c
index ea91658c7060..9d3043df22af 100644
--- a/drivers/scsi/smartpqi/smartpqi_sis.c
+++ b/drivers/scsi/smartpqi/smartpqi_sis.c
@@ -59,7 +59,7 @@
 
 #define SIS_CTRL_KERNEL_UP			0x80
 #define SIS_CTRL_KERNEL_PANIC			0x100
-#define SIS_CTRL_READY_TIMEOUT_SECS		30
+#define SIS_CTRL_READY_TIMEOUT_SECS		180
 #define SIS_CTRL_READY_RESUME_TIMEOUT_SECS	90
 #define SIS_CTRL_READY_POLL_INTERVAL_MSECS	10
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 217/352] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 216/352] scsi: smartpqi: increase fw status register read timeout Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 218/352] net: hns3: add max vector number check for pf Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f68ef64cd7feb1220232bd8f501d8aad340a099 ]

The function cw1200_bss_info_changed() and cw1200_hw_scan() can be
concurrently executed.
The two functions both access a possible shared variable "frame.skb".

This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(),
which is called by cw1200_bss_info_changed(). The free operation is
protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed().

In cw1200_hw_scan(), this shared variable is accessed without the
protection of the mutex lock "priv->conf_mutex".
Thus, concurrency use-after-free bugs may occur.

To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and
mutex_unlock(&priv->conf_mutex) are moved to the places, which can
protect the accesses to the shared variable.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/st/cw1200/scan.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
index 67213f11acbd..0a9eac93dd01 100644
--- a/drivers/net/wireless/st/cw1200/scan.c
+++ b/drivers/net/wireless/st/cw1200/scan.c
@@ -78,6 +78,10 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
 	if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS)
 		return -EINVAL;
 
+	/* will be unlocked in cw1200_scan_work() */
+	down(&priv->scan.lock);
+	mutex_lock(&priv->conf_mutex);
+
 	frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
 		req->ie_len);
 	if (!frame.skb)
@@ -86,19 +90,15 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
 	if (req->ie_len)
 		skb_put_data(frame.skb, req->ie, req->ie_len);
 
-	/* will be unlocked in cw1200_scan_work() */
-	down(&priv->scan.lock);
-	mutex_lock(&priv->conf_mutex);
-
 	ret = wsm_set_template_frame(priv, &frame);
 	if (!ret) {
 		/* Host want to be the probe responder. */
 		ret = wsm_set_probe_responder(priv, true);
 	}
 	if (ret) {
+		dev_kfree_skb(frame.skb);
 		mutex_unlock(&priv->conf_mutex);
 		up(&priv->scan.lock);
-		dev_kfree_skb(frame.skb);
 		return ret;
 	}
 
@@ -120,10 +120,9 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
 		++priv->scan.n_ssids;
 	}
 
-	mutex_unlock(&priv->conf_mutex);
-
 	if (frame.skb)
 		dev_kfree_skb(frame.skb);
+	mutex_unlock(&priv->conf_mutex);
 	queue_work(priv->workqueue, &priv->scan.work);
 	return 0;
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 218/352] net: hns3: add max vector number check for pf
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 217/352] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 219/352] net: hns3: fix the descriptor index when get rss type Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian Shen, Peng Li, David S. Miller,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 75edb610860fda65ceedb017fc69afabd2806b8b ]

Each pf supports max 64 vectors and 128 tqps. For 2p/4p core scenario,
there may be more than 64 cpus online. So the result of min_t(u16,
num_Online_cpus(), tqp_num) may be more than 64. This patch adds check
for the vector number.

Fixes: dd38c72604dc ("net: hns3: fix for coalesce configuration lost during reset")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 85d534a24f2c..beb5dbd5e98d 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2902,6 +2902,8 @@ map_ring_fail:
 
 static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
 {
+#define HNS3_VECTOR_PF_MAX_NUM		64
+
 	struct hnae3_handle *h = priv->ae_handle;
 	struct hns3_enet_tqp_vector *tqp_vector;
 	struct hnae3_vector_info *vector;
@@ -2914,6 +2916,8 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
 	/* RSS size, cpu online and vector_num should be the same */
 	/* Should consider 2p/4p later */
 	vector_num = min_t(u16, num_online_cpus(), tqp_num);
+	vector_num = min_t(u16, vector_num, HNS3_VECTOR_PF_MAX_NUM);
+
 	vector = devm_kcalloc(&pdev->dev, vector_num, sizeof(*vector),
 			      GFP_KERNEL);
 	if (!vector)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 219/352] net: hns3: fix the descriptor index when get rss type
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 218/352] net: hns3: add max vector number check for pf Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 220/352] net: hns3: dont restore rules when flow director is disabled Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peng Li, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 31a16f99e02c2e0b40a5fb05d66f5e56721027e2 ]

Driver gets rss information from the last descriptor of the packet.
When driver handle the rss type, ring->next_to_clean indicates the
first descriptor of next packet.

This patch fix the descriptor index with "ring->next_to_clean - 1".

Fixes: 232fc64b6e62 ("net: hns3: Add HW RSS hash information to RX skb")
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index beb5dbd5e98d..d424d5bc0507 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2332,9 +2332,16 @@ static bool hns3_parse_vlan_tag(struct hns3_enet_ring *ring,
 static void hns3_set_rx_skb_rss_type(struct hns3_enet_ring *ring,
 				     struct sk_buff *skb)
 {
-	struct hns3_desc *desc = &ring->desc[ring->next_to_clean];
 	struct hnae3_handle *handle = ring->tqp->handle;
 	enum pkt_hash_types rss_type;
+	struct hns3_desc *desc;
+	int last_bd;
+
+	/* When driver handle the rss type, ring->next_to_clean indicates the
+	 * first descriptor of next packet, need -1 here.
+	 */
+	last_bd = (ring->next_to_clean - 1 + ring->desc_num) % ring->desc_num;
+	desc = &ring->desc[last_bd];
 
 	if (le32_to_cpu(desc->rx.rss_hash))
 		rss_type = handle->kinfo.rss_type;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 220/352] net: hns3: dont restore rules when flow director is disabled
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 219/352] net: hns3: fix the descriptor index when get rss type Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 221/352] powerpc/perf: Fix thresholding counter data for unknown type Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian Shen, Peng Li, David S. Miller,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8edc2285b7285c5fbffe438dc8113260d3e76656 ]

When user disables flow director, all the rules will be disabled. But
when reset happens, it will restore all the rules again. It's not
reasonable. This patch fixes it by add flow director status check before
restore fules.

Fixes: 6871af29b3ab ("net: hns3: Add reset handle for flow director")
Fixes: c17852a8932f ("net: hns3: Add support for enable/disable flow director")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index ffdd96020860..a7895aefe291 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -4339,6 +4339,10 @@ static int hclge_restore_fd_entries(struct hnae3_handle *handle)
 	if (!hnae3_dev_fd_supported(hdev))
 		return -EOPNOTSUPP;
 
+	/* if fd is disabled, should not restore it when reset */
+	if (!hdev->fd_cfg.fd_en)
+		return 0;
+
 	hlist_for_each_entry_safe(rule, node, &hdev->fd_rule_list, rule_node) {
 		ret = hclge_config_action(hdev, HCLGE_FD_STAGE_1, rule);
 		if (!ret)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 221/352] powerpc/perf: Fix thresholding counter data for unknown type
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 220/352] net: hns3: dont restore rules when flow director is disabled Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 222/352] iwlwifi: mvm: fix setting HE ppe FW config Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Madhavan Srinivasan,
	Michael Ellerman, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 17cfccc91545682513541924245abb876d296063 ]

MMCRA[34:36] and MMCRA[38:44] expose the thresholding counter value.
Thresholding counter can be used to count latency cycles such as
load miss to reload. But threshold counter value is not relevant
when the sampled instruction type is unknown or reserved. Patch to
fix the thresholding counter value to zero when sampled instruction
type is unknown or reserved.

Fixes: 170a315f41c6('powerpc/perf: Support to export MMCRA[TEC*] field to userspace')
Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/isa207-common.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index 177de814286f..6a2f65d3d088 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -226,8 +226,13 @@ void isa207_get_mem_weight(u64 *weight)
 	u64 mmcra = mfspr(SPRN_MMCRA);
 	u64 exp = MMCRA_THR_CTR_EXP(mmcra);
 	u64 mantissa = MMCRA_THR_CTR_MANT(mmcra);
+	u64 sier = mfspr(SPRN_SIER);
+	u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
 
-	*weight = mantissa << (2 * exp);
+	if (val == 0 || val == 7)
+		*weight = 0;
+	else
+		*weight = mantissa << (2 * exp);
 }
 
 int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 222/352] iwlwifi: mvm: fix setting HE ppe FW config
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 221/352] powerpc/perf: Fix thresholding counter data for unknown type Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 223/352] powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naftali Goldstein, Luca Coelho,
	Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 189b8d441b0f7825f0b4278851c52afaa0515ed2 ]

The FW expects to get the ppe value for each NSS-BW pair in the same
format as in the he phy capabilities IE, which means that a value of 0
implies ppe should be used for BPSK (mcs 0). If there are no PPE
thresholds in the IE, or if for some NSS-RU pair there's no threshold
set for it (this could happen because it's a variable-sized field), it
means no PPE should not be used for that pair, so the value sent to FW
should be 7 which corresponds to "none".

Fixes: 514c30696fbc ("iwlwifi: add support for IEEE802.11ax")
Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/api/mac.h   | 2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
index 1dd23f846fb9..f3ccd7948340 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
@@ -442,7 +442,7 @@ struct iwl_he_backoff_conf {
  * Support for Nss x BW (or RU) matrix:
  *	(0=SISO, 1=MIMO2) x (0-20MHz, 1-40MHz, 2-80MHz, 3-160MHz)
  * Each entry contains 2 QAM thresholds for 8us and 16us:
- *	0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6/7=RES
+ *	0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6=RES, 7=NONE
  * i.e. QAM_th1 < QAM_th2 such if TX uses QAM_tx:
  *	QAM_tx < QAM_th1            --> PPE=0us
  *	QAM_th1 <= QAM_tx < QAM_th2 --> PPE=8us
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 00f831d88366..5a42c617c54c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2005,7 +2005,13 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
 	if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
 
-	/* If PPE Thresholds exist, parse them into a FW-familiar format */
+	/*
+	 * Initialize the PPE thresholds to "None" (7), as described in Table
+	 * 9-262ac of 80211.ax/D3.0.
+	 */
+	memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
+
+	/* If PPE Thresholds exist, parse them into a FW-familiar format. */
 	if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
 	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
 		u8 nss = (sta->he_cap.ppe_thres[0] &
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 223/352] powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 222/352] iwlwifi: mvm: fix setting HE ppe FW config Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 224/352] mlx5: update timecounter at least twice per counter overflow Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, David Gibson,
	Michael Ellerman, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit bdbf649efe21173cae63b4b71db84176420f9039 ]

The powernv platform maintains 2 TCE tables for VFIO - a hardware TCE
table and a table with userspace addresses; the latter is used for
marking pages dirty when corresponging TCEs are unmapped from
the hardware table.

a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels
on demand") enabled on-demand allocation of the hardware table,
however it missed the other table so it has still been fully allocated
at the boot time. This fixes the issue by allocating a single level,
just like we do for the hardware table.

Fixes: a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/powernv/pci-ioda-tce.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
index fe9691040f54..7639b2168755 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
@@ -299,7 +299,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
 	if (alloc_userspace_copy) {
 		offset = 0;
 		uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
-				levels, tce_table_size, &offset,
+				tmplevels, tce_table_size, &offset,
 				&total_allocated_uas);
 		if (!uas)
 			goto free_tces_exit;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 224/352] mlx5: update timecounter at least twice per counter overflow
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 223/352] powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 225/352] drbd: narrow rcu_read_lock in drbd_sync_handshake Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Cochran, Ariel Levkovich,
	Saeed Mahameed, Miroslav Lichvar, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5d8678365c90b9ce1fd2243ff5ea562609f6cec1 ]

The timecounter needs to be updated at least once in half of the
cyclecounter interval to prevent timecounter_cyc2time() interpreting a
new timestamp as an old value and causing a backward jump.

This would be an issue if the timecounter multiplier was so small that
the update interval would not be limited by the 64-bit overflow in
multiplication.

Shorten the calculated interval to make sure the timecounter is updated
in time even when the system clock is slowed down by up to 10%, the
multiplier is increased by up to 10%, and the scheduled overflow check
is late by 15%.

Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Ariel Levkovich <lariel@mellanox.com>
Cc: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 0d90b1b4a3d3..2d6168ee99e8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -511,14 +511,14 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
 			 ktime_to_ns(ktime_get_real()));
 
 	/* Calculate period in seconds to call the overflow watchdog - to make
-	 * sure counter is checked at least once every wrap around.
+	 * sure counter is checked at least twice every wrap around.
 	 * The period is calculated as the minimum between max HW cycles count
 	 * (The clock source mask) and max amount of cycles that can be
 	 * multiplied by clock multiplier where the result doesn't exceed
 	 * 64bits.
 	 */
 	overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult);
-	overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1);
+	overflow_cycles = min(overflow_cycles, div_u64(clock->cycles.mask, 3));
 
 	ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles,
 				 frac, &frac);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 225/352] drbd: narrow rcu_read_lock in drbd_sync_handshake
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 224/352] mlx5: update timecounter at least twice per counter overflow Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 226/352] drbd: disconnect, if the wrong UUIDs are attached on a connected peer Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, Lars Ellenberg,
	Roland Kammerer, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d29e89e34952a9ad02c77109c71a80043544296e ]

So far there was the possibility that we called
genlmsg_new(GFP_NOIO)/mutex_lock() while holding an rcu_read_lock().

This included cases like:

drbd_sync_handshake (acquire the RCU lock)
  drbd_asb_recover_1p
    drbd_khelper
      drbd_bcast_event
        genlmsg_new(GFP_NOIO) --> may sleep

drbd_sync_handshake (acquire the RCU lock)
  drbd_asb_recover_1p
    drbd_khelper
      notify_helper
        genlmsg_new(GFP_NOIO) --> may sleep

drbd_sync_handshake (acquire the RCU lock)
  drbd_asb_recover_1p
    drbd_khelper
      notify_helper
        mutex_lock --> may sleep

While using GFP_ATOMIC whould have been possible in the first two cases,
the real fix is to narrow the rcu_read_lock.

Reported-by: Jia-Ju Bai <baijiaju1990@163.com>
Reviewed-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_receiver.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 61c392752fe4..1b9822f264d2 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3364,7 +3364,7 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
 	enum drbd_conns rv = C_MASK;
 	enum drbd_disk_state mydisk;
 	struct net_conf *nc;
-	int hg, rule_nr, rr_conflict, tentative;
+	int hg, rule_nr, rr_conflict, tentative, always_asbp;
 
 	mydisk = device->state.disk;
 	if (mydisk == D_NEGOTIATING)
@@ -3415,8 +3415,12 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
 
 	rcu_read_lock();
 	nc = rcu_dereference(peer_device->connection->net_conf);
+	always_asbp = nc->always_asbp;
+	rr_conflict = nc->rr_conflict;
+	tentative = nc->tentative;
+	rcu_read_unlock();
 
-	if (hg == 100 || (hg == -100 && nc->always_asbp)) {
+	if (hg == 100 || (hg == -100 && always_asbp)) {
 		int pcount = (device->state.role == R_PRIMARY)
 			   + (peer_role == R_PRIMARY);
 		int forced = (hg == -100);
@@ -3455,9 +3459,6 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
 			     "Sync from %s node\n",
 			     (hg < 0) ? "peer" : "this");
 	}
-	rr_conflict = nc->rr_conflict;
-	tentative = nc->tentative;
-	rcu_read_unlock();
 
 	if (hg == -100) {
 		/* FIXME this log message is not correct if we end up here
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 226/352] drbd: disconnect, if the wrong UUIDs are attached on a connected peer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 225/352] drbd: narrow rcu_read_lock in drbd_sync_handshake Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 227/352] drbd: skip spurious timeout (ping-timeo) when failing promote Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b17b59602b6dcf8f97a7dc7bc489a48388d7063a ]

With "on-no-data-accessible suspend-io", DRBD requires the next attach
or connect to be to the very same data generation uuid tag it lost last.

If we first lost connection to the peer,
then later lost connection to our own disk,
we would usually refuse to re-connect to the peer,
because it presents the wrong data set.

However, if the peer first connects without a disk,
and then attached its disk, we accepted that same wrong data set,
which would be "unexpected" by any user of that DRBD
and cause "undefined results" (read: very likely data corruption).

The fix is to forcefully disconnect as soon as we notice that the peer
attached to the "wrong" dataset.

Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_receiver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 1b9822f264d2..e3da52b524d3 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -4143,7 +4143,7 @@ static int receive_uuids(struct drbd_connection *connection, struct packet_info
 	kfree(device->p_uuid);
 	device->p_uuid = p_uuid;
 
-	if (device->state.conn < C_CONNECTED &&
+	if ((device->state.conn < C_CONNECTED || device->state.pdsk == D_DISKLESS) &&
 	    device->state.disk < D_INCONSISTENT &&
 	    device->state.role == R_PRIMARY &&
 	    (device->ed_uuid & ~((u64)1)) != (p_uuid[UI_CURRENT] & ~((u64)1))) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 227/352] drbd: skip spurious timeout (ping-timeo) when failing promote
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 226/352] drbd: disconnect, if the wrong UUIDs are attached on a connected peer Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 228/352] drbd: Avoid Clang warning about pointless switch statment Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9848b6ddd8c92305252f94592c5e278574e7a6ac ]

If you try to promote a Secondary while connected to a Primary
and allow-two-primaries is NOT set, we will wait for "ping-timeout"
to give this node a chance to detect a dead primary,
in case the cluster manager noticed faster than we did.

But if we then are *still* connected to a Primary,
we fail (after an additional timeout of ping-timout).

This change skips the spurious second timeout.

Most people won't notice really,
since "ping-timeout" by default is half a second.

But in some installations, ping-timeout may be 10 or 20 seconds or more,
and spuriously delaying the error return becomes annoying.

Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_nl.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index d15703b1ffe8..714503173150 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -668,14 +668,15 @@ drbd_set_role(struct drbd_device *const device, enum drbd_role new_role, int for
 		if (rv == SS_TWO_PRIMARIES) {
 			/* Maybe the peer is detected as dead very soon...
 			   retry at most once more in this case. */
-			int timeo;
-			rcu_read_lock();
-			nc = rcu_dereference(connection->net_conf);
-			timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
-			rcu_read_unlock();
-			schedule_timeout_interruptible(timeo);
-			if (try < max_tries)
+			if (try < max_tries) {
+				int timeo;
 				try = max_tries - 1;
+				rcu_read_lock();
+				nc = rcu_dereference(connection->net_conf);
+				timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
+				rcu_read_unlock();
+				schedule_timeout_interruptible(timeo);
+			}
 			continue;
 		}
 		if (rv < SS_SUCCESS) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 228/352] drbd: Avoid Clang warning about pointless switch statment
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 227/352] drbd: skip spurious timeout (ping-timeo) when failing promote Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 229/352] ath10k: fix kernel panic due to use after free Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Nathan Chancellor,
	Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a52c5a16cf19d8a85831bb1b915a221dd4ffae3c ]

There are several warnings from Clang about no case statement matching
the constant 0:

In file included from drivers/block/drbd/drbd_receiver.c:48:
In file included from drivers/block/drbd/drbd_int.h:48:
In file included from ./include/linux/drbd_genl_api.h:54:
In file included from ./include/linux/genl_magic_struct.h:236:
./include/linux/drbd_genl.h:321:1: warning: no case matching constant
switch condition '0'
GENL_struct(DRBD_NLA_HELPER, 24, drbd_helper_info,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/linux/genl_magic_struct.h:220:10: note: expanded from macro
'GENL_struct'
        switch (0) {
                ^

Silence this warning by adding a 'case 0:' statement. Additionally,
adjust the alignment of the statements in the ct_assert_unique macro to
avoid a checkpatch warning.

This solution was originally sent by Arnd Bergmann with a default case
statement: https://lore.kernel.org/patchwork/patch/756723/

Link: https://github.com/ClangBuiltLinux/linux/issues/43
Suggested-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/genl_magic_struct.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h
index 5972e4969197..eeae59d3ceb7 100644
--- a/include/linux/genl_magic_struct.h
+++ b/include/linux/genl_magic_struct.h
@@ -191,6 +191,7 @@ static inline void ct_assert_unique_operations(void)
 {
 	switch (0) {
 #include GENL_MAGIC_INCLUDE_FILE
+	case 0:
 		;
 	}
 }
@@ -209,6 +210,7 @@ static inline void ct_assert_unique_top_level_attributes(void)
 {
 	switch (0) {
 #include GENL_MAGIC_INCLUDE_FILE
+	case 0:
 		;
 	}
 }
@@ -218,7 +220,8 @@ static inline void ct_assert_unique_top_level_attributes(void)
 static inline void ct_assert_unique_ ## s_name ## _attributes(void)	\
 {									\
 	switch (0) {							\
-		s_fields						\
+	s_fields							\
+	case 0:								\
 			;						\
 	}								\
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 229/352] ath10k: fix kernel panic due to use after free
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 228/352] drbd: Avoid Clang warning about pointless switch statment Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 230/352] ath10k: fix tx_stats memory leak Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Karthikeyan Periyasamy, Kalle Valo,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 553a7cca769d551f1317186760631487c47e23bf ]

This issue arise in a race condition between ath10k_sta_state() and
ath10k_htt_fetch_peer_stats(), explained in below scenario

Steps:
1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion
   when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST
   state.
2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message.
   In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after
   the peer validation check.

Since arsta->tx_stats get freed before the peer deletion [1].
ath10k_htt_fetch_peer_stats() ended up in "use after free" situation.

Fixed this issue by moving the arsta->tx_stats free handling after the
peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in
"use after free" situation.

Kernel Panic:

Unable to handle kernel NULL pointer dereference at virtual address 00000286
pgd = d8754000
[00000286] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
...
CPU: 0 PID: 6245 Comm: hostapd Not tainted
task: dc44cac0 ti: d4a38000 task.ti: d4a38000
PC is at kmem_cache_alloc+0x7c/0x114
LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core]
pc : [<c02bdc50>]    lr : [<bf916b78>]    psr: 20000013
sp : d4a39b88  ip : 00000000  fp : 00000001
r10: 00000000  r9 : 1d3bc000  r8 : 00000dc0
r7 : 000080d0  r6 : d4a38000  r5 : dd401b00  r4 : 00000286
r3 : 00000000  r2 : d4a39ba0  r1 : 000080d0  r0 : dd401b00
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5787d  Table: 5a75406a  DAC: 00000015
Process hostapd (pid: 6245, stack limit = 0xd4a38238)
Stack: (0xd4a39b88 to 0xd4a3a000)
...
[<c02bdc50>] (kmem_cache_alloc) from [<bf916b78>] (ath10k_sta_state+0x190/0xd58 [ath10k_core])
[<bf916b78>] (ath10k_sta_state [ath10k_core]) from [<bf870d4c>] (sta_info_insert_rcu+0x418/0x61c [mac80211])
[<bf870d4c>] (sta_info_insert_rcu [mac80211]) from [<bf88634c>] (ieee80211_add_station+0xf0/0x134 [mac80211])
[<bf88634c>] (ieee80211_add_station [mac80211]) from [<bf83f3c4>] (nl80211_new_station+0x330/0x36c [cfg80211])
[<bf83f3c4>] (nl80211_new_station [cfg80211]) from [<bf6c4040>] (extack_doit+0x2c/0x74 [compat])
[<bf6c4040>] (extack_doit [compat]) from [<c05c285c>] (genl_rcv_msg+0x274/0x30c)
[<c05c285c>] (genl_rcv_msg) from [<c05c1d98>] (netlink_rcv_skb+0x58/0xac)
[<c05c1d98>] (netlink_rcv_skb) from [<c05c25d4>] (genl_rcv+0x20/0x34)
[<c05c25d4>] (genl_rcv) from [<c05c1750>] (netlink_unicast+0x11c/0x204)
[<c05c1750>] (netlink_unicast) from [<c05c1be0>] (netlink_sendmsg+0x30c/0x370)
[<c05c1be0>] (netlink_sendmsg) from [<c0587e90>] (sock_sendmsg+0x70/0x84)
[<c0587e90>] (sock_sendmsg) from [<c058970c>] (___sys_sendmsg.part.3+0x188/0x228)
[<c058970c>] (___sys_sendmsg.part.3) from [<c058a594>] (__sys_sendmsg+0x4c/0x70)
[<c058a594>] (__sys_sendmsg) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003)
ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon

Hardware tested: QCA9984
Firmware tested: 10.4-3.6.0.1-00004

Fixes: a904417fc ("ath10k: add extended per sta tx statistics support")
Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index b4764fee4751..6436dc229be5 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6387,11 +6387,6 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			   "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
 			   arvif->vdev_id, sta->addr, sta);
 
-		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
-			kfree(arsta->tx_stats);
-			arsta->tx_stats = NULL;
-		}
-
 		if (sta->tdls) {
 			ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
 							  sta,
@@ -6431,6 +6426,11 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 		}
 		spin_unlock_bh(&ar->data_lock);
 
+		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
+			kfree(arsta->tx_stats);
+			arsta->tx_stats = NULL;
+		}
+
 		for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
 			ath10k_mac_txq_unref(ar, sta->txq[i]);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 230/352] ath10k: fix tx_stats memory leak
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 229/352] ath10k: fix kernel panic due to use after free Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 231/352] drm/amd/display: validate extended dongle caps Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhi Chen, Kalle Valo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 386f97e3b201d18578abb0e7037b85a1ae50c0a3 ]

Memory of tx_stats was allocated when a STA was added. But it's not freed
if the STA failed to be added to driver. This issue could be seen in MDK3
attack case when STA number reached the limit.

Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005
Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 6436dc229be5..400495858e4e 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6293,15 +6293,6 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			   ar->num_stations + 1, ar->max_num_stations,
 			   ar->num_peers + 1, ar->max_num_peers);
 
-		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
-			arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats),
-						  GFP_KERNEL);
-			if (!arsta->tx_stats) {
-				ret = -ENOMEM;
-				goto exit;
-			}
-		}
-
 		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);
 		num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw);
 
@@ -6323,12 +6314,22 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			goto exit;
 		}
 
+		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
+			arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats),
+						  GFP_KERNEL);
+			if (!arsta->tx_stats) {
+				ret = -ENOMEM;
+				goto exit;
+			}
+		}
+
 		ret = ath10k_peer_create(ar, vif, sta, arvif->vdev_id,
 					 sta->addr, peer_type);
 		if (ret) {
 			ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
 				    sta->addr, arvif->vdev_id, ret);
 			ath10k_mac_dec_num_stations(arvif, sta);
+			kfree(arsta->tx_stats);
 			goto exit;
 		}
 
@@ -6341,6 +6342,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			spin_unlock_bh(&ar->data_lock);
 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
 			ath10k_mac_dec_num_stations(arvif, sta);
+			kfree(arsta->tx_stats);
 			ret = -ENOENT;
 			goto exit;
 		}
@@ -6361,6 +6363,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			ath10k_peer_delete(ar, arvif->vdev_id,
 					   sta->addr);
 			ath10k_mac_dec_num_stations(arvif, sta);
+			kfree(arsta->tx_stats);
 			goto exit;
 		}
 
@@ -6372,6 +6375,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 				    sta->addr, arvif->vdev_id, ret);
 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
 			ath10k_mac_dec_num_stations(arvif, sta);
+			kfree(arsta->tx_stats);
 
 			if (num_tdls_stations != 0)
 				goto exit;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 231/352] drm/amd/display: validate extended dongle caps
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 230/352] ath10k: fix tx_stats memory leak Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 232/352] video: clps711x-fb: release disp device node in probe() Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenjing Liu, Aric Cyr, Jun Lei,
	Abdoulaye Berthe, Leo Li, Alex Deucher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 99b922f9ed6a6313c0d2247cde8aa1e4a0bd67e4 ]

[why]
Some dongle doesn't have a valid extended dongle caps,
but we still set the extended dongle caps to be valid.
This causes validation fails for all timing.

[how]
If no dp_hdmi_max_pixel_clk is provided,
don't use extended dongle caps.

Signed-off-by: Wenjing Liu <Wenjing.Liu@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Abdoulaye Berthe <Abdoulaye.Berthe@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index d91df5ef0cb3..d33a5ebe990b 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -2240,7 +2240,8 @@ static void get_active_converter_info(
 					translate_dpcd_max_bpc(
 						hdmi_color_caps.bits.MAX_BITS_PER_COLOR_COMPONENT);
 
-				link->dpcd_caps.dongle_caps.extendedCapValid = true;
+				if (link->dpcd_caps.dongle_caps.dp_hdmi_max_pixel_clk != 0)
+					link->dpcd_caps.dongle_caps.extendedCapValid = true;
 			}
 
 			break;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 232/352] video: clps711x-fb: release disp device node in probe()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 231/352] drm/amd/display: validate extended dongle caps Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 233/352] md: fix raid10 hang issue caused by barrier Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Alexander Shiyan,
	Bartlomiej Zolnierkiewicz, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit fdac751355cd76e049f628afe6acb8ff4b1399f7 ]

clps711x_fb_probe() increments refcnt of disp device node by
of_parse_phandle() and leaves it undecremented on both
successful and error paths.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/clps711x-fb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/clps711x-fb.c b/drivers/video/fbdev/clps711x-fb.c
index ff561073ee4e..42f909618f04 100644
--- a/drivers/video/fbdev/clps711x-fb.c
+++ b/drivers/video/fbdev/clps711x-fb.c
@@ -287,14 +287,17 @@ static int clps711x_fb_probe(struct platform_device *pdev)
 	}
 
 	ret = of_get_fb_videomode(disp, &cfb->mode, OF_USE_NATIVE_MODE);
-	if (ret)
+	if (ret) {
+		of_node_put(disp);
 		goto out_fb_release;
+	}
 
 	of_property_read_u32(disp, "ac-prescale", &cfb->ac_prescale);
 	cfb->cmap_invert = of_property_read_bool(disp, "cmap-invert");
 
 	ret = of_property_read_u32(disp, "bits-per-pixel",
 				   &info->var.bits_per_pixel);
+	of_node_put(disp);
 	if (ret)
 		goto out_fb_release;
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 233/352] md: fix raid10 hang issue caused by barrier
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 232/352] video: clps711x-fb: release disp device node in probe() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 234/352] fbdev: fbmem: behave better with small rotated displays and many CPUs Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guoqing Jiang, Shaohua Li,
	Sasha Levin, Siniša Bandin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e820d55cb99dd93ac2dc949cf486bb187e5cd70d ]

When both regular IO and resync IO happen at the same time,
and if we also need to split regular. Then we can see tasks
hang due to barrier.

1. resync thread
[ 1463.757205] INFO: task md1_resync:5215 blocked for more than 480 seconds.
[ 1463.757207]       Not tainted 4.19.5-1-default #1
[ 1463.757209] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1463.757212] md1_resync      D    0  5215      2 0x80000000
[ 1463.757216] Call Trace:
[ 1463.757223]  ? __schedule+0x29a/0x880
[ 1463.757231]  ? raise_barrier+0x8d/0x140 [raid10]
[ 1463.757236]  schedule+0x78/0x110
[ 1463.757243]  raise_barrier+0x8d/0x140 [raid10]
[ 1463.757248]  ? wait_woken+0x80/0x80
[ 1463.757257]  raid10_sync_request+0x1f6/0x1e30 [raid10]
[ 1463.757265]  ? _raw_spin_unlock_irq+0x22/0x40
[ 1463.757284]  ? is_mddev_idle+0x125/0x137 [md_mod]
[ 1463.757302]  md_do_sync.cold.78+0x404/0x969 [md_mod]
[ 1463.757311]  ? wait_woken+0x80/0x80
[ 1463.757336]  ? md_rdev_init+0xb0/0xb0 [md_mod]
[ 1463.757351]  md_thread+0xe9/0x140 [md_mod]
[ 1463.757358]  ? _raw_spin_unlock_irqrestore+0x2e/0x60
[ 1463.757364]  ? __kthread_parkme+0x4c/0x70
[ 1463.757369]  kthread+0x112/0x130
[ 1463.757374]  ? kthread_create_worker_on_cpu+0x40/0x40
[ 1463.757380]  ret_from_fork+0x3a/0x50

2. regular IO
[ 1463.760679] INFO: task kworker/0:8:5367 blocked for more than 480 seconds.
[ 1463.760683]       Not tainted 4.19.5-1-default #1
[ 1463.760684] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1463.760687] kworker/0:8     D    0  5367      2 0x80000000
[ 1463.760718] Workqueue: md submit_flushes [md_mod]
[ 1463.760721] Call Trace:
[ 1463.760731]  ? __schedule+0x29a/0x880
[ 1463.760741]  ? wait_barrier+0xdd/0x170 [raid10]
[ 1463.760746]  schedule+0x78/0x110
[ 1463.760753]  wait_barrier+0xdd/0x170 [raid10]
[ 1463.760761]  ? wait_woken+0x80/0x80
[ 1463.760768]  raid10_write_request+0xf2/0x900 [raid10]
[ 1463.760774]  ? wait_woken+0x80/0x80
[ 1463.760778]  ? mempool_alloc+0x55/0x160
[ 1463.760795]  ? md_write_start+0xa9/0x270 [md_mod]
[ 1463.760801]  ? try_to_wake_up+0x44/0x470
[ 1463.760810]  raid10_make_request+0xc1/0x120 [raid10]
[ 1463.760816]  ? wait_woken+0x80/0x80
[ 1463.760831]  md_handle_request+0x121/0x190 [md_mod]
[ 1463.760851]  md_make_request+0x78/0x190 [md_mod]
[ 1463.760860]  generic_make_request+0x1c6/0x470
[ 1463.760870]  raid10_write_request+0x77a/0x900 [raid10]
[ 1463.760875]  ? wait_woken+0x80/0x80
[ 1463.760879]  ? mempool_alloc+0x55/0x160
[ 1463.760895]  ? md_write_start+0xa9/0x270 [md_mod]
[ 1463.760904]  raid10_make_request+0xc1/0x120 [raid10]
[ 1463.760910]  ? wait_woken+0x80/0x80
[ 1463.760926]  md_handle_request+0x121/0x190 [md_mod]
[ 1463.760931]  ? _raw_spin_unlock_irq+0x22/0x40
[ 1463.760936]  ? finish_task_switch+0x74/0x260
[ 1463.760954]  submit_flushes+0x21/0x40 [md_mod]

So resync io is waiting for regular write io to complete to
decrease nr_pending (conf->barrier++ is called before waiting).
The regular write io splits another bio after call wait_barrier
which call nr_pending++, then the splitted bio would continue
with raid10_write_request -> wait_barrier, so the splitted bio
has to wait for barrier to be zero, then deadlock happens as
follows.

	resync io		regular io

	raise_barrier
				wait_barrier
				generic_make_request
				wait_barrier

To resolve the issue, we need to call allow_barrier to decrease
nr_pending before generic_make_request since regular IO is not
issued to underlying devices, and wait_barrier is called again
to ensure no internal IO happening.

Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.")
Reported-and-tested-by: Siniša Bandin <sinisa@4net.rs>
Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid10.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index b98e746e7fc4..12cf8a04e839 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1209,7 +1209,9 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
 		struct bio *split = bio_split(bio, max_sectors,
 					      gfp, &conf->bio_split);
 		bio_chain(split, bio);
+		allow_barrier(conf);
 		generic_make_request(bio);
+		wait_barrier(conf);
 		bio = split;
 		r10_bio->master_bio = bio;
 		r10_bio->sectors = max_sectors;
@@ -1514,7 +1516,9 @@ retry_write:
 		struct bio *split = bio_split(bio, r10_bio->sectors,
 					      GFP_NOIO, &conf->bio_split);
 		bio_chain(split, bio);
+		allow_barrier(conf);
 		generic_make_request(bio);
+		wait_barrier(conf);
 		bio = split;
 		r10_bio->master_bio = bio;
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 234/352] fbdev: fbmem: behave better with small rotated displays and many CPUs
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 233/352] md: fix raid10 hang issue caused by barrier Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 235/352] i40e: define proper net_device::neigh_priv_len Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Rosin, Tomi Valkeinen,
	Fabian Frederick, Geert Uytterhoeven, Geoff Levand,
	James Simmons, Bartlomiej Zolnierkiewicz, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit f75df8d4b4fabfad7e3cba2debfad12741c6fde7 ]

Blitting an image with "negative" offsets is not working since there
is no clipping. It hopefully just crashes. For the bootup logo, there
is protection so that blitting does not happen as the image is drawn
further and further to the right (ROTATE_UR) or further and further
down (ROTATE_CW). There is however no protection when drawing in the
opposite directions (ROTATE_UD and ROTATE_CCW).

Add back this protection.

The regression is 20-odd years old but the mindless warning-killing
mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove
positive test on unsigned values") is also to blame, methinks.

Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates")
Signed-off-by: Peter Rosin <peda@axentia.se>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Fabian Frederick <ffrederick@users.sourceforge.net>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
cc: Geoff Levand <geoff@infradead.org>
Cc: James Simmons <jsimmons@users.sf.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/core/fbmem.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 861bf8081619..7dd6924feaa8 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -436,7 +436,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
 			image->dx += image->width + 8;
 		}
 	} else if (rotate == FB_ROTATE_UD) {
-		for (x = 0; x < num; x++) {
+		u32 dx = image->dx;
+
+		for (x = 0; x < num && image->dx <= dx; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dx -= image->width + 8;
 		}
@@ -448,7 +450,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
 			image->dy += image->height + 8;
 		}
 	} else if (rotate == FB_ROTATE_CCW) {
-		for (x = 0; x < num; x++) {
+		u32 dy = image->dy;
+
+		for (x = 0; x < num && image->dy <= dy; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dy -= image->height + 8;
 		}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 235/352] i40e: define proper net_device::neigh_priv_len
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 234/352] fbdev: fbmem: behave better with small rotated displays and many CPUs Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 236/352] ice: Do not enable NAPI on q_vectors that have no rings Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Konstantin Khorenko, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 31389b53b3e0b535867af9090a5d19ec64768d55 ]

Out of bound read reported by KASan.

i40iw_net_event() reads unconditionally 16 bytes from
neigh->primary_key while the memory allocated for
"neighbour" struct is evaluated in neigh_alloc() as

  tbl->entry_size + dev->neigh_priv_len

where "dev" is a net_device.

But the driver does not setup dev->neigh_priv_len and
we read beyond the neigh entry allocated memory,
so the patch in the next mail fixes this.

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 419cf3faada6..f97c3d5ab884 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -12339,6 +12339,9 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
 	ether_addr_copy(netdev->dev_addr, mac_addr);
 	ether_addr_copy(netdev->perm_addr, mac_addr);
 
+	/* i40iw_net_event() reads 16 bytes from neigh->primary_key */
+	netdev->neigh_priv_len = sizeof(u32) * 4;
+
 	netdev->priv_flags |= IFF_UNICAST_FLT;
 	netdev->priv_flags |= IFF_SUPP_NOFCS;
 	/* Setup netdev TC information */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 236/352] ice: Do not enable NAPI on q_vectors that have no rings
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 235/352] i40e: define proper net_device::neigh_priv_len Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 237/352] igb: Fix an issue that PME is not enabled during runtime suspend Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Young Xiao, Anirudh Venkataramanan,
	Andrew Bowers, Jeff Kirsher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit eec903769b4ea476591ffff73bb7359f14f38c51 ]

If ice driver has q_vectors w/ active NAPI that has no rings,
then this will result in a divide by zero error. To correct it
I am updating the driver code so that we only support NAPI on
q_vectors that have 1 or more rings allocated to them.

See commit 13a8cd191a2b ("i40e: Do not enable NAPI on q_vectors
that have no rings") for detail.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Acked-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 333312a1d595..945000449279 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -2563,8 +2563,12 @@ static void ice_napi_enable_all(struct ice_vsi *vsi)
 	if (!vsi->netdev)
 		return;
 
-	for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-		napi_enable(&vsi->q_vectors[q_idx]->napi);
+	for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+		struct ice_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+		if (q_vector->rx.ring || q_vector->tx.ring)
+			napi_enable(&q_vector->napi);
+	}
 }
 
 /**
@@ -2931,8 +2935,12 @@ static void ice_napi_disable_all(struct ice_vsi *vsi)
 	if (!vsi->netdev)
 		return;
 
-	for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-		napi_disable(&vsi->q_vectors[q_idx]->napi);
+	for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+		struct ice_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+		if (q_vector->rx.ring || q_vector->tx.ring)
+			napi_disable(&q_vector->napi);
+	}
 }
 
 /**
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 237/352] igb: Fix an issue that PME is not enabled during runtime suspend
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 236/352] ice: Do not enable NAPI on q_vectors that have no rings Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 238/352] ACPI/APEI: Clear GHES block_status before panic() Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Aaron Brown,
	Jeff Kirsher, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 1fb3a7a75e2efcc83ef21f2434069cddd6fae6f5 ]

I210 ethernet card doesn't wakeup when a cable gets plugged. It's
because its PME is not set.

Since commit 42eca2302146 ("PCI: Don't touch card regs after runtime
suspend D3"), if the PCI state is saved, pci_pm_runtime_suspend() stops
calling pci_finish_runtime_suspend(), which enables the PCI PME.

To fix the issue, let's not to save PCI states when it's runtime
suspend, to let the PCI subsystem enables PME.

Fixes: 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 5df88ad8ac81..93f150784cfc 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8770,9 +8770,11 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
 	rtnl_unlock();
 
 #ifdef CONFIG_PM
-	retval = pci_save_state(pdev);
-	if (retval)
-		return retval;
+	if (!runtime) {
+		retval = pci_save_state(pdev);
+		if (retval)
+			return retval;
+	}
 #endif
 
 	status = rd32(E1000_STATUS);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 238/352] ACPI/APEI: Clear GHES block_status before panic()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 237/352] igb: Fix an issue that PME is not enabled during runtime suspend Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 239/352] fbdev: fbcon: Fix unregister crash when more than one framebuffer Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lenny Szubowicz, David Arcari,
	Tyler Baicar, Borislav Petkov, Rafael J. Wysocki, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 98cff8b23ed1c763a029ee81ea300df0d153d07d ]

In __ghes_panic() clear the block status in the APEI generic
error status block for that generic hardware error source before
calling panic() to prevent a second panic() in the crash kernel
for exactly the same fatal error.

Otherwise ghes_probe(), running in the crash kernel, would see
an unhandled error in the APEI generic error status block and
panic again, thereby precluding any crash dump.

Signed-off-by: Lenny Szubowicz <lszubowi@redhat.com>
Signed-off-by: David Arcari <darcari@redhat.com>
Tested-by: Tyler Baicar <baicar.tyler@gmail.com>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/apei/ghes.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 02c6fd9caff7..f008ba7c9ced 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -691,6 +691,8 @@ static void __ghes_panic(struct ghes *ghes)
 {
 	__ghes_print_estatus(KERN_EMERG, ghes->generic, ghes->estatus);
 
+	ghes_clear_estatus(ghes);
+
 	/* reboot to log the error! */
 	if (!panic_timeout)
 		panic_timeout = ghes_panic_timeout;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 239/352] fbdev: fbcon: Fix unregister crash when more than one framebuffer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 238/352] ACPI/APEI: Clear GHES block_status before panic() Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 240/352] bpf: sk_msg, zap ingress queue on psock down Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Noralf Trønnes, Mikulas Patocka,
	Daniel Vetter, Bartlomiej Zolnierkiewicz, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ]

When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:

[   76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c
[   76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm]
[   76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[   76.478933] Hardware name: BCM2835
[   76.478949] Backtrace:
[   76.478995] [<c010d388>] (dump_backtrace) from [<c010d670>] (show_stack+0x20/0x24)
[   76.479022]  r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81
[   76.479060] [<c010d650>] (show_stack) from [<c08e82f4>] (dump_stack+0x20/0x28)
[   76.479102] [<c08e82d4>] (dump_stack) from [<c0120070>] (__warn+0xec/0x12c)
[   76.479134] [<c011ff84>] (__warn) from [<c01201e4>] (warn_slowpath_null+0x4c/0x58)
[   76.479165]  r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84
[   76.479197] [<c0120198>] (warn_slowpath_null) from [<c0139e84>] (__queue_work+0x2d4/0x41c)
[   76.479222]  r6:d7666a00 r5:c0e918ee r4:dbc4e700
[   76.479251] [<c0139bb0>] (__queue_work) from [<c013a02c>] (queue_work_on+0x60/0x88)
[   76.479281]  r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00
[   76.479298]  r4:20000113
[   76.479348] [<c0139fcc>] (queue_work_on) from [<c0496c28>] (cursor_timer_handler+0x30/0x54)
[   76.479374]  r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[   76.479413] [<c0496bf8>] (cursor_timer_handler) from [<c0178744>] (call_timer_fn+0x100/0x230)
[   76.479435]  r4:c0e9192f r3:d758a340
[   76.479465] [<c0178644>] (call_timer_fn) from [<c0178980>] (expire_timers+0x10c/0x12c)
[   76.479495]  r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8
[   76.479513]  r4:d8a8fabc
[   76.479541] [<c0178874>] (expire_timers) from [<c0179630>] (run_timer_softirq+0xa8/0x184)
[   76.479570]  r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280
[   76.479603] [<c0179588>] (run_timer_softirq) from [<c0102404>] (__do_softirq+0x1ac/0x3fc)
[   76.479632]  r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002
[   76.479650]  r4:c0eb65ec
[   76.479686] [<c0102258>] (__do_softirq) from [<c0124d10>] (irq_exit+0xe8/0x168)
[   76.479716]  r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0
[   76.479734]  r4:00000000
[   76.479764] [<c0124c28>] (irq_exit) from [<c016b72c>] (__handle_domain_irq+0x94/0xb0)
[   76.479793] [<c016b698>] (__handle_domain_irq) from [<c01021dc>] (bcm2835_handle_irq+0x3c/0x48)
[   76.479823]  r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8
[   76.479851] [<c01021a0>] (bcm2835_handle_irq) from [<c01019f0>] (__irq_svc+0x70/0x98)

The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.

Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer")
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/core/fbcon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8958ccc8b1ac..8976190b6c1f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx)
 	for (i = first_fb_vc; i <= last_fb_vc; i++) {
 		if (con2fb_map[i] != idx &&
 		    con2fb_map[i] != -1) {
-			new_idx = i;
+			new_idx = con2fb_map[i];
 			break;
 		}
 	}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 240/352] bpf: sk_msg, zap ingress queue on psock down
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 239/352] fbdev: fbcon: Fix unregister crash when more than one framebuffer Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 241/352] powerpc/mm: Fix reporting of kernel execute faults on the 8xx Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Daniel Borkmann, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a136678c0bdbb650daff5df5eec1dab960e074a7 ]

In addition to releasing any cork'ed data on a psock when the psock
is removed we should also release any skb's in the ingress work queue.
Otherwise the skb's eventually get free'd but late in the tear
down process so we see the WARNING due to non-zero sk_forward_alloc.

  void sk_stream_kill_queues(struct sock *sk)
  {
	...
	WARN_ON(sk->sk_forward_alloc);
	...
  }

Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index b7dbb3c976cd..fc7d59f1c57c 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -575,6 +575,7 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
 {
 	rcu_assign_sk_user_data(sk, NULL);
 	sk_psock_cork_free(psock);
+	sk_psock_zap_ingress(psock);
 	sk_psock_restore_proto(sk, psock);
 
 	write_lock_bh(&sk->sk_callback_lock);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 241/352] powerpc/mm: Fix reporting of kernel execute faults on the 8xx
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 240/352] bpf: sk_msg, zap ingress queue on psock down Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 242/352] bpf: sk_msg, fix socket data_ready events Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ffca395b11c4a5a6df6d6345f794b0e3d578e2d0 ]

On the 8xx, no-execute is set via PPP bits in the PTE. Therefore
a no-exec fault generates DSISR_PROTFAULT error bits,
not DSISR_NOEXEC_OR_G.

This patch adds DSISR_PROTFAULT in the test mask.

Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/fault.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 1697e903bbf2..50e5c790d11e 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -226,7 +226,9 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr,
 static bool bad_kernel_fault(bool is_exec, unsigned long error_code,
 			     unsigned long address)
 {
-	if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT))) {
+	/* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */
+	if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT |
+				      DSISR_PROTFAULT))) {
 		printk_ratelimited(KERN_CRIT "kernel tried to execute"
 				   " exec-protected page (%lx) -"
 				   "exploit attempt? (uid: %d)\n",
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 242/352] bpf: sk_msg, fix socket data_ready events
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 241/352] powerpc/mm: Fix reporting of kernel execute faults on the 8xx Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 243/352] pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Daniel Borkmann, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 552de91068828daef50a227a665068cf8dde835e ]

When a skb verdict program is in-use and either another BPF program
redirects to that socket or the new SK_PASS support is used the
data_ready callback does not wake up application. Instead because
the stream parser/verdict is using the sk data_ready callback we wake
up the stream parser/verdict block.

Fix this by adding a helper to check if the stream parser block is
enabled on the sk and if so call the saved pointer which is the
upper layers wake up function.

This fixes application stalls observed when an application is waiting
for data in a blocking read().

Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/skmsg.h | 8 ++++++++
 net/core/skmsg.c      | 6 +++---
 net/ipv4/tcp_bpf.c    | 2 +-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index 2a11e9d91dfa..36bd85863081 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -416,6 +416,14 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock)
 		sk_psock_drop(sk, psock);
 }
 
+static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock)
+{
+	if (psock->parser.enabled)
+		psock->parser.saved_data_ready(sk);
+	else
+		sk->sk_data_ready(sk);
+}
+
 static inline void psock_set_prog(struct bpf_prog **pprog,
 				  struct bpf_prog *prog)
 {
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index fc7d59f1c57c..54d854807630 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -406,7 +406,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
 	msg->skb = skb;
 
 	sk_psock_queue_msg(psock, msg);
-	sk->sk_data_ready(sk);
+	sk_psock_data_ready(sk, psock);
 	return copied;
 }
 
@@ -739,7 +739,7 @@ static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
 }
 
 /* Called with socket lock held. */
-static void sk_psock_data_ready(struct sock *sk)
+static void sk_psock_strp_data_ready(struct sock *sk)
 {
 	struct sk_psock *psock;
 
@@ -787,7 +787,7 @@ void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
 		return;
 
 	parser->saved_data_ready = sk->sk_data_ready;
-	sk->sk_data_ready = sk_psock_data_ready;
+	sk->sk_data_ready = sk_psock_strp_data_ready;
 	sk->sk_write_space = sk_psock_write_space;
 	parser->enabled = true;
 }
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 3b45fe530f91..2d6bd7a59b2c 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -198,7 +198,7 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
 		msg->sg.start = i;
 		msg->sg.size -= apply_bytes;
 		sk_psock_queue_msg(psock, tmp);
-		sk->sk_data_ready(sk);
+		sk_psock_data_ready(sk, psock);
 	} else {
 		sk_msg_free(sk, tmp);
 		kfree(tmp);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 243/352] pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 242/352] bpf: sk_msg, fix socket data_ready events Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 244/352] pinctrl: meson: meson8b: " Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Linus Walleij,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 42f9b48cc5402be11d2364275eb18c257d2a79e8 ]

The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N)
only belong to the pin controller in the AO domain. With the current
definition these pins cannot be referred to in .dts files as group
(which is possible on GXBB and GXL for example).

Add a separate "gpio_aobus" function to fix the mapping between the pin
controller and the GPIO pins in the AO domain. This is similar to how
the GXBB and GXL drivers implement this functionality.

Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/meson/pinctrl-meson8.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
index 86466173114d..e482672e833a 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8.c
@@ -807,7 +807,9 @@ static const char * const gpio_groups[] = {
 	"BOOT_5", "BOOT_6", "BOOT_7", "BOOT_8", "BOOT_9",
 	"BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14",
 	"BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18",
+};
 
+static const char * const gpio_aobus_groups[] = {
 	"GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
 	"GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
 	"GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
@@ -1030,6 +1032,7 @@ static struct meson_pmx_func meson8_cbus_functions[] = {
 };
 
 static struct meson_pmx_func meson8_aobus_functions[] = {
+	FUNCTION(gpio_aobus),
 	FUNCTION(uart_ao),
 	FUNCTION(remote),
 	FUNCTION(i2c_slave_ao),
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 244/352] pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 243/352] pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 245/352] KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Linus Walleij,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 2b745ac3cceb8fc1d9985990c8241a821ea97e53 ]

The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N)
only belong to the pin controller in the AO domain. With the current
definition these pins cannot be referred to in .dts files as group
(which is possible on GXBB and GXL for example).

Add a separate "gpio_aobus" function to fix the mapping between the pin
controller and the GPIO pins in the AO domain. This is similar to how
the GXBB and GXL drivers implement this functionality.

Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/meson/pinctrl-meson8b.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index 647ad15d5c3c..91cffc051055 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -646,16 +646,18 @@ static const char * const gpio_groups[] = {
 	"BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14",
 	"BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18",
 
-	"GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
-	"GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
-	"GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
-	"GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N",
-
 	"DIF_0_P", "DIF_0_N", "DIF_1_P", "DIF_1_N",
 	"DIF_2_P", "DIF_2_N", "DIF_3_P", "DIF_3_N",
 	"DIF_4_P", "DIF_4_N"
 };
 
+static const char * const gpio_aobus_groups[] = {
+	"GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
+	"GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
+	"GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
+	"GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N"
+};
+
 static const char * const sd_a_groups[] = {
 	"sd_d0_a", "sd_d1_a", "sd_d2_a", "sd_d3_a", "sd_clk_a",
 	"sd_cmd_a"
@@ -871,6 +873,7 @@ static struct meson_pmx_func meson8b_cbus_functions[] = {
 };
 
 static struct meson_pmx_func meson8b_aobus_functions[] = {
+	FUNCTION(gpio_aobus),
 	FUNCTION(uart_ao),
 	FUNCTION(uart_ao_b),
 	FUNCTION(i2c_slave_ao),
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 245/352] KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 244/352] pinctrl: meson: meson8b: " Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 246/352] powerpc/fadump: Do not allow hot-remove memory from fadump reserved area Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vitaly Kuznetsov,
	Radim Krčmář,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e87555e550cef4941579cd879759a7c0dee24e68 ]

AMD doesn't seem to implement MSR_IA32_MCG_EXT_CTL and svm code in kvm
knows nothing about it, however, this MSR is among emulated_msrs and
thus returned with KVM_GET_MSR_INDEX_LIST. The consequent KVM_GET_MSRS,
of course, fails.

Report the MSR as unsupported to not confuse userspace.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/svm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 101f53ccf571..11641d9e7f6f 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -5836,6 +5836,13 @@ static bool svm_cpu_has_accelerated_tpr(void)
 
 static bool svm_has_emulated_msr(int index)
 {
+	switch (index) {
+	case MSR_IA32_MCG_EXT_CTL:
+		return false;
+	default:
+		break;
+	}
+
 	return true;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 246/352] powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 245/352] KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 247/352] selftests: kvm: report failed stage when exit reason is unexpected Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mahesh Salgaonkar, Michael Ellerman,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0db6896ff6332ba694f1e61b93ae3b2640317633 ]

For fadump to work successfully there should not be any holes in reserved
memory ranges where kernel has asked firmware to move the content of old
kernel memory in event of crash. Now that fadump uses CMA for reserved
area, this memory area is now not protected from hot-remove operations
unless it is cma allocated. Hence, fadump service can fail to re-register
after the hot-remove operation, if hot-removed memory belongs to fadump
reserved region. To avoid this make sure that memory from fadump reserved
area is not hot-removable if fadump is registered.

However, if user still wants to remove that memory, he can do so by
manually stopping fadump service before hot-remove operation.

Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/fadump.h               |  2 +-
 arch/powerpc/kernel/fadump.c                    | 10 ++++++++--
 arch/powerpc/platforms/pseries/hotplug-memory.c |  7 +++++--
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
index 1e7a33592e29..15bc07a31c46 100644
--- a/arch/powerpc/include/asm/fadump.h
+++ b/arch/powerpc/include/asm/fadump.h
@@ -200,7 +200,7 @@ struct fad_crash_memory_ranges {
 	unsigned long long	size;
 };
 
-extern int is_fadump_boot_memory_area(u64 addr, ulong size);
+extern int is_fadump_memory_area(u64 addr, ulong size);
 extern int early_init_dt_scan_fw_dump(unsigned long node,
 		const char *uname, int depth, void *data);
 extern int fadump_reserve_mem(void);
diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
index 761b28b1427d..7fd9b3e1fa39 100644
--- a/arch/powerpc/kernel/fadump.c
+++ b/arch/powerpc/kernel/fadump.c
@@ -118,13 +118,19 @@ int __init early_init_dt_scan_fw_dump(unsigned long node,
 
 /*
  * If fadump is registered, check if the memory provided
- * falls within boot memory area.
+ * falls within boot memory area and reserved memory area.
  */
-int is_fadump_boot_memory_area(u64 addr, ulong size)
+int is_fadump_memory_area(u64 addr, ulong size)
 {
+	u64 d_start = fw_dump.reserve_dump_area_start;
+	u64 d_end = d_start + fw_dump.reserve_dump_area_size;
+
 	if (!fw_dump.dump_registered)
 		return 0;
 
+	if (((addr + size) > d_start) && (addr <= d_end))
+		return 1;
+
 	return (addr + size) > RMA_START && addr <= fw_dump.boot_memory_size;
 }
 
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 2a983b5a52e1..2318ab29d5dd 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -355,8 +355,11 @@ static bool lmb_is_removable(struct drmem_lmb *lmb)
 	phys_addr = lmb->base_addr;
 
 #ifdef CONFIG_FA_DUMP
-	/* Don't hot-remove memory that falls in fadump boot memory area */
-	if (is_fadump_boot_memory_area(phys_addr, block_sz))
+	/*
+	 * Don't hot-remove memory that falls in fadump boot memory area
+	 * and memory that is reserved for capturing old kernel memory.
+	 */
+	if (is_fadump_memory_area(phys_addr, block_sz))
 		return false;
 #endif
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 247/352] selftests: kvm: report failed stage when exit reason is unexpected
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 246/352] powerpc/fadump: Do not allow hot-remove memory from fadump reserved area Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 248/352] kvm: Change offset in kvm_write_guest_offset_cached to unsigned Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vitaly Kuznetsov,
	Radim Krčmář,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b85c32dd27495075380350fcd5d614a6b45311b8 ]

When we get a report like

==== Test Assertion Failure ====
  x86_64/state_test.c:157: run->exit_reason == KVM_EXIT_IO
  pid=955 tid=955 - Success
     1	0x0000000000401350: main at state_test.c:154
     2	0x00007fc31c9e9412: ?? ??:0
     3	0x000000000040159d: _start at ??:?
  Unexpected exit reason: 8 (SHUTDOWN),

it is not obvious which particular stage failed. Add the info.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/x86_64/evmcs_test.c | 4 ++--
 tools/testing/selftests/kvm/x86_64/state_test.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index 92c2cfd1b182..ea3c73e8f4f6 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -113,8 +113,8 @@ int main(int argc, char *argv[])
 	for (stage = 1;; stage++) {
 		_vcpu_run(vm, VCPU_ID);
 		TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
-			    "Unexpected exit reason: %u (%s),\n",
-			    run->exit_reason,
+			    "Stage %d: unexpected exit reason: %u (%s),\n",
+			    stage, run->exit_reason,
 			    exit_reason_str(run->exit_reason));
 
 		memset(&regs1, 0, sizeof(regs1));
diff --git a/tools/testing/selftests/kvm/x86_64/state_test.c b/tools/testing/selftests/kvm/x86_64/state_test.c
index 03da41f0f736..4b3f556265f1 100644
--- a/tools/testing/selftests/kvm/x86_64/state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/state_test.c
@@ -152,8 +152,8 @@ int main(int argc, char *argv[])
 	for (stage = 1;; stage++) {
 		_vcpu_run(vm, VCPU_ID);
 		TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
-			    "Unexpected exit reason: %u (%s),\n",
-			    run->exit_reason,
+			    "Stage %d: unexpected exit reason: %u (%s),\n",
+			    stage, run->exit_reason,
 			    exit_reason_str(run->exit_reason));
 
 		memset(&regs1, 0, sizeof(regs1));
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 248/352] kvm: Change offset in kvm_write_guest_offset_cached to unsigned
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 247/352] selftests: kvm: report failed stage when exit reason is unexpected Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 249/352] NFS: nfs_compare_mount_options always compare auth flavors Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cfir Cohen, Jim Mattson, Peter Shier,
	Krish Sadhukhan, Sean Christopherson, Radim Krčmář,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7a86dab8cf2f0fdf508f3555dddfc236623bff60 ]

Since the offset is added directly to the hva from the
gfn_to_hva_cache, a negative offset could result in an out of bounds
write. The existing BUG_ON only checks for addresses beyond the end of
the gfn_to_hva_cache, not for addresses before the start of the
gfn_to_hva_cache.

Note that all current call sites have non-negative offsets.

Fixes: 4ec6e8636256 ("kvm: Introduce kvm_write_guest_offset_cached()")
Reported-by: Cfir Cohen <cfir@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Cfir Cohen <cfir@google.com>
Reviewed-by: Peter Shier <pshier@google.com>
Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/kvm_host.h | 3 ++-
 virt/kvm/kvm_main.c      | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index c926698040e0..a03d5e264e5e 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -694,7 +694,8 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
 int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
 			   void *data, unsigned long len);
 int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
-			   void *data, int offset, unsigned long len);
+				  void *data, unsigned int offset,
+				  unsigned long len);
 int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
 			      gpa_t gpa, unsigned long len);
 int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 2679e476b6c3..065ee2fb4034 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1965,7 +1965,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
 EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
 
 int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
-			   void *data, int offset, unsigned long len)
+				  void *data, unsigned int offset,
+				  unsigned long len)
 {
 	struct kvm_memslots *slots = kvm_memslots(kvm);
 	int r;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 249/352] NFS: nfs_compare_mount_options always compare auth flavors.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 248/352] kvm: Change offset in kvm_write_guest_offset_cached to unsigned Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 250/352] perf build: Dont unconditionally link the libbfd feature test to -liberty and -lz Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Perl, Anna Schumaker, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 594d1644cd59447f4fceb592448d5cd09eb09b5e ]

This patch removes the check from nfs_compare_mount_options to see if a
`sec' option was passed for the current mount before comparing auth
flavors and instead just always compares auth flavors.

Consider the following scenario:

You have a server with the address 192.168.1.1 and two exports /export/a
and /export/b.  The first export supports `sys' and `krb5' security, the
second just `sys'.

Assume you start with no mounts from the server.

The following results in EIOs being returned as the kernel nfs client
incorrectly thinks it can share the underlying `struct nfs_server's:

$ mkdir /tmp/{a,b}
$ sudo mount -t nfs -o vers=3,sec=krb5 192.168.1.1:/export/a /tmp/a
$ sudo mount -t nfs -o vers=3          192.168.1.1:/export/b /tmp/b
$ df >/dev/null
df: ‘/tmp/b’: Input/output error

Signed-off-by: Chris Perl <cperl@janestreet.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/super.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ac4b2f005778..5ef2c71348bd 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2409,8 +2409,7 @@ static int nfs_compare_mount_options(const struct super_block *s, const struct n
 		goto Ebusy;
 	if (a->acdirmax != b->acdirmax)
 		goto Ebusy;
-	if (b->auth_info.flavor_len > 0 &&
-	   clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
+	if (clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
 		goto Ebusy;
 	return 1;
 Ebusy:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 250/352] perf build: Dont unconditionally link the libbfd feature test to -liberty and -lz
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 249/352] NFS: nfs_compare_mount_options always compare auth flavors Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 251/352] hwmon: (lm80) fix a missing check of the status of SMBus read Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stanislav Fomichev, Jiri Olsa,
	Alexander Shishkin, Mathieu Poirier, Namhyung Kim,
	Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 14541b1e7e723859ff2c75c6fc10cdbbec6b8c34 ]

Current libbfd feature test unconditionally links against -liberty and -lz.
While it's required on some systems (e.g. opensuse), it's completely
unnecessary on the others, where only -lbdf is sufficient (debian).
This patch streamlines (and renames) the following feature checks:

feature-libbfd           - only link against -lbfd (debian),
                           see commit 2cf9040714f3 ("perf tools: Fix bfd
			   dependency libraries detection")
feature-libbfd-liberty   - link against -lbfd and -liberty
feature-libbfd-liberty-z - link against -lbfd, -liberty and -lz (opensuse),
                           see commit 280e7c48c3b8 ("perf tools: fix BFD
			   detection on opensuse")

(feature-liberty{,-z} were renamed to feature-libbfd-liberty{,z}
for clarity)

The main motivation is to fix this feature test for bpftool which is
currently broken on debian (libbfd feature shows OFF, but we still
unconditionally link against -lbfd and it works).

Tested on debian with only -lbfd installed (without -liberty); I'd
appreciate if somebody on the other systems can test this new detection
method.

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/4dfc634cfcfb236883971b5107cf3c28ec8a31be.1542328222.git.sdf@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/build/Makefile.feature |  4 ++--
 tools/build/feature/Makefile | 10 ++++----
 tools/perf/Makefile.config   | 44 +++++++++++++++++++-----------------
 3 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index d74bb9414d7c..81dda411e9d3 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -80,8 +80,8 @@ FEATURE_TESTS_EXTRA :=                  \
          cplus-demangle                 \
          hello                          \
          libbabeltrace                  \
-         liberty                        \
-         liberty-z                      \
+         libbfd-liberty                 \
+         libbfd-liberty-z               \
          libunwind-debug-frame          \
          libunwind-debug-frame-arm      \
          libunwind-debug-frame-aarch64  \
diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index 304b984f11b9..912b82d4b70a 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -16,8 +16,8 @@ FILES=                                          \
          test-libbfd.bin                        \
          test-disassembler-four-args.bin        \
          test-reallocarray.bin			\
-         test-liberty.bin                       \
-         test-liberty-z.bin                     \
+         test-libbfd-liberty.bin                \
+         test-libbfd-liberty-z.bin              \
          test-cplus-demangle.bin                \
          test-libelf.bin                        \
          test-libelf-getphdrnum.bin             \
@@ -204,7 +204,7 @@ $(OUTPUT)test-libpython-version.bin:
 	$(BUILD)
 
 $(OUTPUT)test-libbfd.bin:
-	$(BUILD) -DPACKAGE='"perf"' -lbfd -lz -liberty -ldl
+	$(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
 
 $(OUTPUT)test-disassembler-four-args.bin:
 	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
@@ -212,10 +212,10 @@ $(OUTPUT)test-disassembler-four-args.bin:
 $(OUTPUT)test-reallocarray.bin:
 	$(BUILD)
 
-$(OUTPUT)test-liberty.bin:
+$(OUTPUT)test-libbfd-liberty.bin:
 	$(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty
 
-$(OUTPUT)test-liberty-z.bin:
+$(OUTPUT)test-libbfd-liberty-z.bin:
 	$(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty -lz
 
 $(OUTPUT)test-cplus-demangle.bin:
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index acbb657f7ce2..a0f366c7a318 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -693,18 +693,20 @@ endif
 
 ifeq ($(feature-libbfd), 1)
   EXTLIBS += -lbfd
+else
+  # we are on a system that requires -liberty and (maybe) -lz
+  # to link against -lbfd; test each case individually here
 
   # call all detections now so we get correct
   # status in VF output
-  $(call feature_check,liberty)
-  $(call feature_check,liberty-z)
-  $(call feature_check,cplus-demangle)
+  $(call feature_check,libbfd-liberty)
+  $(call feature_check,libbfd-liberty-z)
 
-  ifeq ($(feature-liberty), 1)
-    EXTLIBS += -liberty
+  ifeq ($(feature-libbfd-liberty), 1)
+    EXTLIBS += -lbfd -liberty
   else
-    ifeq ($(feature-liberty-z), 1)
-      EXTLIBS += -liberty -lz
+    ifeq ($(feature-libbfd-liberty-z), 1)
+      EXTLIBS += -lbfd -liberty -lz
     endif
   endif
 endif
@@ -714,24 +716,24 @@ ifdef NO_DEMANGLE
 else
   ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
     EXTLIBS += -liberty
-    CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
   else
-    ifneq ($(feature-libbfd), 1)
-      ifneq ($(feature-liberty), 1)
-        ifneq ($(feature-liberty-z), 1)
-          # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT
-          # or any of 'bfd iberty z' trinity
-          ifeq ($(feature-cplus-demangle), 1)
-            EXTLIBS += -liberty
-            CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
-          else
-            msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling)
-            CFLAGS += -DNO_DEMANGLE
-          endif
-        endif
+    ifeq ($(filter -liberty,$(EXTLIBS)),)
+      $(call feature_check,cplus-demangle)
+
+      # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT
+      # or any of 'bfd iberty z' trinity
+      ifeq ($(feature-cplus-demangle), 1)
+        EXTLIBS += -liberty
+      else
+        msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling)
+        CFLAGS += -DNO_DEMANGLE
       endif
     endif
   endif
+
+  ifneq ($(filter -liberty,$(EXTLIBS)),)
+    CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
+  endif
 endif
 
 ifneq ($(filter -lbfd,$(EXTLIBS)),)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 251/352] hwmon: (lm80) fix a missing check of the status of SMBus read
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 250/352] perf build: Dont unconditionally link the libbfd feature test to -liberty and -lz Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:17 ` [PATCH 4.20 252/352] hwmon: (lm80) fix a missing check of bus read in lm80 probe Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Guenter Roeck, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit c9c63915519b1def7043b184680f33c24cd49d7b ]

If lm80_read_value() fails, it returns a negative number instead of the
correct read data. Therefore, we should avoid using the data if it
fails.

The fix checks if lm80_read_value() fails, and if so, returns with the
error number.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
[groeck: One variable for return values is enough]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm80.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 08e3945a6fbf..04f9df0d2341 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -360,9 +360,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
 	struct i2c_client *client = data->client;
 	unsigned long min, val;
 	u8 reg;
-	int err = kstrtoul(buf, 10, &val);
-	if (err < 0)
-		return err;
+	int rv;
+
+	rv = kstrtoul(buf, 10, &val);
+	if (rv < 0)
+		return rv;
 
 	/* Save fan_min */
 	mutex_lock(&data->update_lock);
@@ -390,8 +392,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	reg = (lm80_read_value(client, LM80_REG_FANDIV) &
-	       ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1)));
+	rv = lm80_read_value(client, LM80_REG_FANDIV);
+	if (rv < 0)
+		return rv;
+	reg = (rv & ~(3 << (2 * (nr + 1))))
+	    | (data->fan_div[nr] << (2 * (nr + 1)));
 	lm80_write_value(client, LM80_REG_FANDIV, reg);
 
 	/* Restore fan_min */
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 252/352] hwmon: (lm80) fix a missing check of bus read in lm80 probe
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 251/352] hwmon: (lm80) fix a missing check of the status of SMBus read Greg Kroah-Hartman
@ 2019-02-11 14:17 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 253/352] seq_buf: Make seq_buf_puts() null-terminate the buffer Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:17 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Guenter Roeck, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315 ]

In lm80_probe(), if lm80_read_value() fails, it returns a negative
error number which is stored to data->fan[f_min] and will be further
used. We should avoid using the data if the read fails.

The fix checks if lm80_read_value() fails, and if so, returns with the
error number.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm80.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 04f9df0d2341..0e30fa00204c 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -628,6 +628,7 @@ static int lm80_probe(struct i2c_client *client,
 	struct device *dev = &client->dev;
 	struct device *hwmon_dev;
 	struct lm80_data *data;
+	int rv;
 
 	data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
 	if (!data)
@@ -640,8 +641,14 @@ static int lm80_probe(struct i2c_client *client,
 	lm80_init_client(client);
 
 	/* A few vars need to be filled upon startup */
-	data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
-	data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+	rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+	if (rv < 0)
+		return rv;
+	data->fan[f_min][0] = rv;
+	rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+	if (rv < 0)
+		return rv;
+	data->fan[f_min][1] = rv;
 
 	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
 							   data, lm80_groups);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 253/352] seq_buf: Make seq_buf_puts() null-terminate the buffer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2019-02-11 14:17 ` [PATCH 4.20 252/352] hwmon: (lm80) fix a missing check of bus read in lm80 probe Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 254/352] crypto: ux500 - Use proper enum in cryp_set_dma_transfer Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Michael Ellerman,
	Steven Rostedt (VMware),
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0464ed24380905d640030d368cd84a4e4d1e15e2 ]

Currently seq_buf_puts() will happily create a non null-terminated
string for you in the buffer. This is particularly dangerous if the
buffer is on the stack.

For example:

  char buf[8];
  char secret = "secret";
  struct seq_buf s;

  seq_buf_init(&s, buf, sizeof(buf));
  seq_buf_puts(&s, "foo");
  printk("Message is %s\n", buf);

Can result in:

  Message is fooªªªªªsecret

We could require all users to memset() their buffer to zero before
use. But that seems likely to be forgotten and lead to bugs.

Instead we can change seq_buf_puts() to always leave the buffer in a
null-terminated state.

The only downside is that this makes the buffer 1 character smaller
for seq_buf_puts(), but that seems like a good trade off.

Link: http://lkml.kernel.org/r/20181019042109.8064-1-mpe@ellerman.id.au

Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/seq_buf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 11f2ae0f9099..6aabb609dd87 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -144,9 +144,13 @@ int seq_buf_puts(struct seq_buf *s, const char *str)
 
 	WARN_ON(s->size == 0);
 
+	/* Add 1 to len for the trailing null byte which must be there */
+	len += 1;
+
 	if (seq_buf_can_fit(s, len)) {
 		memcpy(s->buffer + s->len, str, len);
-		s->len += len;
+		/* Don't count the trailing null byte against the capacity */
+		s->len += len - 1;
 		return 0;
 	}
 	seq_buf_set_overflow(s);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 254/352] crypto: ux500 - Use proper enum in cryp_set_dma_transfer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 253/352] seq_buf: Make seq_buf_puts() null-terminate the buffer Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 255/352] crypto: ux500 - Use proper enum in hash_set_dma_transfer Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nick Desaulniers,
	Herbert Xu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9d880c5945c748d8edcac30965f3349a602158c4 ]

Clang warns when one enumerated type is implicitly converted to another:

drivers/crypto/ux500/cryp/cryp_core.c:559:5: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
                                direction, DMA_CTRL_ACK);
                                ^~~~~~~~~
drivers/crypto/ux500/cryp/cryp_core.c:583:5: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
                                direction,
                                ^~~~~~~~~
2 warnings generated.

dmaengine_prep_slave_sg expects an enum from dma_transfer_direction.
Because we know the value of the dma_data_direction enum from the
switch statement, we can just use the proper value from
dma_transfer_direction so there is no more conversion.

DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1
DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ux500/cryp/cryp_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
index d2663a4e1f5e..a92a66b1ff46 100644
--- a/drivers/crypto/ux500/cryp/cryp_core.c
+++ b/drivers/crypto/ux500/cryp/cryp_core.c
@@ -556,7 +556,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
 		desc = dmaengine_prep_slave_sg(channel,
 				ctx->device->dma.sg_src,
 				ctx->device->dma.sg_src_len,
-				direction, DMA_CTRL_ACK);
+				DMA_MEM_TO_DEV, DMA_CTRL_ACK);
 		break;
 
 	case DMA_FROM_DEVICE:
@@ -580,7 +580,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
 		desc = dmaengine_prep_slave_sg(channel,
 				ctx->device->dma.sg_dst,
 				ctx->device->dma.sg_dst_len,
-				direction,
+				DMA_DEV_TO_MEM,
 				DMA_CTRL_ACK |
 				DMA_PREP_INTERRUPT);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 255/352] crypto: ux500 - Use proper enum in hash_set_dma_transfer
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 254/352] crypto: ux500 - Use proper enum in cryp_set_dma_transfer Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 256/352] MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nick Desaulniers,
	Herbert Xu, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5ac93f808338f4dd465402e91869702eb87db241 ]

Clang warns when one enumerated type is implicitly converted to another:

drivers/crypto/ux500/hash/hash_core.c:169:4: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
                        direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
                        ^~~~~~~~~
1 warning generated.

dmaengine_prep_slave_sg expects an enum from dma_transfer_direction.
We know that the only direction supported by this function is
DMA_TO_DEVICE because of the check at the top of this function so we can
just use the equivalent value from dma_transfer_direction.

DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ux500/hash/hash_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
index 633321a8dd03..a0bb8a6eec3f 100644
--- a/drivers/crypto/ux500/hash/hash_core.c
+++ b/drivers/crypto/ux500/hash/hash_core.c
@@ -166,7 +166,7 @@ static int hash_set_dma_transfer(struct hash_ctx *ctx, struct scatterlist *sg,
 		__func__);
 	desc = dmaengine_prep_slave_sg(channel,
 			ctx->device->dma.sg, ctx->device->dma.sg_len,
-			direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
+			DMA_MEM_TO_DEV, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
 	if (!desc) {
 		dev_err(ctx->device->dev,
 			"%s: dmaengine_prep_slave_sg() failed!\n", __func__);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 256/352] MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 255/352] crypto: ux500 - Use proper enum in hash_set_dma_transfer Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 257/352] cifs: check ntwrk_buf_start for NULL before dereferencing it Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Roese, Paul Burton,
	John Crispin, Daniel Schwierzeck, Ralf Baechle, linux-mips,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0b15394475e3bcaf35ca4bf22fc55d56df67224e ]

Testing has shown, that when using mainline U-Boot on MT7688 based
boards, the system may hang or crash while mounting the root-fs. The
main issue here is that mainline U-Boot configures EBase to a value
near the end of system memory. And with CONFIG_CPU_MIPSR2_IRQ_VI
disabled, trap_init() will not allocate a new area to place the
exception handler. The original value will be used and the handler
will be copied to this location, which might already be used by some
userspace application.

The MT7688 supports VI - its config3 register is 0x00002420, so VInt
(Bit 5) is set. But without setting CONFIG_CPU_MIPSR2_IRQ_VI this
bit will not be evaluated to result in "cpu_has_vi" being set. This
patch now selects CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 which results
trap_init() to allocate some memory for the exception handler.

Please note that this issue was not seen with the Mediatek U-Boot
version, as it does not touch EBase (stays at default of 0x8000.0000).
This is strictly also not correct as the kernel (_text) resides
here.

Signed-off-by: Stefan Roese <sr@denx.de>
[paul.burton@mips.com: s/beeing/being/]
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: John Crispin <blogic@openwrt.org>
Cc: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/ralink/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig
index 1f9cb0e3c79a..613d61763433 100644
--- a/arch/mips/ralink/Kconfig
+++ b/arch/mips/ralink/Kconfig
@@ -38,6 +38,7 @@ choice
 
 	config SOC_MT7620
 		bool "MT7620/8"
+		select CPU_MIPSR2_IRQ_VI
 		select HW_HAS_PCI
 
 	config SOC_MT7621
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 257/352] cifs: check ntwrk_buf_start for NULL before dereferencing it
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 256/352] MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 258/352] f2fs: fix use-after-free issue when accessing sbi->stat_info Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ronnie Sahlberg, Steve French, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 59a63e479ce36a3f24444c3a36efe82b78e4a8e0 ]

RHBZ: 1021460

There is an issue where when multiple threads open/close the same directory
ntwrk_buf_start might end up being NULL, causing the call to smbCalcSize
later to oops with a NULL deref.

The real bug is why this happens and why this can become NULL for an
open cfile, which should not be allowed.
This patch tries to avoid a oops until the time when we fix the underlying
issue.

Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/readdir.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index e169e1a5fd35..3925a7bfc74d 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -655,7 +655,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
 		/* scan and find it */
 		int i;
 		char *cur_ent;
-		char *end_of_smb = cfile->srch_inf.ntwrk_buf_start +
+		char *end_of_smb;
+
+		if (cfile->srch_inf.ntwrk_buf_start == NULL) {
+			cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n");
+			return -EIO;
+		}
+
+		end_of_smb = cfile->srch_inf.ntwrk_buf_start +
 			server->ops->calc_smb_size(
 					cfile->srch_inf.ntwrk_buf_start,
 					server);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 258/352] f2fs: fix use-after-free issue when accessing sbi->stat_info
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 257/352] cifs: check ntwrk_buf_start for NULL before dereferencing it Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 259/352] um: Avoid marking pages with "changed protection" Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sahitya Tummala, Chao Yu,
	Jaegeuk Kim, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 60aa4d5536ab7fe32433ca1173bd9d6633851f27 ]

iput() on sbi->node_inode can update sbi->stat_info
in the below context, if the f2fs_write_checkpoint()
has failed with error.

f2fs_balance_fs_bg+0x1ac/0x1ec
f2fs_write_node_pages+0x4c/0x260
do_writepages+0x80/0xbc
__writeback_single_inode+0xdc/0x4ac
writeback_single_inode+0x9c/0x144
write_inode_now+0xc4/0xec
iput+0x194/0x22c
f2fs_put_super+0x11c/0x1e8
generic_shutdown_super+0x70/0xf4
kill_block_super+0x2c/0x5c
kill_f2fs_super+0x44/0x50
deactivate_locked_super+0x60/0x8c
deactivate_super+0x68/0x74
cleanup_mnt+0x40/0x78

Fix this by moving f2fs_destroy_stats() further below iput() in
both f2fs_put_super() and f2fs_fill_super() paths.

Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 855a622fb052..a239472f405a 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1058,9 +1058,6 @@ static void f2fs_put_super(struct super_block *sb)
 		f2fs_write_checkpoint(sbi, &cpc);
 	}
 
-	/* f2fs_write_checkpoint can update stat informaion */
-	f2fs_destroy_stats(sbi);
-
 	/*
 	 * normally superblock is clean, so we need to release this.
 	 * In addition, EIO will skip do checkpoint, we need this as well.
@@ -1080,6 +1077,12 @@ static void f2fs_put_super(struct super_block *sb)
 	iput(sbi->node_inode);
 	iput(sbi->meta_inode);
 
+	/*
+	 * iput() can update stat information, if f2fs_write_checkpoint()
+	 * above failed with error.
+	 */
+	f2fs_destroy_stats(sbi);
+
 	/* destroy f2fs internal modules */
 	f2fs_destroy_node_manager(sbi);
 	f2fs_destroy_segment_manager(sbi);
@@ -3256,30 +3259,30 @@ try_onemore:
 
 	f2fs_build_gc_manager(sbi);
 
+	err = f2fs_build_stats(sbi);
+	if (err)
+		goto free_nm;
+
 	/* get an inode for node space */
 	sbi->node_inode = f2fs_iget(sb, F2FS_NODE_INO(sbi));
 	if (IS_ERR(sbi->node_inode)) {
 		f2fs_msg(sb, KERN_ERR, "Failed to read node inode");
 		err = PTR_ERR(sbi->node_inode);
-		goto free_nm;
+		goto free_stats;
 	}
 
-	err = f2fs_build_stats(sbi);
-	if (err)
-		goto free_node_inode;
-
 	/* read root inode and dentry */
 	root = f2fs_iget(sb, F2FS_ROOT_INO(sbi));
 	if (IS_ERR(root)) {
 		f2fs_msg(sb, KERN_ERR, "Failed to read root inode");
 		err = PTR_ERR(root);
-		goto free_stats;
+		goto free_node_inode;
 	}
 	if (!S_ISDIR(root->i_mode) || !root->i_blocks ||
 			!root->i_size || !root->i_nlink) {
 		iput(root);
 		err = -EINVAL;
-		goto free_stats;
+		goto free_node_inode;
 	}
 
 	sb->s_root = d_make_root(root); /* allocate root dentry */
@@ -3403,12 +3406,12 @@ free_meta:
 free_root_inode:
 	dput(sb->s_root);
 	sb->s_root = NULL;
-free_stats:
-	f2fs_destroy_stats(sbi);
 free_node_inode:
 	f2fs_release_ino_entry(sbi, true);
 	truncate_inode_pages_final(NODE_MAPPING(sbi));
 	iput(sbi->node_inode);
+free_stats:
+	f2fs_destroy_stats(sbi);
 free_nm:
 	f2fs_destroy_node_manager(sbi);
 free_sm:
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 259/352] um: Avoid marking pages with "changed protection"
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 258/352] f2fs: fix use-after-free issue when accessing sbi->stat_info Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 260/352] niu: fix missing checks of niu_pci_eeprom_read Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8892d8545f2d0342b9c550defbfb165db237044b ]

Changing protection is a very high cost operation in UML
because in addition to an extra syscall it also interrupts
mmap merge sequences generated by the tlb.

While the condition is not particularly common it is worth
avoiding.

Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/include/asm/pgtable.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
index 7485398d0737..9c04562310b3 100644
--- a/arch/um/include/asm/pgtable.h
+++ b/arch/um/include/asm/pgtable.h
@@ -197,12 +197,17 @@ static inline pte_t pte_mkold(pte_t pte)
 
 static inline pte_t pte_wrprotect(pte_t pte)
 { 
-	pte_clear_bits(pte, _PAGE_RW);
+	if (likely(pte_get_bits(pte, _PAGE_RW)))
+		pte_clear_bits(pte, _PAGE_RW);
+	else
+		return pte;
 	return(pte_mknewprot(pte)); 
 }
 
 static inline pte_t pte_mkread(pte_t pte)
 { 
+	if (unlikely(pte_get_bits(pte, _PAGE_USER)))
+		return pte;
 	pte_set_bits(pte, _PAGE_USER);
 	return(pte_mknewprot(pte)); 
 }
@@ -221,6 +226,8 @@ static inline pte_t pte_mkyoung(pte_t pte)
 
 static inline pte_t pte_mkwrite(pte_t pte)	
 {
+	if (unlikely(pte_get_bits(pte,  _PAGE_RW)))
+		return pte;
 	pte_set_bits(pte, _PAGE_RW);
 	return(pte_mknewprot(pte)); 
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 260/352] niu: fix missing checks of niu_pci_eeprom_read
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 259/352] um: Avoid marking pages with "changed protection" Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 261/352] f2fs: fix sbi->extent_list corruption issue Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Shannon Nelson,
	David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 26fd962bde0b15e54234fe762d86bc0349df1de4 ]

niu_pci_eeprom_read() may fail, so we should check its return value
before using the read data.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Acked-by: Shannon Nelson <shannon.lee.nelson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sun/niu.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 9319d84bf49f..d84501441edd 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8100,6 +8100,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 		start += 3;
 
 		prop_len = niu_pci_eeprom_read(np, start + 4);
+		if (prop_len < 0)
+			return prop_len;
 		err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
 		if (err < 0)
 			return err;
@@ -8144,8 +8146,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 			netif_printk(np, probe, KERN_DEBUG, np->dev,
 				     "VPD_SCAN: Reading in property [%s] len[%d]\n",
 				     namebuf, prop_len);
-			for (i = 0; i < prop_len; i++)
-				*prop_buf++ = niu_pci_eeprom_read(np, off + i);
+			for (i = 0; i < prop_len; i++) {
+				err = niu_pci_eeprom_read(np, off + i);
+				if (err >= 0)
+					*prop_buf = err;
+				++prop_buf;
+			}
 		}
 
 		start += len;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 261/352] f2fs: fix sbi->extent_list corruption issue
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 260/352] niu: fix missing checks of niu_pci_eeprom_read Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 262/352] cgroup: fix parsing empty mount option string Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sahitya Tummala, Jaegeuk Kim, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e4589fa545e0020dbbc3c9bde35f35f949901392 ]

When there is a failure in f2fs_fill_super() after/during
the recovery of fsync'd nodes, it frees the current sbi and
retries again. This time the mount is successful, but the files
that got recovered before retry, still holds the extent tree,
whose extent nodes list is corrupted since sbi and sbi->extent_list
is freed up. The list_del corruption issue is observed when the
file system is getting unmounted and when those recoverd files extent
node is being freed up in the below context.

list_del corruption. prev->next should be fffffff1e1ef5480, but was (null)
<...>
kernel BUG at kernel/msm-4.14/lib/list_debug.c:53!
lr : __list_del_entry_valid+0x94/0xb4
pc : __list_del_entry_valid+0x94/0xb4
<...>
Call trace:
__list_del_entry_valid+0x94/0xb4
__release_extent_node+0xb0/0x114
__free_extent_tree+0x58/0x7c
f2fs_shrink_extent_tree+0xdc/0x3b0
f2fs_leave_shrinker+0x28/0x7c
f2fs_put_super+0xfc/0x1e0
generic_shutdown_super+0x70/0xf4
kill_block_super+0x2c/0x5c
kill_f2fs_super+0x44/0x50
deactivate_locked_super+0x60/0x8c
deactivate_super+0x68/0x74
cleanup_mnt+0x40/0x78
__cleanup_mnt+0x1c/0x28
task_work_run+0x48/0xd0
do_notify_resume+0x678/0xe98
work_pending+0x8/0x14

Fix this by not creating extents for those recovered files if shrinker is
not registered yet. Once mount is successful and shrinker is registered,
those files can have extents again.

Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/f2fs.h     | 11 ++++++++++-
 fs/f2fs/shrinker.c |  2 +-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index ebad864c031c..6713060a59fb 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2673,10 +2673,19 @@ static inline bool is_dot_dotdot(const struct qstr *str)
 
 static inline bool f2fs_may_extent_tree(struct inode *inode)
 {
-	if (!test_opt(F2FS_I_SB(inode), EXTENT_CACHE) ||
+	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+
+	if (!test_opt(sbi, EXTENT_CACHE) ||
 			is_inode_flag_set(inode, FI_NO_EXTENT))
 		return false;
 
+	/*
+	 * for recovered files during mount do not create extents
+	 * if shrinker is not registered.
+	 */
+	if (list_empty(&sbi->s_list))
+		return false;
+
 	return S_ISREG(inode->i_mode);
 }
 
diff --git a/fs/f2fs/shrinker.c b/fs/f2fs/shrinker.c
index 9e13db994fdf..a467aca29cfe 100644
--- a/fs/f2fs/shrinker.c
+++ b/fs/f2fs/shrinker.c
@@ -135,6 +135,6 @@ void f2fs_leave_shrinker(struct f2fs_sb_info *sbi)
 	f2fs_shrink_extent_tree(sbi, __count_extent_cache(sbi));
 
 	spin_lock(&f2fs_list_lock);
-	list_del(&sbi->s_list);
+	list_del_init(&sbi->s_list);
 	spin_unlock(&f2fs_list_lock);
 }
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 262/352] cgroup: fix parsing empty mount option string
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 261/352] f2fs: fix sbi->extent_list corruption issue Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 263/352] perf python: Do not force closing original perf descriptor in evlist.get_pollfd() Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Smalley, Ondrej Mosnacek,
	Tejun Heo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit e250d91d65750a0c0c62483ac4f9f357e7317617 ]

This fixes the case where all mount options specified are consumed by an
LSM and all that's left is an empty string. In this case cgroupfs should
accept the string and not fail.

How to reproduce (with SELinux enabled):

    # umount /sys/fs/cgroup/unified
    # mount -o context=system_u:object_r:cgroup_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified
    mount: /sys/fs/cgroup/unified: wrong fs type, bad option, bad superblock on cgroup2, missing codepage or helper program, or other error.
    # dmesg | tail -n 1
    [   31.575952] cgroup: cgroup2: unknown option ""

Fixes: 67e9c74b8a87 ("cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type")
[NOTE: should apply on top of commit 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option"), older versions need manual rebase]
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 1f84977fab47..498c6bcf992a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1744,7 +1744,7 @@ static int parse_cgroup_root_flags(char *data, unsigned int *root_flags)
 
 	*root_flags = 0;
 
-	if (!data)
+	if (!data || *data == '\0')
 		return 0;
 
 	while ((token = strsep(&data, ",")) != NULL) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 263/352] perf python: Do not force closing original perf descriptor in evlist.get_pollfd()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 262/352] cgroup: fix parsing empty mount option string Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 264/352] scripts/decode_stacktrace: only strip base path when a prefix of the path Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondřej Lysoněk, Jiri Olsa,
	Alexander Shishkin, Jaroslav Škarvada, Namhyung Kim,
	Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit a389aece97938966616ce0336466b98b0351ef10 ]

Ondřej reported that when compiled with python3, the python extension
regresses in evlist.get_pollfd function behaviour.

The evlist.get_pollfd function creates file objects from evlist's fds
and returns them in a list. The python3 version also sets them to 'close
the original descriptor' when the object dies (is closed), by passing
True via the 'closefd' arg in the PyFile_FromFd call.

The python's closefd doc says:

  If closefd is False, the underlying file descriptor will be kept open
  when the file is closed.

That's why the following line in python3 closes all evlist fds:

  evlist.get_pollfd()

the returned list is immediately destroyed and that takes down the
original events fds.

Passing closefd as False to PyFile_FromFd to fix this.

Reported-by: Ondřej Lysoněk <olysonek@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jaroslav Škarvada <jskarvad@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Fixes: 66dfdff03d19 ("perf tools: Add Python 3 support")
Link: http://lkml.kernel.org/r/20181226112121.5285-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/python.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 50150dfc0cdf..4dd8fd05a260 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -939,7 +939,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
 
 		file = PyFile_FromFile(fp, "perf", "r", NULL);
 #else
-		file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1, NULL, NULL, NULL, 1);
+		file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1,
+				     NULL, NULL, NULL, 0);
 #endif
 		if (file == NULL)
 			goto free_list;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 264/352] scripts/decode_stacktrace: only strip base path when a prefix of the path
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 263/352] perf python: Do not force closing original perf descriptor in evlist.get_pollfd() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 265/352] arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Will Deacon,
	Andrew Morton, Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 67a28de47faa83585dd644bd4c31e5a1d9346c50 ]

Running something like:

	decodecode vmlinux .

leads to interested results where not only the leading "." gets stripped
from the displayed paths, but also anywhere in the string, displaying
something like:

	kvm_vcpu_check_block (arch/arm64/kvm/virt/kvm/kvm_mainc:2141)

which doesn't help further processing.

Fix it by only stripping the base path if it is a prefix of the path.

Link: http://lkml.kernel.org/r/20181210174659.31054-3-marc.zyngier@arm.com
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/decode_stacktrace.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
index 64220e36ce3b..98a7d63a723e 100755
--- a/scripts/decode_stacktrace.sh
+++ b/scripts/decode_stacktrace.sh
@@ -78,7 +78,7 @@ parse_symbol() {
 	fi
 
 	# Strip out the base of the path
-	code=${code//$basepath/""}
+	code=${code//^$basepath/""}
 
 	# In the case of inlines, move everything to same line
 	code=${code//$'\n'/' '}
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 265/352] arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 264/352] scripts/decode_stacktrace: only strip base path when a prefix of the path Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 266/352] ocfs2: dont clear bh uptodate for block read Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Geert Uytterhoeven,
	Miquel Raynal, Yoshinori Sato, Rich Felker, Jacopo Mondi,
	Magnus Damm, Andrew Morton, Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 440e7b379f91acd245d5c8de94d533f40f5dffb3 ]

arch/sh/boards/mach-kfr2r09/setup.c does not need to #include
<mtd/onenand.h>, and doing so causes a build warning, so drop that header
file.

In file included from ../arch/sh/boards/mach-kfr2r09/setup.c:28:
../include/linux/mtd/onenand.h:225:12: warning: 'struct mtd_oob_ops' declared inside parameter list will not be visible outside of this definition or declaration
     struct mtd_oob_ops *ops);

Link: http://lkml.kernel.org/r/702f0a25-c63e-6912-4640-6ab0f00afbc7@infradead.org
Fixes: f3590dc32974 ("media: arch: sh: kfr2r09: Use new renesas-ceu camera driver")

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Suggested-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: Jacopo Mondi <jacopo+renesas@jmondi.org>
Cc: Magnus Damm <magnus.damm@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/boards/mach-kfr2r09/setup.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index e59c577ed871..c70bc7809dda 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -25,7 +25,6 @@
 #include <linux/memblock.h>
 #include <linux/mfd/tmio.h>
 #include <linux/mmc/host.h>
-#include <linux/mtd/onenand.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_data/lv5207lp.h>
 #include <linux/platform_device.h>
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 266/352] ocfs2: dont clear bh uptodate for block read
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 265/352] arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 267/352] ocfs2: improve ocfs2 Makefile Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Junxiao Bi, Changwei Ge, Yiwen Jiang,
	Joel Becker, Joseph Qi, Jun Piao, Mark Fasheh, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 70306d9dce75abde855cefaf32b3f71eed8602a3 ]

For sync io read in ocfs2_read_blocks_sync(), first clear bh uptodate flag
and submit the io, second wait io done, last check whether bh uptodate, if
not return io error.

If two sync io for the same bh were issued, it could be the first io done
and set uptodate flag, but just before check that flag, the second io came
in and cleared uptodate, then ocfs2_read_blocks_sync() for the first io
will return IO error.

Indeed it's not necessary to clear uptodate flag, as the io end handler
end_buffer_read_sync() will set or clear it based on io succeed or failed.

The following message was found from a nfs server but the underlying
storage returned no error.

[4106438.567376] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2780 ERROR: read block 1238823695 failed -5
[4106438.567569] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2812 ERROR: status = -5
[4106438.567611] (nfsd,7146,3):ocfs2_test_inode_bit:2894 ERROR: get alloc slot and bit failed -5
[4106438.567643] (nfsd,7146,3):ocfs2_test_inode_bit:2932 ERROR: status = -5
[4106438.567675] (nfsd,7146,3):ocfs2_get_dentry:94 ERROR: test inode bit failed -5

Same issue in non sync read ocfs2_read_blocks(), fixed it as well.

Link: http://lkml.kernel.org/r/20181121020023.3034-4-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Changwei Ge <ge.changwei@h3c.com>
Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mfasheh@versity.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/buffer_head_io.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index 4ebbd57cbf84..f9b84f7a3e4b 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -161,7 +161,6 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
 #endif
 		}
 
-		clear_buffer_uptodate(bh);
 		get_bh(bh); /* for end_buffer_read_sync() */
 		bh->b_end_io = end_buffer_read_sync;
 		submit_bh(REQ_OP_READ, 0, bh);
@@ -341,7 +340,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
 				continue;
 			}
 
-			clear_buffer_uptodate(bh);
 			get_bh(bh); /* for end_buffer_read_sync() */
 			if (validate)
 				set_buffer_needs_validate(bh);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 267/352] ocfs2: improve ocfs2 Makefile
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 266/352] ocfs2: dont clear bh uptodate for block read Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 268/352] mm/page_alloc.c: dont call kasan_free_pages() at deferred mem init Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Larry Chen, Andrew Morton,
	Mark Fasheh, Joel Becker, Junxiao Bi, Joseph Qi, Changwei Ge,
	Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9e6aea22802b5684c7e1d69822aeb0844dd01953 ]

Included file path was hard-wired in the ocfs2 makefile, which might
causes some confusion when compiling ocfs2 as an external module.

Say if we compile ocfs2 module as following.
cp -r /kernel/tree/fs/ocfs2 /other/dir/ocfs2
cd /other/dir/ocfs2
make -C /path/to/kernel_source M=`pwd` modules

Acutally, the compiler wil try to find included file in
/kernel/tree/fs/ocfs2, rather than the directory /other/dir/ocfs2.

To fix this little bug, we introduce the var $(src) provided by kbuild.
$(src) means the absolute path of the running kbuild file.

Link: http://lkml.kernel.org/r/20181108085546.15149-1-lchen@suse.com
Signed-off-by: Larry Chen <lchen@suse.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <ge.changwei@h3c.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/Makefile       | 2 +-
 fs/ocfs2/dlm/Makefile   | 2 +-
 fs/ocfs2/dlmfs/Makefile | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile
index 99ee093182cb..cc9b32b9db7c 100644
--- a/fs/ocfs2/Makefile
+++ b/fs/ocfs2/Makefile
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-ccflags-y := -Ifs/ocfs2
+ccflags-y := -I$(src)
 
 obj-$(CONFIG_OCFS2_FS) += 	\
 	ocfs2.o			\
diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
index bd1aab1f49a4..ef2854422a6e 100644
--- a/fs/ocfs2/dlm/Makefile
+++ b/fs/ocfs2/dlm/Makefile
@@ -1,4 +1,4 @@
-ccflags-y := -Ifs/ocfs2
+ccflags-y := -I$(src)/..
 
 obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
 
diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
index eed3db8c5b49..33431a0296a3 100644
--- a/fs/ocfs2/dlmfs/Makefile
+++ b/fs/ocfs2/dlmfs/Makefile
@@ -1,4 +1,4 @@
-ccflags-y := -Ifs/ocfs2
+ccflags-y := -I$(src)/..
 
 obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 268/352] mm/page_alloc.c: dont call kasan_free_pages() at deferred mem init
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 267/352] ocfs2: improve ocfs2 Makefile Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 269/352] zram: fix lockdep warning of free block handling Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Waiman Long, Andrew Morton,
	Andrey Ryabinin, Alexander Potapenko, Dmitry Vyukov,
	Michal Hocko, Pasha Tatashin, Oscar Salvador, Linus Torvalds,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 3c0c12cc8f00ca5f81acb010023b8eb13e9a7004 ]

When CONFIG_KASAN is enabled on large memory SMP systems, the deferrred
pages initialization can take a long time.  Below were the reported init
times on a 8-socket 96-core 4TB IvyBridge system.

  1) Non-debug kernel without CONFIG_KASAN
     [    8.764222] node 1 initialised, 132086516 pages in 7027ms

  2) Debug kernel with CONFIG_KASAN
     [  146.288115] node 1 initialised, 132075466 pages in 143052ms

So the page init time in a debug kernel was 20X of the non-debug kernel.
The long init time can be problematic as the page initialization is done
with interrupt disabled.  In this particular case, it caused the
appearance of following warning messages as well as NMI backtraces of all
the cores that were doing the initialization.

[   68.240049] rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[   68.241000] rcu: 	25-...0: (100 ticks this GP) idle=b72/1/0x4000000000000000 softirq=915/915 fqs=16252
[   68.241000] rcu: 	44-...0: (95 ticks this GP) idle=49a/1/0x4000000000000000 softirq=788/788 fqs=16253
[   68.241000] rcu: 	54-...0: (104 ticks this GP) idle=03a/1/0x4000000000000000 softirq=721/825 fqs=16253
[   68.241000] rcu: 	60-...0: (103 ticks this GP) idle=cbe/1/0x4000000000000000 softirq=637/740 fqs=16253
[   68.241000] rcu: 	72-...0: (105 ticks this GP) idle=786/1/0x4000000000000000 softirq=536/641 fqs=16253
[   68.241000] rcu: 	84-...0: (99 ticks this GP) idle=292/1/0x4000000000000000 softirq=537/537 fqs=16253
[   68.241000] rcu: 	111-...0: (104 ticks this GP) idle=bde/1/0x4000000000000000 softirq=474/476 fqs=16253
[   68.241000] rcu: 	(detected by 13, t=65018 jiffies, g=249, q=2)

The long init time was mainly caused by the call to kasan_free_pages() to
poison the newly initialized pages.  On a 4TB system, we are talking about
almost 500GB of memory probably on the same node.

In reality, we may not need to poison the newly initialized pages before
they are ever allocated.  So KASAN poisoning of freed pages before the
completion of deferred memory initialization is now disabled.  Those pages
will be properly poisoned when they are allocated or freed after deferred
pages initialization is done.

With this change, the new page initialization time became:

[   21.948010] node 1 initialised, 132075466 pages in 18702ms

This was still about double the non-debug kernel time, but was much
better than before.

Link: http://lkml.kernel.org/r/1544459388-8736-1-git-send-email-longman@redhat.com
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Pasha Tatashin <Pavel.Tatashin@microsoft.com>
Cc: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 995d1079f958..a29043ea9212 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -294,6 +294,32 @@ EXPORT_SYMBOL(nr_online_nodes);
 int page_group_by_mobility_disabled __read_mostly;
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
+/*
+ * During boot we initialize deferred pages on-demand, as needed, but once
+ * page_alloc_init_late() has finished, the deferred pages are all initialized,
+ * and we can permanently disable that path.
+ */
+static DEFINE_STATIC_KEY_TRUE(deferred_pages);
+
+/*
+ * Calling kasan_free_pages() only after deferred memory initialization
+ * has completed. Poisoning pages during deferred memory init will greatly
+ * lengthen the process and cause problem in large memory systems as the
+ * deferred pages initialization is done with interrupt disabled.
+ *
+ * Assuming that there will be no reference to those newly initialized
+ * pages before they are ever allocated, this should have no effect on
+ * KASAN memory tracking as the poison will be properly inserted at page
+ * allocation time. The only corner case is when pages are allocated by
+ * on-demand allocation and then freed again before the deferred pages
+ * initialization is done, but this is not likely to happen.
+ */
+static inline void kasan_free_nondeferred_pages(struct page *page, int order)
+{
+	if (!static_branch_unlikely(&deferred_pages))
+		kasan_free_pages(page, order);
+}
+
 /* Returns true if the struct page for the pfn is uninitialised */
 static inline bool __meminit early_page_uninitialised(unsigned long pfn)
 {
@@ -335,6 +361,8 @@ defer_init(int nid, unsigned long pfn, unsigned long end_pfn)
 	return false;
 }
 #else
+#define kasan_free_nondeferred_pages(p, o)	kasan_free_pages(p, o)
+
 static inline bool early_page_uninitialised(unsigned long pfn)
 {
 	return false;
@@ -1037,7 +1065,7 @@ static __always_inline bool free_pages_prepare(struct page *page,
 	arch_free_page(page, order);
 	kernel_poison_pages(page, 1 << order, 0);
 	kernel_map_pages(page, 1 << order, 0);
-	kasan_free_pages(page, order);
+	kasan_free_nondeferred_pages(page, order);
 
 	return true;
 }
@@ -1605,13 +1633,6 @@ static int __init deferred_init_memmap(void *data)
 	return 0;
 }
 
-/*
- * During boot we initialize deferred pages on-demand, as needed, but once
- * page_alloc_init_late() has finished, the deferred pages are all initialized,
- * and we can permanently disable that path.
- */
-static DEFINE_STATIC_KEY_TRUE(deferred_pages);
-
 /*
  * If this zone has deferred pages, try to grow it by initializing enough
  * deferred pages to satisfy the allocation specified by order, rounded up to
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 269/352] zram: fix lockdep warning of free block handling
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 268/352] mm/page_alloc.c: dont call kasan_free_pages() at deferred mem init Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 270/352] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Minchan Kim, Sergey Senozhatsky,
	Joey Pabalinas, Andrew Morton, Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 3c9959e025472122a61faebb208525cf26b305d1 ]

Patch series "zram idle page writeback", v3.

Inherently, swap device has many idle pages which are rare touched since
it was allocated.  It is never problem if we use storage device as swap.
However, it's just waste for zram-swap.

This patchset supports zram idle page writeback feature.

* Admin can define what is idle page "no access since X time ago"
* Admin can define when zram should writeback them
* Admin can define when zram should stop writeback to prevent wearout

Details are in each patch's description.

This patch (of 7):

  ================================
  WARNING: inconsistent lock state
  4.19.0+ #390 Not tainted
  --------------------------------
  inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
  zram_verify/2095 [HC0[0]:SC1[1]:HE1:SE0] takes:
  00000000b1828693 (&(&zram->bitmap_lock)->rlock){+.?.}, at: put_entry_bdev+0x1e/0x50
  {SOFTIRQ-ON-W} state was registered at:
    _raw_spin_lock+0x2c/0x40
    zram_make_request+0x755/0xdc9
    generic_make_request+0x373/0x6a0
    submit_bio+0x6c/0x140
    __swap_writepage+0x3a8/0x480
    shrink_page_list+0x1102/0x1a60
    shrink_inactive_list+0x21b/0x3f0
    shrink_node_memcg.constprop.99+0x4f8/0x7e0
    shrink_node+0x7d/0x2f0
    do_try_to_free_pages+0xe0/0x300
    try_to_free_pages+0x116/0x2b0
    __alloc_pages_slowpath+0x3f4/0xf80
    __alloc_pages_nodemask+0x2a2/0x2f0
    __handle_mm_fault+0x42e/0xb50
    handle_mm_fault+0x55/0xb0
    __do_page_fault+0x235/0x4b0
    page_fault+0x1e/0x30
  irq event stamp: 228412
  hardirqs last  enabled at (228412): [<ffffffff98245846>] __slab_free+0x3e6/0x600
  hardirqs last disabled at (228411): [<ffffffff98245625>] __slab_free+0x1c5/0x600
  softirqs last  enabled at (228396): [<ffffffff98e0031e>] __do_softirq+0x31e/0x427
  softirqs last disabled at (228403): [<ffffffff98072051>] irq_exit+0xd1/0xe0

  other info that might help us debug this:
   Possible unsafe locking scenario:

         CPU0
         ----
    lock(&(&zram->bitmap_lock)->rlock);
    <Interrupt>
      lock(&(&zram->bitmap_lock)->rlock);

   *** DEADLOCK ***

  no locks held by zram_verify/2095.

  stack backtrace:
  CPU: 5 PID: 2095 Comm: zram_verify Not tainted 4.19.0+ #390
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
  Call Trace:
   <IRQ>
   dump_stack+0x67/0x9b
   print_usage_bug+0x1bd/0x1d3
   mark_lock+0x4aa/0x540
   __lock_acquire+0x51d/0x1300
   lock_acquire+0x90/0x180
   _raw_spin_lock+0x2c/0x40
   put_entry_bdev+0x1e/0x50
   zram_free_page+0xf6/0x110
   zram_slot_free_notify+0x42/0xa0
   end_swap_bio_read+0x5b/0x170
   blk_update_request+0x8f/0x340
   scsi_end_request+0x2c/0x1e0
   scsi_io_completion+0x98/0x650
   blk_done_softirq+0x9e/0xd0
   __do_softirq+0xcc/0x427
   irq_exit+0xd1/0xe0
   do_IRQ+0x93/0x120
   common_interrupt+0xf/0xf
   </IRQ>

With writeback feature, zram_slot_free_notify could be called in softirq
context by end_swap_bio_read.  However, bitmap_lock is not aware of that
so lockdep yell out:

  get_entry_bdev
  spin_lock(bitmap->lock);
  irq
  softirq
  end_swap_bio_read
  zram_slot_free_notify
  zram_slot_lock <-- deadlock prone
  zram_free_page
  put_entry_bdev
  spin_lock(bitmap->lock); <-- deadlock prone

With akpm's suggestion (i.e.  bitmap operation is already atomic), we
could remove bitmap lock.  It might fail to find a empty slot if serious
contention happens.  However, it's not severe problem because huge page
writeback has already possiblity to fail if there is severe memory
pressure.  Worst case is just keeping the incompressible in memory, not
storage.

The other problem is zram_slot_lock in zram_slot_slot_free_notify.  To
make it safe is this patch introduces zram_slot_trylock where
zram_slot_free_notify uses it.  Although it's rare to be contented, this
patch adds new debug stat "miss_free" to keep monitoring how often it
happens.

Link: http://lkml.kernel.org/r/20181127055429.251614-2-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Joey Pabalinas <joeypabalinas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/zram/zram_drv.c | 38 +++++++++++++++++++----------------
 drivers/block/zram/zram_drv.h |  2 +-
 2 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8e6a0db6555f..d1459cc1159f 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -53,6 +53,11 @@ static size_t huge_class_size;
 
 static void zram_free_page(struct zram *zram, size_t index);
 
+static int zram_slot_trylock(struct zram *zram, u32 index)
+{
+	return bit_spin_trylock(ZRAM_LOCK, &zram->table[index].value);
+}
+
 static void zram_slot_lock(struct zram *zram, u32 index)
 {
 	bit_spin_lock(ZRAM_LOCK, &zram->table[index].value);
@@ -401,7 +406,6 @@ static ssize_t backing_dev_store(struct device *dev,
 		goto out;
 
 	reset_bdev(zram);
-	spin_lock_init(&zram->bitmap_lock);
 
 	zram->old_block_size = old_block_size;
 	zram->bdev = bdev;
@@ -445,29 +449,24 @@ out:
 
 static unsigned long get_entry_bdev(struct zram *zram)
 {
-	unsigned long entry;
-
-	spin_lock(&zram->bitmap_lock);
+	unsigned long blk_idx = 1;
+retry:
 	/* skip 0 bit to confuse zram.handle = 0 */
-	entry = find_next_zero_bit(zram->bitmap, zram->nr_pages, 1);
-	if (entry == zram->nr_pages) {
-		spin_unlock(&zram->bitmap_lock);
+	blk_idx = find_next_zero_bit(zram->bitmap, zram->nr_pages, blk_idx);
+	if (blk_idx == zram->nr_pages)
 		return 0;
-	}
 
-	set_bit(entry, zram->bitmap);
-	spin_unlock(&zram->bitmap_lock);
+	if (test_and_set_bit(blk_idx, zram->bitmap))
+		goto retry;
 
-	return entry;
+	return blk_idx;
 }
 
 static void put_entry_bdev(struct zram *zram, unsigned long entry)
 {
 	int was_set;
 
-	spin_lock(&zram->bitmap_lock);
 	was_set = test_and_clear_bit(entry, zram->bitmap);
-	spin_unlock(&zram->bitmap_lock);
 	WARN_ON_ONCE(!was_set);
 }
 
@@ -888,9 +887,10 @@ static ssize_t debug_stat_show(struct device *dev,
 
 	down_read(&zram->init_lock);
 	ret = scnprintf(buf, PAGE_SIZE,
-			"version: %d\n%8llu\n",
+			"version: %d\n%8llu %8llu\n",
 			version,
-			(u64)atomic64_read(&zram->stats.writestall));
+			(u64)atomic64_read(&zram->stats.writestall),
+			(u64)atomic64_read(&zram->stats.miss_free));
 	up_read(&zram->init_lock);
 
 	return ret;
@@ -1402,10 +1402,14 @@ static void zram_slot_free_notify(struct block_device *bdev,
 
 	zram = bdev->bd_disk->private_data;
 
-	zram_slot_lock(zram, index);
+	atomic64_inc(&zram->stats.notify_free);
+	if (!zram_slot_trylock(zram, index)) {
+		atomic64_inc(&zram->stats.miss_free);
+		return;
+	}
+
 	zram_free_page(zram, index);
 	zram_slot_unlock(zram, index);
-	atomic64_inc(&zram->stats.notify_free);
 }
 
 static int zram_rw_page(struct block_device *bdev, sector_t sector,
diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h
index 72c8584b6dff..d1095dfdffa8 100644
--- a/drivers/block/zram/zram_drv.h
+++ b/drivers/block/zram/zram_drv.h
@@ -79,6 +79,7 @@ struct zram_stats {
 	atomic64_t pages_stored;	/* no. of pages currently stored */
 	atomic_long_t max_used_pages;	/* no. of maximum pages stored */
 	atomic64_t writestall;		/* no. of write slow paths */
+	atomic64_t miss_free;		/* no. of missed free */
 };
 
 struct zram {
@@ -110,7 +111,6 @@ struct zram {
 	unsigned int old_block_size;
 	unsigned long *bitmap;
 	unsigned long nr_pages;
-	spinlock_t bitmap_lock;
 #endif
 #ifdef CONFIG_ZRAM_MEMORY_TRACKING
 	struct dentry *debugfs_dir;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 270/352] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 269/352] zram: fix lockdep warning of free block handling Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 271/352] gdrom: fix a memory leak bug Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 7418e6520f22a2e35815122fa5a53d5bbfa2c10f ]

In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and
HFCPCI_l1hw() may be concurrently executed.

HFCPCI_l1hw()
  line 1173: if (!cs->tx_skb)

hfcpci_interrupt()
  line 942: spin_lock_irqsave();
  line 1066: dev_kfree_skb_irq(cs->tx_skb);

Thus, a possible concurrency use-after-free bug may occur
in HFCPCI_l1hw().

To fix these bugs, the calls to spin_lock_irqsave() and
spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the
access to cs->tx_skb.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hisax/hfc_pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index ea0e4c6de3fb..0109e0e8bcb6 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1170,11 +1170,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg)
 		if (cs->debug & L1_DEB_LAPD)
 			debugl1(cs, "-> PH_REQUEST_PULL");
 #endif
+		spin_lock_irqsave(&cs->lock, flags);
 		if (!cs->tx_skb) {
 			test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
 			st->l1.l1l2(st, PH_PULL | CONFIRM, NULL);
 		} else
 			test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
+		spin_unlock_irqrestore(&cs->lock, flags);
 		break;
 	case (HW_RESET | REQUEST):
 		spin_lock_irqsave(&cs->lock, flags);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 271/352] gdrom: fix a memory leak bug
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 270/352] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 272/352] fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Jens Axboe, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017 ]

In probe_gdrom(), the buffer pointed by 'gd.cd_info' is allocated through
kzalloc() and is used to hold the information of the gdrom device. To
register and unregister the device, the pointer 'gd.cd_info' is passed to
the functions register_cdrom() and unregister_cdrom(), respectively.
However, this buffer is not freed after it is used, which can cause a
memory leak bug.

This patch simply frees the buffer 'gd.cd_info' in exit_gdrom() to fix the
above issue.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cdrom/gdrom.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index a5b8afe3609c..f8b7345fe1cb 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -873,6 +873,7 @@ static void __exit exit_gdrom(void)
 	platform_device_unregister(pd);
 	platform_driver_unregister(&gdrom_driver);
 	kfree(gd.toc);
+	kfree(gd.cd_info);
 }
 
 module_init(init_gdrom);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 272/352] fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 271/352] gdrom: fix a memory leak bug Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 273/352] block/swim3: Fix -EBUSY error when re-opening device after unmount Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Scott Wood, David S. Miller, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0d9c9a238faf925823bde866182c663b6d734f2e ]

These functions are called from atomic context:

[    9.150239] BUG: sleeping function called from invalid context at /home/scott/git/linux/mm/slab.h:421
[    9.158159] in_atomic(): 1, irqs_disabled(): 0, pid: 4432, name: ip
[    9.163128] CPU: 8 PID: 4432 Comm: ip Not tainted 4.20.0-rc2-00169-g63d86876f324 #29
[    9.163130] Call Trace:
[    9.170701] [c0000002e899a980] [c0000000009c1068] .dump_stack+0xa8/0xec (unreliable)
[    9.177140] [c0000002e899aa10] [c00000000007a7b4] .___might_sleep+0x138/0x164
[    9.184440] [c0000002e899aa80] [c0000000001d5bac] .kmem_cache_alloc_trace+0x238/0x30c
[    9.191216] [c0000002e899ab40] [c00000000065ea1c] .memac_add_hash_mac_address+0x104/0x198
[    9.199464] [c0000002e899abd0] [c00000000065a788] .set_multi+0x1c8/0x218
[    9.206242] [c0000002e899ac80] [c0000000006615ec] .dpaa_set_rx_mode+0xdc/0x17c
[    9.213544] [c0000002e899ad00] [c00000000083d2b0] .__dev_set_rx_mode+0x80/0xd4
[    9.219535] [c0000002e899ad90] [c00000000083d334] .dev_set_rx_mode+0x30/0x54
[    9.225271] [c0000002e899ae10] [c00000000083d4a0] .__dev_open+0x148/0x1c8
[    9.230751] [c0000002e899aeb0] [c00000000083d934] .__dev_change_flags+0x19c/0x1e0
[    9.230755] [c0000002e899af60] [c00000000083d9a4] .dev_change_flags+0x2c/0x80
[    9.242752] [c0000002e899aff0] [c0000000008554ec] .do_setlink+0x350/0xf08
[    9.248228] [c0000002e899b170] [c000000000857ad0] .rtnl_newlink+0x588/0x7e0
[    9.253965] [c0000002e899b740] [c000000000852424] .rtnetlink_rcv_msg+0x3e0/0x498
[    9.261440] [c0000002e899b820] [c000000000884790] .netlink_rcv_skb+0x134/0x14c
[    9.267607] [c0000002e899b8e0] [c000000000851840] .rtnetlink_rcv+0x18/0x2c
[    9.274558] [c0000002e899b950] [c000000000883c8c] .netlink_unicast+0x214/0x318
[    9.281163] [c0000002e899ba00] [c000000000884220] .netlink_sendmsg+0x348/0x444
[    9.287076] [c0000002e899bae0] [c00000000080d13c] .sock_sendmsg+0x2c/0x54
[    9.287080] [c0000002e899bb50] [c0000000008106c0] .___sys_sendmsg+0x2d0/0x2d8
[    9.298375] [c0000002e899bd30] [c000000000811a80] .__sys_sendmsg+0x5c/0xb0
[    9.303939] [c0000002e899be20] [c0000000000006b0] system_call+0x60/0x6c

Signed-off-by: Scott Wood <oss@buserror.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fman/fman_memac.c | 2 +-
 drivers/net/ethernet/freescale/fman/fman_tgec.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
index bc6eb30aa20f..41c6fa200e74 100644
--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
@@ -928,7 +928,7 @@ int memac_add_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
 	hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK;
 
 	/* Create element to be added to the driver hash table */
-	hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
+	hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
 	if (!hash_entry)
 		return -ENOMEM;
 	hash_entry->addr = addr;
diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
index 40705938eecc..f75b9c11b2d2 100644
--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
@@ -553,7 +553,7 @@ int tgec_add_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
 	hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK;
 
 	/* Create element to be added to the driver hash table */
-	hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
+	hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
 	if (!hash_entry)
 		return -ENOMEM;
 	hash_entry->addr = addr;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 273/352] block/swim3: Fix -EBUSY error when re-opening device after unmount
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 272/352] fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 274/352] thermal: bcm2835: enable hwmon explicitly Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, linuxppc-dev, Finn Thain, Jens Axboe,
	Sasha Levin, Stan Johnson

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 296dcc40f2f2e402facf7cd26cf3f2c8f4b17d47 ]

When the block device is opened with FMODE_EXCL, ref_count is set to -1.
This value doesn't get reset when the device is closed which means the
device cannot be opened again. Fix this by checking for refcount <= 0
in the release method.

Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/swim3.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index c1c676a33e4a..3f6df3f1f5d9 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -995,7 +995,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode)
 	struct swim3 __iomem *sw = fs->swim3;
 
 	mutex_lock(&swim3_mutex);
-	if (fs->ref_count > 0 && --fs->ref_count == 0) {
+	if (fs->ref_count > 0)
+		--fs->ref_count;
+	else if (fs->ref_count == -1)
+		fs->ref_count = 0;
+	if (fs->ref_count == 0) {
 		swim3_action(fs, MOTOR_OFF);
 		out_8(&sw->control_bic, 0xff);
 		swim3_select(fs, RELAX);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 274/352] thermal: bcm2835: enable hwmon explicitly
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 273/352] block/swim3: Fix -EBUSY error when re-opening device after unmount Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 275/352] kdb: Dont back trace on a cpu that didnt round up Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Brugger, Stefan Wahren,
	Eduardo Valentin, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit d56c19d07e0bc3ceff366a49b7d7a2440c967b1b ]

By defaul of-based thermal driver do not enable hwmon.
This patch does this explicitly, so that the temperature can be read
through the common hwmon sysfs.

Signed-off-by: Matthias Brugger <mbrugger@suse.com>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/broadcom/bcm2835_thermal.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
index b9d90f0ed504..720760cd493f 100644
--- a/drivers/thermal/broadcom/bcm2835_thermal.c
+++ b/drivers/thermal/broadcom/bcm2835_thermal.c
@@ -18,6 +18,8 @@
 #include <linux/platform_device.h>
 #include <linux/thermal.h>
 
+#include "../thermal_hwmon.h"
+
 #define BCM2835_TS_TSENSCTL			0x00
 #define BCM2835_TS_TSENSSTAT			0x04
 
@@ -266,6 +268,15 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, tz);
 
+	/*
+	 * Thermal_zone doesn't enable hwmon as default,
+	 * enable it here
+	 */
+	tz->tzp->no_hwmon = false;
+	err = thermal_add_hwmon_sysfs(tz);
+	if (err)
+		goto err_tz;
+
 	bcm2835_thermal_debugfs(pdev);
 
 	return 0;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 275/352] kdb: Dont back trace on a cpu that didnt round up
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 274/352] thermal: bcm2835: enable hwmon explicitly Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 276/352] thermal: tsens: qcom: do not create duplicate regmap debugfs entries Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Daniel Thompson,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 162bc7f5afd75b72acbe3c5f3488ef7e64a3fe36 ]

If you have a CPU that fails to round up and then run 'btc' you'll end
up crashing in kdb becaue we dereferenced NULL.  Let's add a check.
It's wise to also set the task to NULL when leaving the debugger so
that if we fail to round up on a later entry into the debugger we
won't backtrace a stale task.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/debug_core.c       |  4 ++++
 kernel/debug/kdb/kdb_bt.c       | 11 ++++++++++-
 kernel/debug/kdb/kdb_debugger.c |  7 -------
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 65c0f1363788..94aa9ae0007a 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -535,6 +535,8 @@ return_normal:
 				arch_kgdb_ops.correct_hw_break();
 			if (trace_on)
 				tracing_on();
+			kgdb_info[cpu].debuggerinfo = NULL;
+			kgdb_info[cpu].task = NULL;
 			kgdb_info[cpu].exception_state &=
 				~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
 			kgdb_info[cpu].enter_kgdb--;
@@ -667,6 +669,8 @@ kgdb_restore:
 	if (trace_on)
 		tracing_on();
 
+	kgdb_info[cpu].debuggerinfo = NULL;
+	kgdb_info[cpu].task = NULL;
 	kgdb_info[cpu].exception_state &=
 		~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
 	kgdb_info[cpu].enter_kgdb--;
diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
index 7921ae4fca8d..7e2379aa0a1e 100644
--- a/kernel/debug/kdb/kdb_bt.c
+++ b/kernel/debug/kdb/kdb_bt.c
@@ -186,7 +186,16 @@ kdb_bt(int argc, const char **argv)
 		kdb_printf("btc: cpu status: ");
 		kdb_parse("cpu\n");
 		for_each_online_cpu(cpu) {
-			sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
+			void *kdb_tsk = KDB_TSK(cpu);
+
+			/* If a CPU failed to round up we could be here */
+			if (!kdb_tsk) {
+				kdb_printf("WARNING: no task for cpu %ld\n",
+					   cpu);
+				continue;
+			}
+
+			sprintf(buf, "btt 0x%px\n", kdb_tsk);
 			kdb_parse(buf);
 			touch_nmi_watchdog();
 		}
diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
index 15e1a7af5dd0..53a0df6e4d92 100644
--- a/kernel/debug/kdb/kdb_debugger.c
+++ b/kernel/debug/kdb/kdb_debugger.c
@@ -118,13 +118,6 @@ int kdb_stub(struct kgdb_state *ks)
 	kdb_bp_remove();
 	KDB_STATE_CLEAR(DOING_SS);
 	KDB_STATE_SET(PAGER);
-	/* zero out any offline cpu data */
-	for_each_present_cpu(i) {
-		if (!cpu_online(i)) {
-			kgdb_info[i].debuggerinfo = NULL;
-			kgdb_info[i].task = NULL;
-		}
-	}
 	if (ks->err_code == DIE_OOPS || reason == KDB_REASON_OOPS) {
 		ks->pass_exception = 1;
 		KDB_FLAG_SET(CATASTROPHIC);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 276/352] thermal: tsens: qcom: do not create duplicate regmap debugfs entries
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 275/352] kdb: Dont back trace on a cpu that didnt round up Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 277/352] PCI: imx: Enable MSI from downstream components Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Amit Kucheria,
	Eduardo Valentin, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4ab248b3b10a58e379e2d32333fff99ea5ca256c ]

Regmap would use device name to create debugfs entries. If the device
has multiple regmaps it is recommended to use name field in regmap_config.
Fix this by providing name to the regmap configs correctly.

Without this patch we would see below error on DB820c.

qcom-tsens 4a9000.thermal-sensor: Failed to create 4a9000.thermal-sensor
debugfs directory

Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Amit Kucheria <amit.kucheria@linaro.org>
Tested-by: Amit Kucheria <amit.kucheria@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/qcom/tsens-common.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/qcom/tsens-common.c b/drivers/thermal/qcom/tsens-common.c
index 3be4be2e0465..78652cac7f3d 100644
--- a/drivers/thermal/qcom/tsens-common.c
+++ b/drivers/thermal/qcom/tsens-common.c
@@ -114,6 +114,14 @@ int get_temp_common(struct tsens_device *tmdev, int id, int *temp)
 }
 
 static const struct regmap_config tsens_config = {
+	.name		= "tm",
+	.reg_bits	= 32,
+	.val_bits	= 32,
+	.reg_stride	= 4,
+};
+
+static const struct regmap_config tsens_srot_config = {
+	.name		= "srot",
 	.reg_bits	= 32,
 	.val_bits	= 32,
 	.reg_stride	= 4,
@@ -139,8 +147,8 @@ int __init init_common(struct tsens_device *tmdev)
 		if (IS_ERR(srot_base))
 			return PTR_ERR(srot_base);
 
-		tmdev->srot_map = devm_regmap_init_mmio(tmdev->dev,
-							srot_base, &tsens_config);
+		tmdev->srot_map = devm_regmap_init_mmio(tmdev->dev, srot_base,
+							&tsens_srot_config);
 		if (IS_ERR(tmdev->srot_map))
 			return PTR_ERR(tmdev->srot_map);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 277/352] PCI: imx: Enable MSI from downstream components
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 276/352] thermal: tsens: qcom: do not create duplicate regmap debugfs entries Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 278/352] block/swim3: Fix regression on PowerBook G3 Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Zhu, Bjorn Helgaas,
	Sven Van Asbroeck, Trent Piepho, Lucas Stach, Lorenzo Pieralisi,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 75cb8d20c112aba70f23d98e3f8d0a38ace16006 ]

The MSI Enable bit in the MSI Capability (PCIe r4.0, sec 7.7.1.2) controls
whether a Function can request service using MSI.

i.MX6 Root Ports implement the MSI Capability and may use MSI to request
service for events like PME, hotplug, AER, etc.  In addition, on i.MX6, the
MSI Enable bit controls delivery of MSI interrupts from components below
the Root Port.

Prior to f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of
CONFIG_PCIEPORTBUS"), enabling CONFIG_PCI_IMX6 automatically also enabled
CONFIG_PCIEPORTBUS, and when portdrv claimed the Root Ports, it set the MSI
Enable bit so it could use PME, hotplug, AER, etc.  As a side effect, that
also enabled delivery of MSI interrupts from downstream components.

The imx6q-pcie driver itself does not depend on portdrv, so set MSI Enable
in imx6q-pcie so MSI from downstream components works even if nobody uses
MSI for the Root Port events.

Fixes: f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of CONFIG_PCIEPORTBUS")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Sven Van Asbroeck <TheSven73@googlemail.com>
Tested-by: Trent Piepho <tpiepho@impinj.com>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pci-imx6.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 88af6bff945f..6b54528b5f0c 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -67,6 +67,7 @@ struct imx6_pcie {
 #define PHY_PLL_LOCK_WAIT_USLEEP_MAX	200
 
 /* PCIe Root Complex registers (memory-mapped) */
+#define PCIE_RC_IMX6_MSI_CAP			0x50
 #define PCIE_RC_LCR				0x7c
 #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN1	0x1
 #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN2	0x2
@@ -840,6 +841,7 @@ static int imx6_pcie_probe(struct platform_device *pdev)
 	struct resource *dbi_base;
 	struct device_node *node = dev->of_node;
 	int ret;
+	u16 val;
 
 	imx6_pcie = devm_kzalloc(dev, sizeof(*imx6_pcie), GFP_KERNEL);
 	if (!imx6_pcie)
@@ -981,6 +983,14 @@ static int imx6_pcie_probe(struct platform_device *pdev)
 	if (ret < 0)
 		return ret;
 
+	if (pci_msi_enabled()) {
+		val = dw_pcie_readw_dbi(pci, PCIE_RC_IMX6_MSI_CAP +
+					PCI_MSI_FLAGS);
+		val |= PCI_MSI_FLAGS_ENABLE;
+		dw_pcie_writew_dbi(pci, PCIE_RC_IMX6_MSI_CAP + PCI_MSI_FLAGS,
+				   val);
+	}
+
 	return 0;
 }
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 278/352] block/swim3: Fix regression on PowerBook G3
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 277/352] PCI: imx: Enable MSI from downstream components Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 279/352] thermal: generic-adc: Fix adc to temp interpolation Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, linuxppc-dev, Finn Thain, Jens Axboe,
	Sasha Levin, Stan Johnson

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 427c5ce4417cba0801fbf79c8525d1330704759c ]

As of v4.20, the swim3 driver crashes when loaded on a PowerBook G3
(Wallstreet).

MacIO PCI driver attached to Gatwick chipset
MacIO PCI driver attached to Heathrow chipset
swim3 0.00015000:floppy: [fd0] SWIM3 floppy controller in media bay
0.00013020:ch-a: ttyS0 at MMIO 0xf3013020 (irq = 16, base_baud = 230400) is a Z85c30 ESCC - Serial port
0.00013000:ch-b: ttyS1 at MMIO 0xf3013000 (irq = 17, base_baud = 230400) is a Z85c30 ESCC - Infrared port
macio: fixed media-bay irq on gatwick
macio: fixed left floppy irqs
swim3 1.00015000:floppy: [fd1] Couldn't request interrupt
Unable to handle kernel paging request for data at address 0x00000024
Faulting instruction address: 0xc02652f8
Oops: Kernel access of bad area, sig: 11 [#1]
BE SMP NR_CPUS=2 PowerMac
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.20.0 #2
NIP:  c02652f8 LR: c026915c CTR: c0276d1c
REGS: df43ba10 TRAP: 0300   Not tainted  (4.20.0)
MSR:  00009032 <EE,ME,IR,DR,RI>  CR: 28228288  XER: 00000100
DAR: 00000024 DSISR: 40000000
GPR00: c026915c df43bac0 df439060 c0731524 df494700 00000000 c06e1c08 00000001
GPR08: 00000001 00000000 df5ff220 00001032 28228282 00000000 c0004ca4 00000000
GPR16: 00000000 00000000 00000000 c073144c dfffe064 c0731524 00000120 c0586108
GPR24: c073132c c073143c c073143c 00000000 c0731524 df67cd70 df494700 00000001
NIP [c02652f8] blk_mq_free_rqs+0x28/0xf8
LR [c026915c] blk_mq_sched_tags_teardown+0x58/0x84
Call Trace:
[df43bac0] [c0045f50] flush_workqueue_prep_pwqs+0x178/0x1c4 (unreliable)
[df43bae0] [c026915c] blk_mq_sched_tags_teardown+0x58/0x84
[df43bb00] [c02697f0] blk_mq_exit_sched+0x9c/0xb8
[df43bb20] [c0252794] elevator_exit+0x84/0xa4
[df43bb40] [c0256538] blk_exit_queue+0x30/0x50
[df43bb50] [c0256640] blk_cleanup_queue+0xe8/0x184
[df43bb70] [c034732c] swim3_attach+0x330/0x5f0
[df43bbb0] [c034fb24] macio_device_probe+0x58/0xec
[df43bbd0] [c032ba88] really_probe+0x1e4/0x2f4
[df43bc00] [c032bd28] driver_probe_device+0x64/0x204
[df43bc20] [c0329ac4] bus_for_each_drv+0x60/0xac
[df43bc50] [c032b824] __device_attach+0xe8/0x160
[df43bc80] [c032ab38] bus_probe_device+0xa0/0xbc
[df43bca0] [c0327338] device_add+0x3d8/0x630
[df43bcf0] [c0350848] macio_add_one_device+0x444/0x48c
[df43bd50] [c03509f8] macio_pci_add_devices+0x168/0x1bc
[df43bd90] [c03500ec] macio_pci_probe+0xc0/0x10c
[df43bda0] [c02ad884] pci_device_probe+0xd4/0x184
[df43bdd0] [c032ba88] really_probe+0x1e4/0x2f4
[df43be00] [c032bd28] driver_probe_device+0x64/0x204
[df43be20] [c032bfcc] __driver_attach+0x104/0x108
[df43be40] [c0329a00] bus_for_each_dev+0x64/0xb4
[df43be70] [c032add8] bus_add_driver+0x154/0x238
[df43be90] [c032ca24] driver_register+0x84/0x148
[df43bea0] [c0004aa0] do_one_initcall+0x40/0x188
[df43bf00] [c0690100] kernel_init_freeable+0x138/0x1d4
[df43bf30] [c0004cbc] kernel_init+0x18/0x10c
[df43bf40] [c00121e4] ret_from_kernel_thread+0x14/0x1c
Instruction dump:
5484d97e 4bfff4f4 9421ffe0 7c0802a6 bf410008 7c9e2378 90010024 8124005c
2f890000 419e0078 81230004 7c7c1b78 <81290024> 2f890000 419e0064 81440000
---[ end trace 12025ab921a9784c ]---

Reverting commit 8ccb8cb1892b ("swim3: convert to blk-mq") resolves the
problem.

That commit added a struct blk_mq_tag_set to struct floppy_state and
initialized it with a blk_mq_init_sq_queue() call. Unfortunately, there
is a memset() in swim3_add_device() that subsequently clears the
floppy_state struct. That means fs->tag_set->ops is a NULL pointer, and
it gets dereferenced by blk_mq_free_rqs() which gets called in the
request_irq() error path. Move the memset() to fix this bug.

BTW, the request_irq() failure for the left mediabay floppy (fd1) is not
a regression. I don't know why it happens. The right media bay floppy
(fd0) works fine however.

Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
Fixes: 8ccb8cb1892b ("swim3: convert to blk-mq")
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>

Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/swim3.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 3f6df3f1f5d9..1046459f172b 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -1091,8 +1091,6 @@ static int swim3_add_device(struct macio_dev *mdev, int index)
 	struct floppy_state *fs = &floppy_states[index];
 	int rc = -EBUSY;
 
-	/* Do this first for message macros */
-	memset(fs, 0, sizeof(*fs));
 	fs->mdev = mdev;
 	fs->index = index;
 
@@ -1192,14 +1190,15 @@ static int swim3_attach(struct macio_dev *mdev,
 			return rc;
 	}
 
-	fs = &floppy_states[floppy_count];
-
 	disk = alloc_disk(1);
 	if (disk == NULL) {
 		rc = -ENOMEM;
 		goto out_unregister;
 	}
 
+	fs = &floppy_states[floppy_count];
+	memset(fs, 0, sizeof(*fs));
+
 	disk->queue = blk_mq_init_sq_queue(&fs->tag_set, &swim3_mq_ops, 2,
 						BLK_MQ_F_SHOULD_MERGE);
 	if (IS_ERR(disk->queue)) {
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 279/352] thermal: generic-adc: Fix adc to temp interpolation
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 278/352] block/swim3: Fix regression on PowerBook G3 Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 280/352] HID: lenovo: Add checks to fix of_led_classdev_register Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laxman Dewangan, Bjorn Andersson,
	Eduardo Valentin, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 9d216211fded20fff301d0317af3238d8383634c ]

First correct the edge case to return the last element if we're
outside the range, rather than at the last element, so that
interpolation is not omitted for points between the two last entries in
the table.

Then correct the formula to perform linear interpolation based the two
points surrounding the read ADC value. The indices for temp are kept as
"hi" and "lo" to pair with the adc indices, but there's no requirement
that the temperature is provided in descendent order. mult_frac() is
used to prevent issues with overflowing the int.

Cc: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal-generic-adc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/thermal-generic-adc.c b/drivers/thermal/thermal-generic-adc.c
index bf1c628d4a7a..e22fc60ad36d 100644
--- a/drivers/thermal/thermal-generic-adc.c
+++ b/drivers/thermal/thermal-generic-adc.c
@@ -26,7 +26,7 @@ struct gadc_thermal_info {
 
 static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val)
 {
-	int temp, adc_hi, adc_lo;
+	int temp, temp_hi, temp_lo, adc_hi, adc_lo;
 	int i;
 
 	for (i = 0; i < gti->nlookup_table; i++) {
@@ -36,13 +36,17 @@ static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val)
 
 	if (i == 0) {
 		temp = gti->lookup_table[0];
-	} else if (i >= (gti->nlookup_table - 1)) {
+	} else if (i >= gti->nlookup_table) {
 		temp = gti->lookup_table[2 * (gti->nlookup_table - 1)];
 	} else {
 		adc_hi = gti->lookup_table[2 * i - 1];
 		adc_lo = gti->lookup_table[2 * i + 1];
-		temp = gti->lookup_table[2 * i];
-		temp -= ((val - adc_lo) * 1000) / (adc_hi - adc_lo);
+
+		temp_hi = gti->lookup_table[2 * i - 2];
+		temp_lo = gti->lookup_table[2 * i];
+
+		temp = temp_hi + mult_frac(temp_lo - temp_hi, val - adc_hi,
+					   adc_lo - adc_hi);
 	}
 
 	return temp;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 280/352] HID: lenovo: Add checks to fix of_led_classdev_register
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 279/352] thermal: generic-adc: Fix adc to temp interpolation Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 281/352] arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Jiri Kosina, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 6ae16dfb61bce538d48b7fe98160fada446056c5 ]

In lenovo_probe_tpkbd(), the function of_led_classdev_register() could
return an error value that is unchecked. The fix adds these checks.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-lenovo.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 643b6eb54442..eacc76d2ab96 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -743,7 +743,9 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
 	data_pointer->led_mute.brightness_get = lenovo_led_brightness_get_tpkbd;
 	data_pointer->led_mute.brightness_set = lenovo_led_brightness_set_tpkbd;
 	data_pointer->led_mute.dev = dev;
-	led_classdev_register(dev, &data_pointer->led_mute);
+	ret = led_classdev_register(dev, &data_pointer->led_mute);
+	if (ret < 0)
+		goto err;
 
 	data_pointer->led_micmute.name = name_micmute;
 	data_pointer->led_micmute.brightness_get =
@@ -751,7 +753,11 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
 	data_pointer->led_micmute.brightness_set =
 		lenovo_led_brightness_set_tpkbd;
 	data_pointer->led_micmute.dev = dev;
-	led_classdev_register(dev, &data_pointer->led_micmute);
+	ret = led_classdev_register(dev, &data_pointer->led_micmute);
+	if (ret < 0) {
+		led_classdev_unregister(&data_pointer->led_mute);
+		goto err;
+	}
 
 	lenovo_features_set_tpkbd(hdev);
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 281/352] arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 280/352] HID: lenovo: Add checks to fix of_led_classdev_register Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dave Martin, Will Deacon, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ee1b465b303591d3a04d403122bbc0d7026520fb ]

SVE_PT_REGS_OFFSET is supposed to indicate the offset for skipping
over the ptrace NT_ARM_SVE header (struct user_sve_header) to the
start of the SVE register data proper.

However, currently SVE_PT_REGS_OFFSET is defined in terms of struct
sve_context, which is wrong: that structure describes the SVE
header in the signal frame, not in the ptrace regset.

This patch fixes the definition to use the ptrace header structure
struct user_sve_header instead.

By good fortune, the two structures are the same size anyway, so
there is no functional or ABI change.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/uapi/asm/ptrace.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
index a36227fdb084..65ef8b0fdb0e 100644
--- a/arch/arm64/include/uapi/asm/ptrace.h
+++ b/arch/arm64/include/uapi/asm/ptrace.h
@@ -131,7 +131,7 @@ struct user_sve_header {
 
 /* Offset from the start of struct user_sve_header to the register data */
 #define SVE_PT_REGS_OFFSET					\
-	((sizeof(struct sve_context) + (SVE_VQ_BYTES - 1))	\
+	((sizeof(struct user_sve_header) + (SVE_VQ_BYTES - 1))	\
 		/ SVE_VQ_BYTES * SVE_VQ_BYTES)
 
 /*
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 281/352] arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-12  1:02   ` Eric W. Biederman
  2019-02-11 14:18 ` [PATCH 4.20 283/352] kernel/hung_task.c: break RCU locks based on jiffies Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  354 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Benjamin Gordon, Eric W. Biederman,
	John Stultz, Kees Cook, Serge E. Hallyn, Thomas Gleixner,
	Arjan van de Ven, Oren Laadan, Ruchi Kandoi, Rom Lemarchand,
	Todd Kjos, Colin Cross, Nick Kralevich, Dmitry Shmidt,
	Elliott Hughes, Alexey Dobriyan, Andrew Morton, Linus Torvalds,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8da0b4f692c6d90b09c91f271517db746a22ff67 ]

Access to timerslack_ns is controlled by a process having CAP_SYS_NICE
in its effective capability set, but the current check looks in the root
namespace instead of the process' user namespace.  Since a process is
allowed to do other activities controlled by CAP_SYS_NICE inside a
namespace, it should also be able to adjust timerslack_ns.

Link: http://lkml.kernel.org/r/20181030180012.232896-1-bmgordon@google.com
Signed-off-by: Benjamin Gordon <bmgordon@google.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Oren Laadan <orenl@cellrox.com>
Cc: Ruchi Kandoi <kandoiruchi@google.com>
Cc: Rom Lemarchand <romlem@android.com>
Cc: Todd Kjos <tkjos@google.com>
Cc: Colin Cross <ccross@android.com>
Cc: Nick Kralevich <nnk@google.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Elliott Hughes <enh@google.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/base.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index ce3465479447..98525af0953e 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2356,10 +2356,13 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
 		return -ESRCH;
 
 	if (p != current) {
-		if (!capable(CAP_SYS_NICE)) {
+		rcu_read_lock();
+		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
+			rcu_read_unlock();
 			count = -EPERM;
 			goto out;
 		}
+		rcu_read_unlock();
 
 		err = security_task_setscheduler(p);
 		if (err) {
@@ -2392,11 +2395,14 @@ static int timerslack_ns_show(struct seq_file *m, void *v)
 		return -ESRCH;
 
 	if (p != current) {
-
-		if (!capable(CAP_SYS_NICE)) {
+		rcu_read_lock();
+		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
+			rcu_read_unlock();
 			err = -EPERM;
 			goto out;
 		}
+		rcu_read_unlock();
+
 		err = security_task_getscheduler(p);
 		if (err)
 			goto out;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 283/352] kernel/hung_task.c: break RCU locks based on jiffies
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 284/352] proc/sysctl: fix return error for proc_doulongvec_minmax() Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Paul E. McKenney,
	Petr Mladek, Sergey Senozhatsky, Dmitry Vyukov,
	Rafael J. Wysocki, Vitaly Kuznetsov, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 304ae42739b108305f8d7b3eb3c1aec7c2b643a9 ]

check_hung_uninterruptible_tasks() is currently calling rcu_lock_break()
for every 1024 threads.  But check_hung_task() is very slow if printk()
was called, and is very fast otherwise.

If many threads within some 1024 threads called printk(), the RCU grace
period might be extended enough to trigger RCU stall warnings.
Therefore, calling rcu_lock_break() for every some fixed jiffies will be
safer.

Link: http://lkml.kernel.org/r/1544800658-11423-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Paul E. McKenney <paulmck@linux.ibm.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/hung_task.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index cb8e3e8ac7b9..444b8b5dd69f 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -34,7 +34,7 @@ int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT;
  * is disabled during the critical section. It also controls the size of
  * the RCU grace period. So it needs to be upper-bound.
  */
-#define HUNG_TASK_BATCHING 1024
+#define HUNG_TASK_LOCK_BREAK (HZ / 10)
 
 /*
  * Zero means infinite timeout - no checking done:
@@ -173,7 +173,7 @@ static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
 static void check_hung_uninterruptible_tasks(unsigned long timeout)
 {
 	int max_count = sysctl_hung_task_check_count;
-	int batch_count = HUNG_TASK_BATCHING;
+	unsigned long last_break = jiffies;
 	struct task_struct *g, *t;
 
 	/*
@@ -188,10 +188,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
 	for_each_process_thread(g, t) {
 		if (!max_count--)
 			goto unlock;
-		if (!--batch_count) {
-			batch_count = HUNG_TASK_BATCHING;
+		if (time_after(jiffies, last_break + HUNG_TASK_LOCK_BREAK)) {
 			if (!rcu_lock_break(g, t))
 				goto unlock;
+			last_break = jiffies;
 		}
 		/* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
 		if (t->state == TASK_UNINTERRUPTIBLE)
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 284/352] proc/sysctl: fix return error for proc_doulongvec_minmax()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 283/352] kernel/hung_task.c: break RCU locks based on jiffies Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 285/352] kernel/hung_task.c: force console verbose before panic Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cheng Lin, Luis Chamberlain,
	Kees Cook, Alexey Dobriyan, Andrew Morton, Linus Torvalds,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 09be178400829dddc1189b50a7888495dd26aa84 ]

If the number of input parameters is less than the total parameters, an
EINVAL error will be returned.

For example, we use proc_doulongvec_minmax to pass up to two parameters
with kern_table:

{
	.procname       = "monitor_signals",
	.data           = &monitor_sigs,
	.maxlen         = 2*sizeof(unsigned long),
	.mode           = 0644,
	.proc_handler   = proc_doulongvec_minmax,
},

Reproduce:

When passing two parameters, it's work normal.  But passing only one
parameter, an error "Invalid argument"(EINVAL) is returned.

  [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  1       2
  [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
  -bash: echo: write error: Invalid argument
  [root@cl150 ~]# echo $?
  1
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  3       2
  [root@cl150 ~]#

The following is the result after apply this patch.  No error is
returned when the number of input parameters is less than the total
parameters.

  [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  1       2
  [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# echo $?
  0
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  3       2
  [root@cl150 ~]#

There are three processing functions dealing with digital parameters,
__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax.

This patch deals with __do_proc_doulongvec_minmax, just as
__do_proc_dointvec does, adding a check for parameters 'left'.  In
__do_proc_douintvec, its code implementation explicitly does not support
multiple inputs.

static int __do_proc_douintvec(...){
         ...
         /*
          * Arrays are not supported, keep this simple. *Do not* add
          * support for them.
          */
         if (vleft != 1) {
                 *lenp = 0;
                 return -EINVAL;
         }
         ...
}

So, just __do_proc_doulongvec_minmax has the problem.  And most use of
proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one
parameter.

Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sysctl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 5fc724e4e454..9ee261fce89e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2779,6 +2779,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
 			bool neg;
 
 			left -= proc_skip_spaces(&p);
+			if (!left)
+				break;
 
 			err = proc_get_long(&p, &left, &val, &neg,
 					     proc_wspace_sep,
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 285/352] kernel/hung_task.c: force console verbose before panic
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 284/352] proc/sysctl: fix return error for proc_doulongvec_minmax() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 286/352] fs/epoll: drop ovflist branch prediction Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuansheng Liu, Petr Mladek,
	Sergey Senozhatsky, Tetsuo Handa, Andrew Morton, Linus Torvalds,
	Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 168e06f7937d96c7222037d8a05565e8a6eb00fe ]

Based on commit 401c636a0eeb ("kernel/hung_task.c: show all hung tasks
before panic"), we could get the call stack of hung task.

However, if the console loglevel is not high, we still can not see the
useful panic information in practice, and in most cases users don't set
console loglevel to high level.

This patch is to force console verbose before system panic, so that the
real useful information can be seen in the console, instead of being
like the following, which doesn't have hung task information.

  INFO: task init:1 blocked for more than 120 seconds.
        Tainted: G     U  W         4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  Kernel panic - not syncing: hung_task: blocked tasks
  CPU: 2 PID: 479 Comm: khungtaskd Tainted: G     U  W         4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1
  Call Trace:
   dump_stack+0x4f/0x65
   panic+0xde/0x231
   watchdog+0x290/0x410
   kthread+0x12c/0x150
   ret_from_fork+0x35/0x40
  reboot: panic mode set: p,w
  Kernel Offset: 0x34000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)

Link: http://lkml.kernel.org/r/27240C0AC20F114CBF8149A2696CBE4A6015B675@SHSMSX101.ccr.corp.intel.com
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/hung_task.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 444b8b5dd69f..4a9191617076 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -112,8 +112,11 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
 
 	trace_sched_process_hang(t);
 
-	if (!sysctl_hung_task_warnings && !sysctl_hung_task_panic)
-		return;
+	if (sysctl_hung_task_panic) {
+		console_verbose();
+		hung_task_show_lock = true;
+		hung_task_call_panic = true;
+	}
 
 	/*
 	 * Ok, the task did not get scheduled for more than 2 minutes,
@@ -135,11 +138,6 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
 	}
 
 	touch_nmi_watchdog();
-
-	if (sysctl_hung_task_panic) {
-		hung_task_show_lock = true;
-		hung_task_call_panic = true;
-	}
 }
 
 /*
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 286/352] fs/epoll: drop ovflist branch prediction
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 285/352] kernel/hung_task.c: force console verbose before panic Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 287/352] exec: load_script: dont blindly truncate shebang string Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Davidlohr Bueso, Andrew Morton,
	Al Viro, Jason Baron, Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 76699a67f3041ff4c7af6d6ee9be2bfbf1ffb671 ]

The ep->ovflist is a secondary ready-list to temporarily store events
that might occur when doing sproc without holding the ep->wq.lock.  This
accounts for every time we check for ready events and also send events
back to userspace; both callbacks, particularly the latter because of
copy_to_user, can account for a non-trivial time.

As such, the unlikely() check to see if the pointer is being used, seems
both misleading and sub-optimal.  In fact, we go to an awful lot of
trouble to sync both lists, and populating the ovflist is far from an
uncommon scenario.

For example, profiling a concurrent epoll_wait(2) benchmark, with
CONFIG_PROFILE_ANNOTATED_BRANCHES shows that for a two threads a 33%
incorrect rate was seen; and when incrementally increasing the number of
epoll instances (which is used, for example for multiple queuing load
balancing models), up to a 90% incorrect rate was seen.

Similarly, by deleting the prediction, 3% throughput boost was seen
across incremental threads.

Link: http://lkml.kernel.org/r/20181108051006.18751-4-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/eventpoll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 42bbe6824b4b..58f48ea0db23 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1154,7 +1154,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v
 	 * semantics). All the events that happen during that period of time are
 	 * chained in ep->ovflist and requeued later on.
 	 */
-	if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) {
+	if (ep->ovflist != EP_UNACTIVE_PTR) {
 		if (epi->next == EP_UNACTIVE_PTR) {
 			epi->next = ep->ovflist;
 			ep->ovflist = epi;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 287/352] exec: load_script: dont blindly truncate shebang string
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 286/352] fs/epoll: drop ovflist branch prediction Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 288/352] kernel/kcov.c: mark write_comp_data() as notrace Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Kees Cook,
	Michal Hocko, Ben Woodard, Eric W. Biederman, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 8099b047ecc431518b9bb6bdbba3549bbecdc343 ]

load_script() simply truncates bprm->buf and this is very wrong if the
length of shebang string exceeds BINPRM_BUF_SIZE-2.  This can silently
truncate i_arg or (worse) we can execute the wrong binary if buf[2:126]
happens to be the valid executable path.

Change load_script() to return ENOEXEC if it can't find '\n' or zero in
bprm->buf.  Note that '\0' can come from either
prepare_binprm()->memset() or from kernel_read(), we do not care.

Link: http://lkml.kernel.org/r/20181112160931.GA28463@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Ben Woodard <woodard@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/binfmt_script.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 7cde3f46ad26..d0078cbb718b 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -42,10 +42,14 @@ static int load_script(struct linux_binprm *bprm)
 	fput(bprm->file);
 	bprm->file = NULL;
 
-	bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
-	if ((cp = strchr(bprm->buf, '\n')) == NULL)
-		cp = bprm->buf+BINPRM_BUF_SIZE-1;
+	for (cp = bprm->buf+2;; cp++) {
+		if (cp >= bprm->buf + BINPRM_BUF_SIZE)
+			return -ENOEXEC;
+		if (!*cp || (*cp == '\n'))
+			break;
+	}
 	*cp = '\0';
+
 	while (cp > bprm->buf) {
 		cp--;
 		if ((*cp == ' ') || (*cp == '\t'))
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 288/352] kernel/kcov.c: mark write_comp_data() as notrace
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 287/352] exec: load_script: dont blindly truncate shebang string Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 289/352] scripts/gdb: fix lx-version string output Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anders Roxell, Arnd Bergmann,
	Steven Rostedt (VMware),
	Will Deacon, Andrew Morton, Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 634724431607f6f46c495dfef801a1c8b44a96d9 ]

Since __sanitizer_cov_trace_const_cmp4 is marked as notrace, the
function called from __sanitizer_cov_trace_const_cmp4 shouldn't be
traceable either.  ftrace_graph_caller() gets called every time func
write_comp_data() gets called if it isn't marked 'notrace'.  This is the
backtrace from gdb:

 #0  ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:179
 #1  0xffffff8010201920 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:151
 #2  0xffffff8010439714 in write_comp_data (type=5, arg1=0, arg2=0, ip=18446743524224276596) at ../kernel/kcov.c:116
 #3  0xffffff8010439894 in __sanitizer_cov_trace_const_cmp4 (arg1=<optimized out>, arg2=<optimized out>) at ../kernel/kcov.c:188
 #4  0xffffff8010201874 in prepare_ftrace_return (self_addr=18446743524226602768, parent=0xffffff801014b918, frame_pointer=18446743524223531344) at ./include/generated/atomic-instrumented.h:27
 #5  0xffffff801020194c in ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:182

Rework so that write_comp_data() that are called from
__sanitizer_cov_trace_*_cmp*() are marked as 'notrace'.

Commit 903e8ff86753 ("kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace")
missed to mark write_comp_data() as 'notrace'. When that patch was
created gcc-7 was used. In lib/Kconfig.debug
config KCOV_ENABLE_COMPARISONS
	depends on $(cc-option,-fsanitize-coverage=trace-cmp)

That code path isn't hit with gcc-7. However, it were that with gcc-8.

Link: http://lkml.kernel.org/r/20181206143011.23719-1-anders.roxell@linaro.org
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Co-developed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kcov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kcov.c b/kernel/kcov.c
index 97959d7b77e2..c2277dbdbfb1 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -112,7 +112,7 @@ void notrace __sanitizer_cov_trace_pc(void)
 EXPORT_SYMBOL(__sanitizer_cov_trace_pc);
 
 #ifdef CONFIG_KCOV_ENABLE_COMPARISONS
-static void write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
+static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 {
 	struct task_struct *t;
 	u64 *area;
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 289/352] scripts/gdb: fix lx-version string output
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 288/352] kernel/kcov.c: mark write_comp_data() as notrace Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 290/352] xprtrdma: Dont wake pending tasks until disconnect is done Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Du Changbin, Kieran Bingham,
	Jan Kiszka, Jason Wessel, Daniel Thompson, Andrew Morton,
	Linus Torvalds, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit b058809bfc8faeb7b7cae047666e23375a060059 ]

A bug is present in GDB which causes early string termination when
parsing variables.  This has been reported [0], but we should ensure
that we can support at least basic printing of the core kernel strings.

For current gdb version (has been tested with 7.3 and 8.1), 'lx-version'
only prints one character.

  (gdb) lx-version
  L(gdb)

This can be fixed by casting 'linux_banner' as (char *).

  (gdb) lx-version
  Linux version 4.19.0-rc1+ (changbin@acer) (gcc version 7.3.0 (Ubuntu 7.3.0-16ubuntu3)) #21 SMP Sat Sep 1 21:43:30 CST 2018

[0] https://sourceware.org/bugzilla/show_bug.cgi?id=20077

[kbingham@kernel.org: add detail to commit message]
Link: http://lkml.kernel.org/r/20181111162035.8356-1-kieran.bingham@ideasonboard.com
Fixes: 2d061d999424 ("scripts/gdb: add version command")
Signed-off-by: Du Changbin <changbin.du@gmail.com>
Signed-off-by: Kieran Bingham <kbingham@kernel.org>
Acked-by: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Jason Wessel <jason.wessel@windriver.com>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/gdb/linux/proc.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/gdb/linux/proc.py b/scripts/gdb/linux/proc.py
index 086d27223c0c..0aebd7565b03 100644
--- a/scripts/gdb/linux/proc.py
+++ b/scripts/gdb/linux/proc.py
@@ -41,7 +41,7 @@ class LxVersion(gdb.Command):
 
     def invoke(self, arg, from_tty):
         # linux_banner should contain a newline
-        gdb.write(gdb.parse_and_eval("linux_banner").string())
+        gdb.write(gdb.parse_and_eval("(char *)linux_banner").string())
 
 LxVersion()
 
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 290/352] xprtrdma: Dont wake pending tasks until disconnect is done
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 289/352] scripts/gdb: fix lx-version string output Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 291/352] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker, Sasha Levin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 0c0829bcf51aef713806e49b8ea2bac7962f54e2 ]

Transport disconnect processing does a "wake pending tasks" at
various points.

Suppose an RPC Reply is being processed. The RPC task that Reply
goes with is waiting on the pending queue. If a disconnect wake-up
happens before reply processing is done, that reply, even if it is
good, is thrown away, and the RPC has to be sent again.

This window apparently does not exist for socket transports because
there is a lock held while a reply is being received which prevents
the wake-up call until after reply processing is done.

To resolve this, all RPC replies being processed on an RPC-over-RDMA
transport have to complete before pending tasks are awoken due to a
transport disconnect.

Callers that already hold the transport write lock may invoke
->ops->close directly. Others use a generic helper that schedules
a close when the write lock can be taken safely.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtrdma/backchannel.c          | 13 +++++++------
 net/sunrpc/xprtrdma/svc_rdma_backchannel.c |  8 +++++---
 net/sunrpc/xprtrdma/transport.c            | 17 ++++++++++-------
 net/sunrpc/xprtrdma/verbs.c                |  1 -
 net/sunrpc/xprtrdma/xprt_rdma.h            |  1 +
 5 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index e5b367a3e517..88fde80b9347 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -193,14 +193,15 @@ static int rpcrdma_bc_marshal_reply(struct rpc_rqst *rqst)
  */
 int xprt_rdma_bc_send_reply(struct rpc_rqst *rqst)
 {
-	struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(rqst->rq_xprt);
+	struct rpc_xprt *xprt = rqst->rq_xprt;
+	struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
 	struct rpcrdma_req *req = rpcr_to_rdmar(rqst);
 	int rc;
 
-	if (!xprt_connected(rqst->rq_xprt))
-		goto drop_connection;
+	if (!xprt_connected(xprt))
+		return -ENOTCONN;
 
-	if (!xprt_request_get_cong(rqst->rq_xprt, rqst))
+	if (!xprt_request_get_cong(xprt, rqst))
 		return -EBADSLT;
 
 	rc = rpcrdma_bc_marshal_reply(rqst);
@@ -216,7 +217,7 @@ failed_marshal:
 	if (rc != -ENOTCONN)
 		return rc;
 drop_connection:
-	xprt_disconnect_done(rqst->rq_xprt);
+	xprt_rdma_close(xprt);
 	return -ENOTCONN;
 }
 
@@ -339,7 +340,7 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,
 
 out_overflow:
 	pr_warn("RPC/RDMA backchannel overflow\n");
-	xprt_disconnect_done(xprt);
+	xprt_force_disconnect(xprt);
 	/* This receive buffer gets reposted automatically
 	 * when the connection is re-established.
 	 */
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index f3c147d70286..b908f2ca08fd 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -200,11 +200,10 @@ rpcrdma_bc_send_request(struct svcxprt_rdma *rdma, struct rpc_rqst *rqst)
 		svc_rdma_send_ctxt_put(rdma, ctxt);
 		goto drop_connection;
 	}
-	return rc;
+	return 0;
 
 drop_connection:
 	dprintk("svcrdma: failed to send bc call\n");
-	xprt_disconnect_done(xprt);
 	return -ENOTCONN;
 }
 
@@ -225,8 +224,11 @@ xprt_rdma_bc_send_request(struct rpc_rqst *rqst)
 
 	ret = -ENOTCONN;
 	rdma = container_of(sxprt, struct svcxprt_rdma, sc_xprt);
-	if (!test_bit(XPT_DEAD, &sxprt->xpt_flags))
+	if (!test_bit(XPT_DEAD, &sxprt->xpt_flags)) {
 		ret = rpcrdma_bc_send_request(rdma, rqst);
+		if (ret == -ENOTCONN)
+			svc_close_xprt(sxprt);
+	}
 
 	mutex_unlock(&sxprt->xpt_mutex);
 
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index ae2a83828953..e7683d3b1e6c 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -437,8 +437,7 @@ out1:
  * Caller holds @xprt's send lock to prevent activity on this
  * transport while the connection is torn down.
  */
-static void
-xprt_rdma_close(struct rpc_xprt *xprt)
+void xprt_rdma_close(struct rpc_xprt *xprt)
 {
 	struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
 	struct rpcrdma_ep *ep = &r_xprt->rx_ep;
@@ -449,13 +448,13 @@ xprt_rdma_close(struct rpc_xprt *xprt)
 	if (test_and_clear_bit(RPCRDMA_IAF_REMOVING, &ia->ri_flags)) {
 		xprt_clear_connected(xprt);
 		rpcrdma_ia_remove(ia);
-		return;
+		goto out;
 	}
+
 	if (ep->rep_connected == -ENODEV)
 		return;
 	if (ep->rep_connected > 0)
 		xprt->reestablish_timeout = 0;
-	xprt_disconnect_done(xprt);
 	rpcrdma_ep_disconnect(ep, ia);
 
 	/* Prepare @xprt for the next connection by reinitializing
@@ -463,6 +462,10 @@ xprt_rdma_close(struct rpc_xprt *xprt)
 	 */
 	r_xprt->rx_buf.rb_credits = 1;
 	xprt->cwnd = RPC_CWNDSHIFT;
+
+out:
+	++xprt->connect_cookie;
+	xprt_disconnect_done(xprt);
 }
 
 /**
@@ -713,7 +716,7 @@ xprt_rdma_send_request(struct rpc_rqst *rqst)
 #endif	/* CONFIG_SUNRPC_BACKCHANNEL */
 
 	if (!xprt_connected(xprt))
-		goto drop_connection;
+		return -ENOTCONN;
 
 	if (!xprt_request_get_cong(xprt, rqst))
 		return -EBADSLT;
@@ -745,8 +748,8 @@ failed_marshal:
 	if (rc != -ENOTCONN)
 		return rc;
 drop_connection:
-	xprt_disconnect_done(xprt);
-	return -ENOTCONN;	/* implies disconnect */
+	xprt_rdma_close(xprt);
+	return -ENOTCONN;
 }
 
 void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index b9bc7f9f6bb9..919fddec0197 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -316,7 +316,6 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
 			ep->rep_connected = -EAGAIN;
 		goto disconnected;
 	case RDMA_CM_EVENT_DISCONNECTED:
-		++xprt->connect_cookie;
 		ep->rep_connected = -ECONNABORTED;
 disconnected:
 		xprt_force_disconnect(xprt);
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index a13ccb643ce0..0af75b1405f8 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -653,6 +653,7 @@ static inline void rpcrdma_set_xdrlen(struct xdr_buf *xdr, size_t len)
 extern unsigned int xprt_rdma_max_inline_read;
 void xprt_rdma_format_addresses(struct rpc_xprt *xprt, struct sockaddr *sap);
 void xprt_rdma_free_addresses(struct rpc_xprt *xprt);
+void xprt_rdma_close(struct rpc_xprt *xprt);
 void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq);
 int xprt_rdma_init(void);
 void xprt_rdma_cleanup(void);
-- 
2.19.1




^ permalink raw reply related	[flat|nested] 380+ messages in thread

* [PATCH 4.20 291/352] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 290/352] xprtrdma: Dont wake pending tasks until disconnect is done Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 292/352] dccp: fool proof ccid_hc_[rt]x_parse_options() Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Eduardo Valentin

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eduardo Valentin <edubezval@gmail.com>

commit 03334ba8b425b2ad275c8f390cf83c7b081c3095 upstream.

Avoid warnings like this:
thermal_hwmon.h:29:1: warning: ‘thermal_remove_hwmon_sysfs’ defined but not used [-Wunused-function]
 thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)

Fixes: 0dd88793aacd ("thermal: hwmon: move hwmon support to single file")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/thermal/thermal_hwmon.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/thermal/thermal_hwmon.h
+++ b/drivers/thermal/thermal_hwmon.h
@@ -19,13 +19,13 @@
 int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz);
 void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz);
 #else
-static int
+static inline int
 thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 {
 	return 0;
 }
 
-static void
+static inline void
 thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
 {
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 292/352] dccp: fool proof ccid_hc_[rt]x_parse_options()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 291/352] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 293/352] enic: fix checksum validation for IPv6 Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Gerrit Renker,
	David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 9b1f19d810e92d6cdc68455fbc22d9f961a58ce1 ]

Similarly to commit 276bdb82dedb ("dccp: check ccid before dereferencing")
it is wise to test for a NULL ccid.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0-rc3+ #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline]
RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233
Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
kobject: 'loop5' (0000000080f78fc1): kobject_uevent_env
RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001
RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80
R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0defa33518 CR3: 000000008db5e000 CR4: 00000000001406e0
kobject: 'loop5' (0000000080f78fc1): fill_kobj_path: path = '/devices/virtual/block/loop5'
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 dccp_rcv_state_process+0x2b6/0x1af6 net/dccp/input.c:654
 dccp_v4_do_rcv+0x100/0x190 net/dccp/ipv4.c:688
 sk_backlog_rcv include/net/sock.h:936 [inline]
 __sk_receive_skb+0x3a9/0xea0 net/core/sock.c:473
 dccp_v4_rcv+0x10cb/0x1f80 net/dccp/ipv4.c:880
 ip_protocol_deliver_rcu+0xb6/0xa20 net/ipv4/ip_input.c:208
 ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip_local_deliver+0x1f0/0x740 net/ipv4/ip_input.c:255
 dst_input include/net/dst.h:450 [inline]
 ip_rcv_finish+0x1f4/0x2f0 net/ipv4/ip_input.c:414
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip_rcv+0xed/0x620 net/ipv4/ip_input.c:524
 __netif_receive_skb_one_core+0x160/0x210 net/core/dev.c:4973
 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
 process_backlog+0x206/0x750 net/core/dev.c:5923
 napi_poll net/core/dev.c:6346 [inline]
 net_rx_action+0x76d/0x1930 net/core/dev.c:6412
 __do_softirq+0x30b/0xb11 kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:654 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:646
 smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 58a0ba03bea2c376 ]---
RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline]
RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233
Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001
RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80
R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0defa33518 CR3: 0000000009871000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/ccid.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_rec
 static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
 					   u8 pkt, u8 opt, u8 *val, u8 len)
 {
-	if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
+	if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options)
 		return 0;
 	return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
 }
@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_optio
 static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
 					   u8 pkt, u8 opt, u8 *val, u8 len)
 {
-	if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
+	if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options)
 		return 0;
 	return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 293/352] enic: fix checksum validation for IPv6
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 292/352] dccp: fool proof ccid_hc_[rt]x_parse_options() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 294/352] lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Govindarajulu Varadarajan, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Govindarajulu Varadarajan <gvaradar@cisco.com>

[ Upstream commit 7596175e99b3d4bce28022193efd954c201a782a ]

In case of IPv6 pkts, ipv4_csum_ok is 0. Because of this, driver does
not set skb->ip_summed. So IPv6 rx checksum is not offloaded.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/cisco/enic/enic_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1434,7 +1434,8 @@ static void enic_rq_indicate_buf(struct
 		 * csum is correct or is zero.
 		 */
 		if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc &&
-		    tcp_udp_csum_ok && ipv4_csum_ok && outer_csum_ok) {
+		    tcp_udp_csum_ok && outer_csum_ok &&
+		    (ipv4_csum_ok || ipv6)) {
 			skb->ip_summed = CHECKSUM_UNNECESSARY;
 			skb->csum_level = encap;
 		}



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 294/352] lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 293/352] enic: fix checksum validation for IPv6 Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 295/352] net: dp83640: expire old TX-skb Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Graf, Herbert Xu, netdev,
	Bart Van Assche, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit fc42a689c4c097859e5bd37b5ea11b60dc426df6 ]

The test_insert_dup() function from lib/test_rhashtable.c passes a
pointer to a stack object to rhltable_init(). Allocate the hash table
dynamically to avoid that the following is reported with object
debugging enabled:

ODEBUG: object (ptrval) is on stack (ptrval), but NOT annotated.
WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:368 __debug_object_init+0x312/0x480
Modules linked in:
EIP: __debug_object_init+0x312/0x480
Call Trace:
 ? debug_object_init+0x1a/0x20
 ? __init_work+0x16/0x30
 ? rhashtable_init+0x1e1/0x460
 ? sched_clock_cpu+0x57/0xe0
 ? rhltable_init+0xb/0x20
 ? test_insert_dup+0x32/0x20f
 ? trace_hardirqs_on+0x38/0xf0
 ? ida_dump+0x10/0x10
 ? jhash+0x130/0x130
 ? my_hashfn+0x30/0x30
 ? test_rht_init+0x6aa/0xab4
 ? ida_dump+0x10/0x10
 ? test_rhltable+0xc5c/0xc5c
 ? do_one_initcall+0x67/0x28e
 ? trace_hardirqs_off+0x22/0xe0
 ? restore_all_kernel+0xf/0x70
 ? trace_hardirqs_on_thunk+0xc/0x10
 ? restore_all_kernel+0xf/0x70
 ? kernel_init_freeable+0x142/0x213
 ? rest_init+0x230/0x230
 ? kernel_init+0x10/0x110
 ? schedule_tail_wrapper+0x9/0xc
 ? ret_from_fork+0x19/0x24

Cc: Thomas Graf <tgraf@suug.ch>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/test_rhashtable.c |   23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -541,38 +541,45 @@ static unsigned int __init print_ht(stru
 static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
 				  int cnt, bool slow)
 {
-	struct rhltable rhlt;
+	struct rhltable *rhlt;
 	unsigned int i, ret;
 	const char *key;
 	int err = 0;
 
-	err = rhltable_init(&rhlt, &test_rht_params_dup);
-	if (WARN_ON(err))
+	rhlt = kmalloc(sizeof(*rhlt), GFP_KERNEL);
+	if (WARN_ON(!rhlt))
+		return -EINVAL;
+
+	err = rhltable_init(rhlt, &test_rht_params_dup);
+	if (WARN_ON(err)) {
+		kfree(rhlt);
 		return err;
+	}
 
 	for (i = 0; i < cnt; i++) {
 		rhl_test_objects[i].value.tid = i;
-		key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
+		key = rht_obj(&rhlt->ht, &rhl_test_objects[i].list_node.rhead);
 		key += test_rht_params_dup.key_offset;
 
 		if (slow) {
-			err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
+			err = PTR_ERR(rhashtable_insert_slow(&rhlt->ht, key,
 							     &rhl_test_objects[i].list_node.rhead));
 			if (err == -EAGAIN)
 				err = 0;
 		} else
-			err = rhltable_insert(&rhlt,
+			err = rhltable_insert(rhlt,
 					      &rhl_test_objects[i].list_node,
 					      test_rht_params_dup);
 		if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
 			goto skip_print;
 	}
 
-	ret = print_ht(&rhlt);
+	ret = print_ht(rhlt);
 	WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
 
 skip_print:
-	rhltable_destroy(&rhlt);
+	rhltable_destroy(rhlt);
+	kfree(rhlt);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 295/352] net: dp83640: expire old TX-skb
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 294/352] lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 296/352] net: dsa: Fix lockdep false positive splat Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Kurt Kanzenbach, Richard Cochran, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit 53bc8d2af08654659abfadfd3e98eb9922ff787c ]

During sendmsg() a cloned skb is saved via dp83640_txtstamp() in
->tx_queue. After the NIC sends this packet, the PHY will reply with a
timestamp for that TX packet. If the cable is pulled at the right time I
don't see that packet. It might gets flushed as part of queue shutdown
on NIC's side.
Once the link is up again then after the next sendmsg() we enqueue
another skb in dp83640_txtstamp() and have two on the list. Then the PHY
will send a reply and decode_txts() attaches it to the first skb on the
list.
No crash occurs since refcounting works but we are one packet behind.
linuxptp/ptp4l usually closes the socket and opens a new one (in such a
timeout case) so those "stale" replies never get there. However it does
not resume normal operation anymore.

Purge old skbs in decode_txts().

Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/dp83640.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -898,14 +898,14 @@ static void decode_txts(struct dp83640_p
 			struct phy_txts *phy_txts)
 {
 	struct skb_shared_hwtstamps shhwtstamps;
+	struct dp83640_skb_info *skb_info;
 	struct sk_buff *skb;
-	u64 ns;
 	u8 overflow;
+	u64 ns;
 
 	/* We must already have the skb that triggered this. */
-
+again:
 	skb = skb_dequeue(&dp83640->tx_queue);
-
 	if (!skb) {
 		pr_debug("have timestamp but tx_queue empty\n");
 		return;
@@ -920,6 +920,11 @@ static void decode_txts(struct dp83640_p
 		}
 		return;
 	}
+	skb_info = (struct dp83640_skb_info *)skb->cb;
+	if (time_after(jiffies, skb_info->tmo)) {
+		kfree_skb(skb);
+		goto again;
+	}
 
 	ns = phy2txts(phy_txts);
 	memset(&shhwtstamps, 0, sizeof(shhwtstamps));
@@ -1472,6 +1477,7 @@ static bool dp83640_rxtstamp(struct phy_
 static void dp83640_txtstamp(struct phy_device *phydev,
 			     struct sk_buff *skb, int type)
 {
+	struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb;
 	struct dp83640_private *dp83640 = phydev->priv;
 
 	switch (dp83640->hwts_tx_en) {
@@ -1484,6 +1490,7 @@ static void dp83640_txtstamp(struct phy_
 		/* fall through */
 	case HWTSTAMP_TX_ON:
 		skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+		skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
 		skb_queue_tail(&dp83640->tx_queue, skb);
 		break;
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 296/352] net: dsa: Fix lockdep false positive splat
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 295/352] net: dp83640: expire old TX-skb Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 297/352] net: dsa: Fix NULL checking in dsa_slave_set_eee() Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Florian Fainelli,
	David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

[ Upstream commit c8101f7729daee251f4f6505f9d135ec08e1342f ]

Creating a macvtap on a DSA-backed interface results in the following
splat when lockdep is enabled:

[   19.638080] IPv6: ADDRCONF(NETDEV_CHANGE): lan0: link becomes ready
[   23.041198] device lan0 entered promiscuous mode
[   23.043445] device eth0 entered promiscuous mode
[   23.049255]
[   23.049557] ============================================
[   23.055021] WARNING: possible recursive locking detected
[   23.060490] 5.0.0-rc3-00013-g56c857a1b8d3 #118 Not tainted
[   23.066132] --------------------------------------------
[   23.071598] ip/2861 is trying to acquire lock:
[   23.076171] 00000000f61990cb (_xmit_ETHER){+...}, at: dev_set_rx_mode+0x1c/0x38
[   23.083693]
[   23.083693] but task is already holding lock:
[   23.089696] 00000000ecf0c3b4 (_xmit_ETHER){+...}, at: dev_uc_add+0x24/0x70
[   23.096774]
[   23.096774] other info that might help us debug this:
[   23.103494]  Possible unsafe locking scenario:
[   23.103494]
[   23.109584]        CPU0
[   23.112093]        ----
[   23.114601]   lock(_xmit_ETHER);
[   23.117917]   lock(_xmit_ETHER);
[   23.121233]
[   23.121233]  *** DEADLOCK ***
[   23.121233]
[   23.127325]  May be due to missing lock nesting notation
[   23.127325]
[   23.134315] 2 locks held by ip/2861:
[   23.137987]  #0: 000000003b766c72 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x338/0x4e0
[   23.146231]  #1: 00000000ecf0c3b4 (_xmit_ETHER){+...}, at: dev_uc_add+0x24/0x70
[   23.153757]
[   23.153757] stack backtrace:
[   23.158243] CPU: 0 PID: 2861 Comm: ip Not tainted 5.0.0-rc3-00013-g56c857a1b8d3 #118
[   23.166212] Hardware name: Globalscale Marvell ESPRESSOBin Board (DT)
[   23.172843] Call trace:
[   23.175358]  dump_backtrace+0x0/0x188
[   23.179116]  show_stack+0x14/0x20
[   23.182524]  dump_stack+0xb4/0xec
[   23.185928]  __lock_acquire+0x123c/0x1860
[   23.190048]  lock_acquire+0xc8/0x248
[   23.193724]  _raw_spin_lock_bh+0x40/0x58
[   23.197755]  dev_set_rx_mode+0x1c/0x38
[   23.201607]  dev_set_promiscuity+0x3c/0x50
[   23.205820]  dsa_slave_change_rx_flags+0x5c/0x70
[   23.210567]  __dev_set_promiscuity+0x148/0x1e0
[   23.215136]  __dev_set_rx_mode+0x74/0x98
[   23.219167]  dev_uc_add+0x54/0x70
[   23.222575]  macvlan_open+0x170/0x1d0
[   23.226336]  __dev_open+0xe0/0x160
[   23.229830]  __dev_change_flags+0x16c/0x1b8
[   23.234132]  dev_change_flags+0x20/0x60
[   23.238074]  do_setlink+0x2d0/0xc50
[   23.241658]  __rtnl_newlink+0x5f8/0x6e8
[   23.245601]  rtnl_newlink+0x50/0x78
[   23.249184]  rtnetlink_rcv_msg+0x360/0x4e0
[   23.253397]  netlink_rcv_skb+0xe8/0x130
[   23.257338]  rtnetlink_rcv+0x14/0x20
[   23.261012]  netlink_unicast+0x190/0x210
[   23.265043]  netlink_sendmsg+0x288/0x350
[   23.269075]  sock_sendmsg+0x18/0x30
[   23.272659]  ___sys_sendmsg+0x29c/0x2c8
[   23.276602]  __sys_sendmsg+0x60/0xb8
[   23.280276]  __arm64_sys_sendmsg+0x1c/0x28
[   23.284488]  el0_svc_common+0xd8/0x138
[   23.288340]  el0_svc_handler+0x24/0x80
[   23.292192]  el0_svc+0x8/0xc

This looks fairly harmless (no actual deadlock occurs), and is
fixed in a similar way to c6894dec8ea9 ("bridge: fix lockdep
addr_list_lock false positive splat") by putting the addr_list_lock
in its own lockdep class.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dsa/master.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -179,6 +179,8 @@ static const struct attribute_group dsa_
 	.attrs	= dsa_slave_attrs,
 };
 
+static struct lock_class_key dsa_master_addr_list_lock_key;
+
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
 	int ret;
@@ -190,6 +192,8 @@ int dsa_master_setup(struct net_device *
 	wmb();
 
 	dev->dsa_ptr = cpu_dp;
+	lockdep_set_class(&dev->addr_list_lock,
+			  &dsa_master_addr_list_lock_key);
 
 	ret = dsa_master_ethtool_setup(dev);
 	if (ret)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 297/352] net: dsa: Fix NULL checking in dsa_slave_set_eee()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 296/352] net: dsa: Fix lockdep false positive splat Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 298/352] net: dsa: mv88e6xxx: Fix counting of ATU violations Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Florian Fainelli,
	Vivien Didelot, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 00670cb8a73b10b10d3c40f045c15411715e4465 ]

This function can't succeed if dp->pl is NULL.  It will Oops inside the
call to return phylink_ethtool_get_eee(dp->pl, e);

Fixes: 1be52e97ed3e ("dsa: slave: eee: Allow ports to use phylink")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dsa/slave.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -639,7 +639,7 @@ static int dsa_slave_set_eee(struct net_
 	int ret;
 
 	/* Port's PHY and MAC both need to be EEE capable */
-	if (!dev->phydev && !dp->pl)
+	if (!dev->phydev || !dp->pl)
 		return -ENODEV;
 
 	if (!ds->ops->set_mac_eee)
@@ -659,7 +659,7 @@ static int dsa_slave_get_eee(struct net_
 	int ret;
 
 	/* Port's PHY and MAC both need to be EEE capable */
-	if (!dev->phydev && !dp->pl)
+	if (!dev->phydev || !dp->pl)
 		return -ENODEV;
 
 	if (!ds->ops->get_mac_eee)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 298/352] net: dsa: mv88e6xxx: Fix counting of ATU violations
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 297/352] net: dsa: Fix NULL checking in dsa_slave_set_eee() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 299/352] net: dsa: slave: Dont propagate flag changes on down slave interfaces Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Healy, Andrew Lunn, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrew Lunn <andrew@lunn.ch>

[ Upstream commit 75c05a74e745ae7d663b04d75777af80ada2233c ]

The ATU port vector contains a bit per port of the switch. The code
wrongly used it as a port number, and incremented a port counter. This
resulted in the wrong interfaces counter being incremented, and
potentially going off the end of the array of ports.

Fix this by using the source port ID for the violation, which really
is a port number.

Reported-by: Chris Healy <Chris.Healy@zii.aero>
Tested-by: Chris Healy <Chris.Healy@zii.aero>
Fixes: 65f60e4582bd ("net: dsa: mv88e6xxx: Keep ATU/VTU violation statistics")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/mv88e6xxx/global1_atu.c |   21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -314,6 +314,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob
 {
 	struct mv88e6xxx_chip *chip = dev_id;
 	struct mv88e6xxx_atu_entry entry;
+	int spid;
 	int err;
 	u16 val;
 
@@ -336,6 +337,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob
 	if (err)
 		goto out;
 
+	spid = entry.state;
+
 	if (val & MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION) {
 		dev_err_ratelimited(chip->dev,
 				    "ATU age out violation for %pM\n",
@@ -344,23 +347,23 @@ static irqreturn_t mv88e6xxx_g1_atu_prob
 
 	if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
 		dev_err_ratelimited(chip->dev,
-				    "ATU member violation for %pM portvec %x\n",
-				    entry.mac, entry.portvec);
-		chip->ports[entry.portvec].atu_member_violation++;
+				    "ATU member violation for %pM portvec %x spid %d\n",
+				    entry.mac, entry.portvec, spid);
+		chip->ports[spid].atu_member_violation++;
 	}
 
 	if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
 		dev_err_ratelimited(chip->dev,
-				    "ATU miss violation for %pM portvec %x\n",
-				    entry.mac, entry.portvec);
-		chip->ports[entry.portvec].atu_miss_violation++;
+				    "ATU miss violation for %pM portvec %x spid %d\n",
+				    entry.mac, entry.portvec, spid);
+		chip->ports[spid].atu_miss_violation++;
 	}
 
 	if (val & MV88E6XXX_G1_ATU_OP_FULL_VIOLATION) {
 		dev_err_ratelimited(chip->dev,
-				    "ATU full violation for %pM portvec %x\n",
-				    entry.mac, entry.portvec);
-		chip->ports[entry.portvec].atu_full_violation++;
+				    "ATU full violation for %pM portvec %x spid %d\n",
+				    entry.mac, entry.portvec, spid);
+		chip->ports[spid].atu_full_violation++;
 	}
 	mutex_unlock(&chip->reg_lock);
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 299/352] net: dsa: slave: Dont propagate flag changes on down slave interfaces
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 298/352] net: dsa: mv88e6xxx: Fix counting of ATU violations Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 300/352] net: systemport: Fix WoL with password after deep sleep Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rundong Ge, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rundong Ge <rdong.ge@gmail.com>

[ Upstream commit 17ab4f61b8cd6f9c38e9d0b935d86d73b5d0d2b5 ]

The unbalance of master's promiscuity or allmulti will happen after ifdown
and ifup a slave interface which is in a bridge.

When we ifdown a slave interface , both the 'dsa_slave_close' and
'dsa_slave_change_rx_flags' will clear the master's flags. The flags
of master will be decrease twice.
In the other hand, if we ifup the slave interface again, since the
slave's flags were cleared the 'dsa_slave_open' won't set the master's
flag, only 'dsa_slave_change_rx_flags' that triggered by 'br_add_if'
will set the master's flags. The flags of master is increase once.

Only propagating flag changes when a slave interface is up makes
sure this does not happen. The 'vlan_dev_change_rx_flags' had the
same problem and was fixed, and changes here follows that fix.

Fixes: 91da11f870f0 ("net: Distributed Switch Architecture protocol support")
Signed-off-by: Rundong Ge <rdong.ge@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dsa/slave.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -140,11 +140,14 @@ static int dsa_slave_close(struct net_de
 static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 {
 	struct net_device *master = dsa_slave_to_master(dev);
-
-	if (change & IFF_ALLMULTI)
-		dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
-	if (change & IFF_PROMISC)
-		dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1);
+	if (dev->flags & IFF_UP) {
+		if (change & IFF_ALLMULTI)
+			dev_set_allmulti(master,
+					 dev->flags & IFF_ALLMULTI ? 1 : -1);
+		if (change & IFF_PROMISC)
+			dev_set_promiscuity(master,
+					    dev->flags & IFF_PROMISC ? 1 : -1);
+	}
 }
 
 static void dsa_slave_set_rx_mode(struct net_device *dev)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 300/352] net: systemport: Fix WoL with password after deep sleep
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 299/352] net: dsa: slave: Dont propagate flag changes on down slave interfaces Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 301/352] rds: fix refcount bug in rds_sock_addref Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit 8dfb8d2cceb76b74ad5b58cc65c75994329b4d5e ]

Broadcom STB chips support a deep sleep mode where all register
contents are lost. Because we were stashing the MagicPacket password
into some of these registers a suspend into that deep sleep then a
resumption would not lead to being able to wake-up from MagicPacket with
password again.

Fix this by keeping a software copy of the password and program it
during suspend.

Fixes: 83e82f4c706b ("net: systemport: add Wake-on-LAN support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bcmsysport.c |   25 ++++++++++---------------
 drivers/net/ethernet/broadcom/bcmsysport.h |    2 ++
 2 files changed, 12 insertions(+), 15 deletions(-)

--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -520,7 +520,6 @@ static void bcm_sysport_get_wol(struct n
 				struct ethtool_wolinfo *wol)
 {
 	struct bcm_sysport_priv *priv = netdev_priv(dev);
-	u32 reg;
 
 	wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
 	wol->wolopts = priv->wolopts;
@@ -528,11 +527,7 @@ static void bcm_sysport_get_wol(struct n
 	if (!(priv->wolopts & WAKE_MAGICSECURE))
 		return;
 
-	/* Return the programmed SecureOn password */
-	reg = umac_readl(priv, UMAC_PSW_MS);
-	put_unaligned_be16(reg, &wol->sopass[0]);
-	reg = umac_readl(priv, UMAC_PSW_LS);
-	put_unaligned_be32(reg, &wol->sopass[2]);
+	memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
 }
 
 static int bcm_sysport_set_wol(struct net_device *dev,
@@ -548,13 +543,8 @@ static int bcm_sysport_set_wol(struct ne
 	if (wol->wolopts & ~supported)
 		return -EINVAL;
 
-	/* Program the SecureOn password */
-	if (wol->wolopts & WAKE_MAGICSECURE) {
-		umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
-			    UMAC_PSW_MS);
-		umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
-			    UMAC_PSW_LS);
-	}
+	if (wol->wolopts & WAKE_MAGICSECURE)
+		memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
 
 	/* Flag the device and relevant IRQ as wakeup capable */
 	if (wol->wolopts) {
@@ -2592,13 +2582,18 @@ static int bcm_sysport_suspend_to_wol(st
 	unsigned int index, i = 0;
 	u32 reg;
 
-	/* Password has already been programmed */
 	reg = umac_readl(priv, UMAC_MPD_CTRL);
 	if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE))
 		reg |= MPD_EN;
 	reg &= ~PSW_EN;
-	if (priv->wolopts & WAKE_MAGICSECURE)
+	if (priv->wolopts & WAKE_MAGICSECURE) {
+		/* Program the SecureOn password */
+		umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
+			    UMAC_PSW_MS);
+		umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
+			    UMAC_PSW_LS);
 		reg |= PSW_EN;
+	}
 	umac_writel(priv, reg, UMAC_MPD_CTRL);
 
 	if (priv->wolopts & WAKE_FILTER) {
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -12,6 +12,7 @@
 #define __BCM_SYSPORT_H
 
 #include <linux/bitmap.h>
+#include <linux/ethtool.h>
 #include <linux/if_vlan.h>
 #include <linux/net_dim.h>
 
@@ -778,6 +779,7 @@ struct bcm_sysport_priv {
 	unsigned int		crc_fwd:1;
 	u16			rev;
 	u32			wolopts;
+	u8			sopass[SOPASS_MAX];
 	unsigned int		wol_irq_disabled:1;
 
 	/* MIB related fields */



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 301/352] rds: fix refcount bug in rds_sock_addref
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 300/352] net: systemport: Fix WoL with password after deep sleep Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 302/352] Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot,
	Sowmini Varadhan, Santosh Shilimkar, rds-devel, Cong Wang,
	David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 6fa19f5637a6c22bc0999596bcc83bdcac8a4fa6 ]

syzbot was able to catch a bug in rds [1]

The issue here is that the socket might be found in a hash table
but that its refcount has already be set to 0 by another cpu.

We need to use refcount_inc_not_zero() to be safe here.

[1]

refcount_t: increment on 0; use-after-free.
WARNING: CPU: 1 PID: 23129 at lib/refcount.c:153 refcount_inc_checked lib/refcount.c:153 [inline]
WARNING: CPU: 1 PID: 23129 at lib/refcount.c:153 refcount_inc_checked+0x61/0x70 lib/refcount.c:151
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 23129 Comm: syz-executor3 Not tainted 5.0.0-rc4+ #53
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 panic+0x2cb/0x65c kernel/panic.c:214
 __warn.cold+0x20/0x48 kernel/panic.c:571
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:refcount_inc_checked lib/refcount.c:153 [inline]
RIP: 0010:refcount_inc_checked+0x61/0x70 lib/refcount.c:151
Code: 1d 51 63 c8 06 31 ff 89 de e8 eb 1b f2 fd 84 db 75 dd e8 a2 1a f2 fd 48 c7 c7 60 9f 81 88 c6 05 31 63 c8 06 01 e8 af 65 bb fd <0f> 0b eb c1 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 49
RSP: 0018:ffff8880a0cbf1e8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90006113000
RDX: 000000000001047d RSI: ffffffff81685776 RDI: 0000000000000005
RBP: ffff8880a0cbf1f8 R08: ffff888097c9e100 R09: ffffed1015ce5021
R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880723c20c0
R13: ffff8880723c24b0 R14: dffffc0000000000 R15: ffffed1014197e64
 sock_hold include/net/sock.h:647 [inline]
 rds_sock_addref+0x19/0x20 net/rds/af_rds.c:675
 rds_find_bound+0x97c/0x1080 net/rds/bind.c:82
 rds_recv_incoming+0x3be/0x1430 net/rds/recv.c:362
 rds_loop_xmit+0xf3/0x2a0 net/rds/loop.c:96
 rds_send_xmit+0x1355/0x2a10 net/rds/send.c:355
 rds_sendmsg+0x323c/0x44e0 net/rds/send.c:1368
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:631
 __sys_sendto+0x387/0x5f0 net/socket.c:1788
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458089
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc266df8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458089
RDX: 0000000000000000 RSI: 00000000204b3fff RDI: 0000000000000005
RBP: 000000000073bf00 R08: 00000000202b4000 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc266df96d4
R13: 00000000004c56e4 R14: 00000000004d94a8 R15: 00000000ffffffff

Fixes: cc4dfb7f70a3 ("rds: fix two RCU related problems")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Cc: rds-devel@oss.oracle.com
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rds/bind.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -78,10 +78,10 @@ struct rds_sock *rds_find_bound(const st
 	__rds_create_bind_key(key, addr, port, scope_id);
 	rcu_read_lock();
 	rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
-	if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
-		rds_sock_addref(rs);
-	else
+	if (rs && (sock_flag(rds_rs_to_sk(rs), SOCK_DEAD) ||
+		   !refcount_inc_not_zero(&rds_rs_to_sk(rs)->sk_refcnt)))
 		rs = NULL;
+
 	rcu_read_unlock();
 
 	rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 302/352] Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x"
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 301/352] rds: fix refcount bug in rds_sock_addref Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 303/352] rxrpc: bad unlock balance in rxrpc_recvmsg Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Yonglong Liu, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit c14f07c6211cc01d52ed92cce1fade5071b8d197 ]

This reverts commit 6623c0fba10ef45b64ca213ad5dec926f37fa9a0.

The original diagnosis was incorrect: it appears that the NIC had
PHY polling mode enabled, which meant that it overwrote the PHYs
advertisement register during negotiation.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Tested-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/marvell.c |   12 ------------
 1 file changed, 12 deletions(-)

--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -847,8 +847,6 @@ static int m88e1510_config_init(struct p
 
 	/* SGMII-to-Copper mode initialization */
 	if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
-		u32 pause;
-
 		/* Select page 18 */
 		err = marvell_set_page(phydev, 18);
 		if (err < 0)
@@ -871,16 +869,6 @@ static int m88e1510_config_init(struct p
 		err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
 		if (err < 0)
 			return err;
-
-		/* There appears to be a bug in the 88e1512 when used in
-		 * SGMII to copper mode, where the AN advertisement register
-		 * clears the pause bits each time a negotiation occurs.
-		 * This means we can never be truely sure what was advertised,
-		 * so disable Pause support.
-		 */
-		pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
-		phydev->supported &= ~pause;
-		phydev->advertising &= ~pause;
 	}
 
 	return m88e1318_config_init(phydev);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 303/352] rxrpc: bad unlock balance in rxrpc_recvmsg
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 302/352] Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 304/352] sctp: check and update stream->out_curr when allocating stream_out Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David Howells, syzbot,
	David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 6dce3c20ac429e7a651d728e375853370c796e8d ]

When either "goto wait_interrupted;" or "goto wait_error;"
paths are taken, socket lock has already been released.

This patch fixes following syzbot splat :

WARNING: bad unlock balance detected!
5.0.0-rc4+ #59 Not tainted
-------------------------------------
syz-executor223/8256 is trying to release lock (sk_lock-AF_RXRPC) at:
[<ffffffff86651353>] rxrpc_recvmsg+0x6d3/0x3099 net/rxrpc/recvmsg.c:598
but there are no more locks to release!

other info that might help us debug this:
1 lock held by syz-executor223/8256:
 #0: 00000000fa9ed0f4 (slock-AF_RXRPC){+...}, at: spin_lock_bh include/linux/spinlock.h:334 [inline]
 #0: 00000000fa9ed0f4 (slock-AF_RXRPC){+...}, at: release_sock+0x20/0x1c0 net/core/sock.c:2798

stack backtrace:
CPU: 1 PID: 8256 Comm: syz-executor223 Not tainted 5.0.0-rc4+ #59
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_unlock_imbalance_bug kernel/locking/lockdep.c:3391 [inline]
 print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3368
 __lock_release kernel/locking/lockdep.c:3601 [inline]
 lock_release+0x67e/0xa00 kernel/locking/lockdep.c:3860
 sock_release_ownership include/net/sock.h:1471 [inline]
 release_sock+0x183/0x1c0 net/core/sock.c:2808
 rxrpc_recvmsg+0x6d3/0x3099 net/rxrpc/recvmsg.c:598
 sock_recvmsg_nosec net/socket.c:794 [inline]
 sock_recvmsg net/socket.c:801 [inline]
 sock_recvmsg+0xd0/0x110 net/socket.c:797
 __sys_recvfrom+0x1ff/0x350 net/socket.c:1845
 __do_sys_recvfrom net/socket.c:1863 [inline]
 __se_sys_recvfrom net/socket.c:1859 [inline]
 __x64_sys_recvfrom+0xe1/0x1a0 net/socket.c:1859
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446379
Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe5da89fd98 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 00000000006dbc28 RCX: 0000000000446379
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000006dbc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc2c
R13: 0000000000000000 R14: 0000000000000000 R15: 20c49ba5e353f7cf

Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Howells <dhowells@redhat.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/recvmsg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -596,6 +596,7 @@ error_requeue_call:
 	}
 error_no_call:
 	release_sock(&rx->sk);
+error_trace:
 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
 	return ret;
 
@@ -604,7 +605,7 @@ wait_interrupted:
 wait_error:
 	finish_wait(sk_sleep(&rx->sk), &wait);
 	call = NULL;
-	goto error_no_call;
+	goto error_trace;
 }
 
 /**



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 304/352] sctp: check and update stream->out_curr when allocating stream_out
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 303/352] rxrpc: bad unlock balance in rxrpc_recvmsg Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 305/352] sctp: walk the list of asoc safely Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ying Xu, syzbot+e33a3a138267ca119c7d,
	Xin Long, Neil Horman, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xin Long <lucien.xin@gmail.com>

[ Upstream commit cfe4bd7a257f6d6f81d3458d8c9d9ec4957539e6 ]

Now when using stream reconfig to add out streams, stream->out
will get re-allocated, and all old streams' information will
be copied to the new ones and the old ones will be freed.

So without stream->out_curr updated, next time when trying to
send from stream->out_curr stream, a panic would be caused.

This patch is to check and update stream->out_curr when
allocating stream_out.

v1->v2:
  - define fa_index() to get elem index from stream->out_curr.
v2->v3:
  - repost with no change.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Reported-by: Ying Xu <yinxu@redhat.com>
Reported-by: syzbot+e33a3a138267ca119c7d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/stream.c |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *f
 	}
 }
 
+static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+{
+	size_t index = 0;
+
+	while (count--) {
+		if (elem == flex_array_get(fa, index))
+			break;
+		index++;
+	}
+
+	return index;
+}
+
 /* Migrates chunks from stream queues to new stream queues if needed,
  * but not across associations. Also, removes those chunks to streams
  * higher than the new max.
@@ -147,6 +160,13 @@ static int sctp_stream_alloc_out(struct
 
 	if (stream->out) {
 		fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
+		if (stream->out_curr) {
+			size_t index = fa_index(stream->out, stream->out_curr,
+						stream->outcnt);
+
+			BUG_ON(index == stream->outcnt);
+			stream->out_curr = flex_array_get(out, index);
+		}
 		fa_free(stream->out);
 	}
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 305/352] sctp: walk the list of asoc safely
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 304/352] sctp: check and update stream->out_curr when allocating stream_out Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 306/352] skge: potential memory corruption in skge_get_regs() Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Secunia Research,
	Marcelo Ricardo Leitner, Neil Horman, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit ba59fb0273076637f0add4311faa990a5eec27c0 ]

In sctp_sendmesg(), when walking the list of endpoint associations, the
association can be dropped from the list, making the list corrupt.
Properly handle this by using list_for_each_entry_safe()

Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg")
Reported-by: Secunia Research <vuln@secunia.com>
Tested-by: Secunia Research <vuln@secunia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2027,7 +2027,7 @@ static int sctp_sendmsg(struct sock *sk,
 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
 	struct sctp_transport *transport = NULL;
 	struct sctp_sndrcvinfo _sinfo, *sinfo;
-	struct sctp_association *asoc;
+	struct sctp_association *asoc, *tmp;
 	struct sctp_cmsgs cmsgs;
 	union sctp_addr *daddr;
 	bool new = false;
@@ -2053,7 +2053,7 @@ static int sctp_sendmsg(struct sock *sk,
 
 	/* SCTP_SENDALL process */
 	if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) {
-		list_for_each_entry(asoc, &ep->asocs, asocs) {
+		list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) {
 			err = sctp_sendmsg_check_sflags(asoc, sflags, msg,
 							msg_len);
 			if (err == 0)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 306/352] skge: potential memory corruption in skge_get_regs()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 305/352] sctp: walk the list of asoc safely Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 307/352] virtio_net: Account for tx bytes and packets on sending xdp_frames Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 294c149a209c6196c2de85f512b52ef50f519949 ]

The "p" buffer is 0x4000 bytes long.  B3_RI_WTO_R1 is 0x190.  The value
of "regs->len" is in the 1-0x4000 range.  The bug here is that
"regs->len - B3_RI_WTO_R1" can be a negative value which would lead to
memory corruption and an abrupt crash.

Fixes: c3f8be961808 ("[PATCH] skge: expand ethtool debug register dump")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/marvell/skge.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_dev
 	memset(p, 0, regs->len);
 	memcpy_fromio(p, io, B3_RAM_ADDR);
 
-	memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
-		      regs->len - B3_RI_WTO_R1);
+	if (regs->len > B3_RI_WTO_R1) {
+		memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+			      regs->len - B3_RI_WTO_R1);
+	}
 }
 
 /* Wake on Lan only supported on Yukon chips with rev 1 or above */



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 307/352] virtio_net: Account for tx bytes and packets on sending xdp_frames
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 306/352] skge: potential memory corruption in skge_get_regs() Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 308/352] bnxt_en: Disable interrupts when allocating CP rings or NQs Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Ahern, Toshiaki Makita,
	Michael S. Tsirkin, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>

[ Upstream commit 546f28974d771b124fb0bf7b551b343888cf0419 ]

Previously virtnet_xdp_xmit() did not account for device tx counters,
which caused confusions.
To be consistent with SKBs, account them on freeing xdp_frames.

Reported-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/virtio_net.c |   20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -502,6 +502,8 @@ static int virtnet_xdp_xmit(struct net_d
 	struct bpf_prog *xdp_prog;
 	struct send_queue *sq;
 	unsigned int len;
+	int packets = 0;
+	int bytes = 0;
 	int drops = 0;
 	int kicks = 0;
 	int ret, err;
@@ -525,10 +527,18 @@ static int virtnet_xdp_xmit(struct net_d
 
 	/* Free up any pending old buffers before queueing new ones. */
 	while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
-		if (likely(is_xdp_frame(ptr)))
-			xdp_return_frame(ptr_to_xdp(ptr));
-		else
-			napi_consume_skb(ptr, false);
+		if (likely(is_xdp_frame(ptr))) {
+			struct xdp_frame *frame = ptr_to_xdp(ptr);
+
+			bytes += frame->len;
+			xdp_return_frame(frame);
+		} else {
+			struct sk_buff *skb = ptr;
+
+			bytes += skb->len;
+			napi_consume_skb(skb, false);
+		}
+		packets++;
 	}
 
 	for (i = 0; i < n; i++) {
@@ -548,6 +558,8 @@ static int virtnet_xdp_xmit(struct net_d
 	}
 out:
 	u64_stats_update_begin(&sq->stats.syncp);
+	sq->stats.bytes += bytes;
+	sq->stats.packets += packets;
 	sq->stats.xdp_tx += n;
 	sq->stats.xdp_tx_drops += drops;
 	sq->stats.kicks += kicks;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 308/352] bnxt_en: Disable interrupts when allocating CP rings or NQs.
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 307/352] virtio_net: Account for tx bytes and packets on sending xdp_frames Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 309/352] net: cls_flower: Remove filter from mask before freeing it Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Chan <michael.chan@broadcom.com>

[ Upstream commit 5e66e35aab335b83d9ffb220d8a3a13986a7a60e ]

When calling firmware to allocate a CP ring or NQ, an interrupt associated
with that ring may be generated immediately before the doorbell is even
setup after the firmware call returns.  When servicing the interrupt, the
driver may crash when trying to access the doorbell.

Fix it by disabling interrupt on that vector until the doorbell is
set up.

Fixes: 697197e5a173 ("bnxt_en: Re-structure doorbells.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4903,12 +4903,18 @@ static int bnxt_hwrm_ring_alloc(struct b
 		struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
 		struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
 		u32 map_idx = ring->map_idx;
+		unsigned int vector;
 
+		vector = bp->irq_tbl[map_idx].vector;
+		disable_irq_nosync(vector);
 		rc = hwrm_ring_alloc_send_msg(bp, ring, type, map_idx);
-		if (rc)
+		if (rc) {
+			enable_irq(vector);
 			goto err_out;
+		}
 		bnxt_set_db(bp, &cpr->cp_db, type, map_idx, ring->fw_ring_id);
 		bnxt_db_nq(bp, &cpr->cp_db, cpr->cp_raw_cons);
+		enable_irq(vector);
 		bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
 
 		if (!i) {



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 309/352] net: cls_flower: Remove filter from mask before freeing it
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 308/352] bnxt_en: Disable interrupts when allocating CP rings or NQs Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 310/352] net: dsa: b53: Fix for failure when irq is not defined in dt Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Jiri Pirko,
	Ido Schimmel, David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit c1f7e02979edd7a3a3e69fe04be60b1d650dc8a7 ]

In fl_change(), when adding a new rule (i.e. fold == NULL), a driver may
reject the new rule, for example due to resource exhaustion. By that
point, the new rule was already assigned a mask, and it was added to
that mask's hash table. The clean-up path that's invoked as a result of
the rejection however neglects to undo the hash table addition, and
proceeds to free the new rule, thus leaving a dangling pointer in the
hash table.

Fix by removing fnew from the mask's hash table before it is freed.

Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules also under skip_sw")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Reviewed-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_flower.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1257,7 +1257,7 @@ static int fl_change(struct net *net, st
 	if (!tc_skip_hw(fnew->flags)) {
 		err = fl_hw_replace_filter(tp, fnew, extack);
 		if (err)
-			goto errout_mask;
+			goto errout_mask_ht;
 	}
 
 	if (!tc_in_hw(fnew->flags))
@@ -1287,6 +1287,10 @@ static int fl_change(struct net *net, st
 	kfree(mask);
 	return 0;
 
+errout_mask_ht:
+	rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
+			       fnew->mask->filter_ht_params);
+
 errout_mask:
 	fl_mask_put(head, fnew->mask, false);
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 310/352] net: dsa: b53: Fix for failure when irq is not defined in dt
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 309/352] net: cls_flower: Remove filter from mask before freeing it Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 311/352] net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arun Parameswaran, Florian Fainelli,
	David S. Miller

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arun Parameswaran <arun.parameswaran@broadcom.com>

[ Upstream commit 39841cc1cbb69344539c98a1fa9d858ed124c7ba ]

Fixes the issues with non BCM58XX chips in the b53 driver
failing, when the irq is not specified in the device tree.

Removed the check for BCM58XX in b53_srab_prepare_irq(),
so the 'port->irq' will be set to '-EXIO' if the irq is not
specified in the device tree.

Fixes: 16994374a6fc ("net: dsa: b53: Make SRAB driver manage port interrupts")
Fixes: b2ddc48a81b5 ("net: dsa: b53: Do not fail when IRQ are not initialized")
Signed-off-by: Arun Parameswaran <arun.parameswaran@broadcom.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/b53/b53_srab.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/net/dsa/b53/b53_srab.c
+++ b/drivers/net/dsa/b53/b53_srab.c
@@ -511,9 +511,6 @@ static void b53_srab_prepare_irq(struct
 	/* Clear all pending interrupts */
 	writel(0xffffffff, priv->regs + B53_SRAB_INTR);
 
-	if (dev->pdata && dev->pdata->chip_id != BCM58XX_DEVICE_ID)
-		return;
-
 	for (i = 0; i < B53_N_PORTS; i++) {
 		port = &priv->port_intrs[i];
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 311/352] net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 310/352] net: dsa: b53: Fix for failure when irq is not defined in dt Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:18 ` [PATCH 4.20 312/352] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guy Shattah, Or Gerlitz, Saeed Mahameed

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guy Shattah <sguy@mellanox.com>

[ Upstream commit 1651925d403e077e3fc86f961905e27c6810e132 ]

In packets that need to be decaped the internal headers
have to be checked, not the external ones.

Fixes: bdd66ac0aeed ("net/mlx5e: Disallow TC offloading of unsupported match/action combinations")
Signed-off-by: Guy Shattah <sguy@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2133,6 +2133,7 @@ static bool csum_offload_supported(struc
 
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
 					  struct tcf_exts *exts,
+					  u32 match_actions,
 					  struct netlink_ext_ack *extack)
 {
 	const struct tc_action *a;
@@ -2143,7 +2144,11 @@ static bool modify_header_match_supporte
 	u16 ethertype;
 	int nkeys, i;
 
-	headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+	if (match_actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
+		headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, inner_headers);
+	else
+		headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+
 	ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
 
 	/* for non-IP we only re-write MACs, so we're okay */
@@ -2200,7 +2205,7 @@ static bool actions_match_supported(stru
 
 	if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
 		return modify_header_match_supported(&parse_attr->spec, exts,
-						     extack);
+						     actions, extack);
 
 	return true;
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 312/352] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 311/352] net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows Greg Kroah-Hartman
@ 2019-02-11 14:18 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 313/352] xfs: eof trim writeback mapping as soon as it is cached Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Tariq Toukan,
	Nikola Ciprich, Cong Wang, Saeed Mahameed

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit e8c8b53ccaff568fef4c13a6ccaf08bf241aa01a ]

When an ethernet frame is padded to meet the minimum ethernet frame
size, the padding octets are not covered by the hardware checksum.
Fortunately the padding octets are usually zero's, which don't affect
checksum. However, we have a switch which pads non-zero octets, this
causes kernel hardware checksum fault repeatedly.

Prior to:
commit '88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE ...")'
skb checksum was forced to be CHECKSUM_NONE when padding is detected.
After it, we need to keep skb->csum updated, like what we do for RXFCS.
However, fixing up CHECKSUM_COMPLETE requires to verify and parse IP
headers, it is not worthy the effort as the packets are so small that
CHECKSUM_COMPLETE can't save anything.

Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends"),
Cc: Eric Dumazet <edumazet@google.com>
Cc: Tariq Toukan <tariqt@mellanox.com>
Cc: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -732,6 +732,8 @@ static u8 get_ip_proto(struct sk_buff *s
 					    ((struct ipv6hdr *)ip_p)->nexthdr;
 }
 
+#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
+
 static inline void mlx5e_handle_csum(struct net_device *netdev,
 				     struct mlx5_cqe64 *cqe,
 				     struct mlx5e_rq *rq,
@@ -754,6 +756,17 @@ static inline void mlx5e_handle_csum(str
 	if (unlikely(test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)))
 		goto csum_unnecessary;
 
+	/* CQE csum doesn't cover padding octets in short ethernet
+	 * frames. And the pad field is appended prior to calculating
+	 * and appending the FCS field.
+	 *
+	 * Detecting these padded frames requires to verify and parse
+	 * IP headers, so we simply force all those small frames to be
+	 * CHECKSUM_UNNECESSARY even if they are not padded.
+	 */
+	if (short_frame(skb->len))
+		goto csum_unnecessary;
+
 	if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
 		if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
 			goto csum_unnecessary;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 313/352] xfs: eof trim writeback mapping as soon as it is cached
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2019-02-11 14:18 ` [PATCH 4.20 312/352] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 314/352] ALSA: compress: Fix stop handling on compressed capture streams Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Foster, Allison Henderson,
	Christoph Hellwig, Darrick J. Wong

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Foster <bfoster@redhat.com>

commit aa6ee4ab69293969867ab09b57546d226ace3d7a upstream.

The cached writeback mapping is EOF trimmed to try and avoid races
between post-eof block management and writeback that result in
sending cached data to a stale location. The cached mapping is
currently trimmed on the validation check, which leaves a race
window between the time the mapping is cached and when it is trimmed
against the current inode size.

For example, if a new mapping is cached by delalloc conversion on a
blocksize == page size fs, we could cycle various locks, perform
memory allocations, etc.  in the writeback codepath before the
associated mapping is eventually trimmed to i_size. This leaves
enough time for a post-eof truncate and file append before the
cached mapping is trimmed. The former event essentially invalidates
a range of the cached mapping and the latter bumps the inode size
such the trim on the next writepage event won't trim all of the
invalid blocks. fstest generic/464 reproduces this scenario
occasionally and causes a lost writeback and stale delalloc blocks
warning on inode inactivation.

To work around this problem, trim the cached writeback mapping as
soon as it is cached in addition to on subsequent validation checks.
This is a minor tweak to tighten the race window as much as possible
until a proper invalidation mechanism is available.

Fixes: 40214d128e07 ("xfs: trim writepage mapping to within eof")
Cc: <stable@vger.kernel.org> # v4.14+
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_aops.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -449,6 +449,7 @@ xfs_map_blocks(
 	}
 
 	wpc->imap = imap;
+	xfs_trim_extent_eof(&wpc->imap, ip);
 	trace_xfs_map_blocks_found(ip, offset, count, wpc->io_type, &imap);
 	return 0;
 allocate_blocks:
@@ -459,6 +460,7 @@ allocate_blocks:
 	ASSERT(whichfork == XFS_COW_FORK || cow_fsb == NULLFILEOFF ||
 	       imap.br_startoff + imap.br_blockcount <= cow_fsb);
 	wpc->imap = imap;
+	xfs_trim_extent_eof(&wpc->imap, ip);
 	trace_xfs_map_blocks_alloc(ip, offset, count, wpc->io_type, &imap);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 314/352] ALSA: compress: Fix stop handling on compressed capture streams
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 313/352] xfs: eof trim writeback mapping as soon as it is cached Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 315/352] ALSA: usb-audio: Add support for new T+A USB DAC Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Charles Keepax <ckeepax@opensource.cirrus.com>

commit 4f2ab5e1d13d6aa77c55f4914659784efd776eb4 upstream.

It is normal user behaviour to start, stop, then start a stream
again without closing it. Currently this works for compressed
playback streams but not capture ones.

The states on a compressed capture stream go directly from OPEN to
PREPARED, unlike a playback stream which moves to SETUP and waits
for a write of data before moving to PREPARED. Currently however,
when a stop is sent the state is set to SETUP for both types of
streams. This leaves a capture stream in the situation where a new
start can't be sent as that requires the state to be PREPARED and
a new set_params can't be sent as that requires the state to be
OPEN. The only option being to close the stream, and then reopen.

Correct this issues by allowing snd_compr_drain_notify to set the
state depending on the stream direction, as we already do in
set_params.

Fixes: 49bb6402f1aa ("ALSA: compress_core: Add support for capture streams")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/sound/compress_driver.h |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -171,7 +171,11 @@ static inline void snd_compr_drain_notif
 	if (snd_BUG_ON(!stream))
 		return;
 
-	stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+	if (stream->direction == SND_COMPRESS_PLAYBACK)
+		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+	else
+		stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+
 	wake_up(&stream->runtime->sleep);
 }
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 315/352] ALSA: usb-audio: Add support for new T+A USB DAC
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (313 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 314/352] ALSA: compress: Fix stop handling on compressed capture streams Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 316/352] ALSA: hda - Serialize codec registrations Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Udo Eberhardt, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Udo Eberhardt <udo.eberhardt@thesycon.de>

commit 3bff2407fbd28fd55ad5b5cccd98fc0c9598f23b upstream.

This patch adds the T+A VID to the generic check in order to enable
native DSD support for T+A devices. This works with the new T+A USB
DAC model SD3100HV and will also work with future devices which
support the XMOS/Thesycon style DSD format.

Signed-off-by: Udo Eberhardt <udo.eberhardt@thesycon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/quirks.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1448,6 +1448,7 @@ u64 snd_usb_interface_dsd_format_quirks(
 	case 0x20b1:  /* XMOS based devices */
 	case 0x152a:  /* Thesycon devices */
 	case 0x25ce:  /* Mytek devices */
+	case 0x2ab6:  /* T+A devices */
 		if (fp->dsd_raw)
 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
 		break;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 316/352] ALSA: hda - Serialize codec registrations
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (314 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 315/352] ALSA: usb-audio: Add support for new T+A USB DAC Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 317/352] ALSA: hda/realtek - Fix lose hp_pins for disable auto mute Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 305a0ade180981686eec1f92aa6252a7c6ebb1cf upstream.

In the current code, the codec registration may happen both at the
codec bind time and the end of the controller probe time.  In a rare
occasion, they race with each other, leading to Oops due to the still
uninitialized card device.

This patch introduces a simple flag to prevent the codec registration
at the codec bind time as long as the controller probe is going on.
The controller probe invokes snd_card_register() that does the whole
registration task, and we don't need to register each piece
beforehand.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/sound/hda_codec.h |    1 +
 sound/pci/hda/hda_bind.c  |    3 ++-
 sound/pci/hda/hda_intel.c |    2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -68,6 +68,7 @@ struct hda_bus {
 	unsigned int response_reset:1;	/* controller was reset */
 	unsigned int in_reset:1;	/* during reset operation */
 	unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
+	unsigned int bus_probing :1;	/* during probing process */
 
 	int primary_dig_out_type;	/* primary digital out PCM type */
 	unsigned int mixer_assigned;	/* codec addr for mixer name */
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -115,7 +115,8 @@ static int hda_codec_driver_probe(struct
 	err = snd_hda_codec_build_controls(codec);
 	if (err < 0)
 		goto error_module;
-	if (codec->card->registered) {
+	/* only register after the bus probe finished; otherwise it's racy */
+	if (!codec->bus->bus_probing && codec->card->registered) {
 		err = snd_card_register(codec->card);
 		if (err < 0)
 			goto error_module;
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2228,6 +2228,7 @@ static int azx_probe_continue(struct azx
 	int dev = chip->dev_index;
 	int err;
 
+	to_hda_bus(bus)->bus_probing = 1;
 	hda->probe_continued = 1;
 
 	/* bind with i915 if needed */
@@ -2323,6 +2324,7 @@ i915_power_fail:
 	if (err < 0)
 		hda->init_failed = 1;
 	complete_all(&hda->probe_wait);
+	to_hda_bus(bus)->bus_probing = 0;
 	return err;
 }
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 317/352] ALSA: hda/realtek - Fix lose hp_pins for disable auto mute
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (315 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 316/352] ALSA: hda - Serialize codec registrations Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 318/352] ALSA: hda/realtek - Use a common helper for hp pin reference Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kailang Yang <kailang@realtek.com>

commit d561aa0a70bb2e1dd85fde98b6a5561e4175ac3e upstream.

When auto_mute = no or spec->suppress_auto_mute = 1, cfg->hp_pins will
lose value.

Add this patch to find hp_pins value.
I add fixed for ALC282 ALC225 ALC256 ALC294 and alc_default_init()
alc_default_shutup().

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   45 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2963,6 +2963,11 @@ static void alc282_init(struct hda_codec
 	bool hp_pin_sense;
 	int coef78;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	alc282_restore_default_value(codec);
 
 	if (!hp_pin)
@@ -3000,6 +3005,11 @@ static void alc282_shutup(struct hda_cod
 	bool hp_pin_sense;
 	int coef78;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3159,6 +3169,11 @@ static void alc256_init(struct hda_codec
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin)
 		return;
 
@@ -3195,6 +3210,11 @@ static void alc256_shutup(struct hda_cod
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3231,6 +3251,11 @@ static void alc225_init(struct hda_codec
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp1_pin_sense, hp2_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin)
 		return;
 
@@ -3274,6 +3299,11 @@ static void alc225_shutup(struct hda_cod
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp1_pin_sense, hp2_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3318,6 +3348,11 @@ static void alc_default_init(struct hda_
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin)
 		return;
 
@@ -3347,6 +3382,11 @@ static void alc_default_shutup(struct hd
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	bool hp_pin_sense;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3379,6 +3419,11 @@ static void alc294_hp_init(struct hda_co
 	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
 	int i, val;
 
+	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
+		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+			hp_pin = spec->gen.autocfg.line_out_pins[0];
+	}
+
 	if (!hp_pin)
 		return;
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 318/352] ALSA: hda/realtek - Use a common helper for hp pin reference
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (316 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 317/352] ALSA: hda/realtek - Fix lose hp_pins for disable auto mute Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 319/352] ALSA: hda/realtek - Headset microphone support for System76 darp5 Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 35a39f98567d8d3f1cea48f0f30de1a7e736b644 upstream.

Replace the open-codes in many places with a new common helper for
performing the same thing: referring to the primary headphone pin.

This eventually fixes the potentially missing headphone pin on some
weird devices, too.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   96 ++++++++++--------------------------------
 1 file changed, 24 insertions(+), 72 deletions(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -515,6 +515,15 @@ static void alc_auto_init_amp(struct hda
 	}
 }
 
+/* get a primary headphone pin if available */
+static hda_nid_t alc_get_hp_pin(struct alc_spec *spec)
+{
+	if (spec->gen.autocfg.hp_pins[0])
+		return spec->gen.autocfg.hp_pins[0];
+	if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+		return spec->gen.autocfg.line_out_pins[0];
+	return 0;
+}
 
 /*
  * Realtek SSID verification
@@ -725,9 +734,7 @@ do_sku:
 	 * 15   : 1 --> enable the function "Mute internal speaker
 	 *	        when the external headphone out jack is plugged"
 	 */
-	if (!spec->gen.autocfg.hp_pins[0] &&
-	    !(spec->gen.autocfg.line_out_pins[0] &&
-	      spec->gen.autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
+	if (!alc_get_hp_pin(spec)) {
 		hda_nid_t nid;
 		tmp = (ass >> 11) & 0x3;	/* HP to chassis */
 		nid = ports[tmp];
@@ -2959,15 +2966,10 @@ static void alc282_restore_default_value
 static void alc282_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 	int coef78;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	alc282_restore_default_value(codec);
 
 	if (!hp_pin)
@@ -3001,15 +3003,10 @@ static void alc282_init(struct hda_codec
 static void alc282_shutup(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 	int coef78;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3084,14 +3081,9 @@ static void alc283_restore_default_value
 static void alc283_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	alc283_restore_default_value(codec);
 
 	if (!hp_pin)
@@ -3125,14 +3117,9 @@ static void alc283_init(struct hda_codec
 static void alc283_shutup(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3166,14 +3153,9 @@ static void alc283_shutup(struct hda_cod
 static void alc256_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin)
 		return;
 
@@ -3207,14 +3189,9 @@ static void alc256_init(struct hda_codec
 static void alc256_shutup(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3248,14 +3225,9 @@ static void alc256_shutup(struct hda_cod
 static void alc225_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp1_pin_sense, hp2_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin)
 		return;
 
@@ -3296,14 +3268,9 @@ static void alc225_init(struct hda_codec
 static void alc225_shutup(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp1_pin_sense, hp2_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3345,14 +3312,9 @@ static void alc225_shutup(struct hda_cod
 static void alc_default_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin)
 		return;
 
@@ -3379,14 +3341,9 @@ static void alc_default_init(struct hda_
 static void alc_default_shutup(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp_pin_sense;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin) {
 		alc269_shutup(codec);
 		return;
@@ -3416,14 +3373,9 @@ static void alc_default_shutup(struct hd
 static void alc294_hp_init(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	int i, val;
 
-	if (!spec->gen.autocfg.hp_outs && spec->gen.suppress_auto_mute) {
-		if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-			hp_pin = spec->gen.autocfg.line_out_pins[0];
-	}
-
 	if (!hp_pin)
 		return;
 
@@ -4825,7 +4777,7 @@ static void alc_update_headset_mode(stru
 	struct alc_spec *spec = codec->spec;
 
 	hda_nid_t mux_pin = spec->gen.imux_pins[spec->gen.cur_mux[0]];
-	hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 
 	int new_headset_mode;
 
@@ -5104,7 +5056,7 @@ static void alc_fixup_tpt470_dock(struct
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
 	struct alc_spec *spec = codec->spec;
-	int hp_pin = spec->gen.autocfg.hp_pins[0];
+	int hp_pin = alc_get_hp_pin(spec);
 
 	/* Prevent pop noises when headphones are plugged in */
 	snd_hda_codec_write(codec, hp_pin, 0,
@@ -5197,7 +5149,7 @@ static void alc271_hp_gate_mic_jack(stru
 
 	if (action == HDA_FIXUP_ACT_PROBE) {
 		int mic_pin = find_ext_mic_pin(codec);
-		int hp_pin = spec->gen.autocfg.hp_pins[0];
+		int hp_pin = alc_get_hp_pin(spec);
 
 		if (snd_BUG_ON(!mic_pin || !hp_pin))
 			return;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 319/352] ALSA: hda/realtek - Headset microphone support for System76 darp5
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (317 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 318/352] ALSA: hda/realtek - Use a common helper for hp pin reference Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 320/352] fuse: call pipe_buf_release() under pipe lock Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeremy Soller, Takashi Iwai

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeremy Soller <jeremy@system76.com>

commit 89e3a5682edaa4e5bb334719afb180256ac7bf78 upstream.

On the System76 Darter Pro (darp5), there is a headset microphone
input attached to 0x1a that does not have a jack detect.  In order to
get it working, the pin configuration needs to be set correctly, and
the ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied.
This is similar to the MIC_NO_PRESENCE fixups for some Dell laptops,
except we have a separate microphone jack that is already configured
correctly.

Signed-off-by: Jeremy Soller <jeremy@system76.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5572,6 +5572,7 @@ enum {
 	ALC294_FIXUP_ASUS_MIC,
 	ALC294_FIXUP_ASUS_HEADSET_MIC,
 	ALC294_FIXUP_ASUS_SPK,
+	ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6496,6 +6497,15 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
 	},
+	[ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6674,6 +6684,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 320/352] fuse: call pipe_buf_release() under pipe lock
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (318 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 319/352] ALSA: hda/realtek - Headset microphone support for System76 darp5 Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 321/352] fuse: decrement NR_WRITEBACK_TEMP on the right page Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Miklos Szeredi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jannh@google.com>

commit 9509941e9c534920ccc4771ae70bd6cbbe79df1c upstream.

Some of the pipe_buf_release() handlers seem to assume that the pipe is
locked - in particular, anon_pipe_buf_release() accesses pipe->tmp_page
without taking any extra locks. From a glance through the callers of
pipe_buf_release(), it looks like FUSE is the only one that calls
pipe_buf_release() without having the pipe locked.

This bug should only lead to a memory leak, nothing terrible.

Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/dev.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(str
 
 	ret = fuse_dev_do_write(fud, &cs, len);
 
+	pipe_lock(pipe);
 	for (idx = 0; idx < nbuf; idx++)
 		pipe_buf_release(pipe, &bufs[idx]);
+	pipe_unlock(pipe);
 
 out:
 	kvfree(bufs);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 321/352] fuse: decrement NR_WRITEBACK_TEMP on the right page
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (319 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 320/352] fuse: call pipe_buf_release() under pipe lock Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 322/352] fuse: handle zero sized retrieve correctly Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit a2ebba824106dabe79937a9f29a875f837e1b6d4 upstream.

NR_WRITEBACK_TEMP is accounted on the temporary page in the request, not
the page cache page.

Fixes: 8b284dc47291 ("fuse: writepages: handle same page rewrites")
Cc: <stable@vger.kernel.org> # v3.13
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1782,7 +1782,7 @@ static bool fuse_writepage_in_flight(str
 		spin_unlock(&fc->lock);
 
 		dec_wb_stat(&bdi->wb, WB_WRITEBACK);
-		dec_node_page_state(page, NR_WRITEBACK_TEMP);
+		dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
 		wb_writeout_inc(&bdi->wb);
 		fuse_writepage_free(fc, new_req);
 		fuse_request_free(new_req);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 322/352] fuse: handle zero sized retrieve correctly
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (320 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 321/352] fuse: decrement NR_WRITEBACK_TEMP on the right page Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 323/352] cuse: fix ioctl Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+c1e36d30ee3416289cc0, Miklos Szeredi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit 97e1532ef81acb31c30f9e75bf00306c33a77812 upstream.

Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.

Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Fixes: b2430d7567a3 ("fuse: add per-page descriptor <offset, length> to fuse_req")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/dev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_con
 	req->in.h.nodeid = outarg->nodeid;
 	req->in.numargs = 2;
 	req->in.argpages = 1;
-	req->page_descs[0].offset = offset;
 	req->end = fuse_retrieve_end;
 
 	index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_con
 
 		this_num = min_t(unsigned, num, PAGE_SIZE - offset);
 		req->pages[req->num_pages] = page;
+		req->page_descs[req->num_pages].offset = offset;
 		req->page_descs[req->num_pages].length = this_num;
 		req->num_pages++;
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 323/352] cuse: fix ioctl
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (321 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 322/352] fuse: handle zero sized retrieve correctly Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 324/352] HID: debug: fix the ring buffer implementation Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andreas Steinmetz, Miklos Szeredi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit 8a3177db59cd644fde05ba9efee29392dfdec8aa upstream.

cuse_process_init_reply() doesn't initialize fc->max_pages and thus all
cuse bases ioctls fail with ENOMEM.

Reported-by: Andreas Steinmetz <ast@domdv.de>
Fixes: 5da784cce430 ("fuse: add max_pages to init_out")
Cc: <stable@vger.kernel.org> # v4.20
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/inode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -628,6 +628,7 @@ void fuse_conn_init(struct fuse_conn *fc
 	get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
 	fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
 	fc->user_ns = get_user_ns(user_ns);
+	fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 }
 EXPORT_SYMBOL_GPL(fuse_conn_init);
 
@@ -1162,7 +1163,6 @@ static int fuse_fill_super(struct super_
 	fc->user_id = d.user_id;
 	fc->group_id = d.group_id;
 	fc->max_read = max_t(unsigned, 4096, d.max_read);
-	fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 
 	/* Used by get_root_inode() */
 	sb->s_fs_info = fc;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 324/352] HID: debug: fix the ring buffer implementation
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (322 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 323/352] cuse: fix ioctl Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 325/352] dmaengine: bcm2835: Fix interrupt race on RT Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladis Dronov, Oleg Nesterov,
	Benjamin Tissoires

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vladis Dronov <vdronov@redhat.com>

commit 13054abbaa4f1fd4e6f3b4b63439ec033b4c8035 upstream.

Ring buffer implementation in hid_debug_event() and hid_debug_events_read()
is strange allowing lost or corrupted data. After commit 717adfdaf147
("HID: debug: check length before copy_to_user()") it is possible to enter
an infinite loop in hid_debug_events_read() by providing 0 as count, this
locks up a system. Fix this by rewriting the ring buffer implementation
with kfifo and simplify the code.

This fixes CVE-2019-3819.

v2: fix an execution logic and add a comment
v3: use __set_current_state() instead of set_current_state()

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187
Cc: stable@vger.kernel.org # v4.18+
Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/hid-debug.c   |  120 ++++++++++++++++++----------------------------
 include/linux/hid-debug.h |    9 +--
 2 files changed, 51 insertions(+), 78 deletions(-)

--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/kfifo.h>
 #include <linux/sched/signal.h>
 #include <linux/export.h>
 #include <linux/slab.h>
@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
 /* enqueue string to 'events' ring buffer */
 void hid_debug_event(struct hid_device *hdev, char *buf)
 {
-	unsigned i;
 	struct hid_debug_list *list;
 	unsigned long flags;
 
 	spin_lock_irqsave(&hdev->debug_list_lock, flags);
-	list_for_each_entry(list, &hdev->debug_list, node) {
-		for (i = 0; buf[i]; i++)
-			list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
-				buf[i];
-		list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
-        }
+	list_for_each_entry(list, &hdev->debug_list, node)
+		kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
 	spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
 
 	wake_up_interruptible(&hdev->debug_wait);
@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *h
 	hid_debug_event(hdev, buf);
 
 	kfree(buf);
-        wake_up_interruptible(&hdev->debug_wait);
-
+	wake_up_interruptible(&hdev->debug_wait);
 }
 EXPORT_SYMBOL_GPL(hid_dump_input);
 
@@ -1088,8 +1083,8 @@ static int hid_debug_events_open(struct
 		goto out;
 	}
 
-	if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
-		err = -ENOMEM;
+	err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
+	if (err) {
 		kfree(list);
 		goto out;
 	}
@@ -1109,77 +1104,57 @@ static ssize_t hid_debug_events_read(str
 		size_t count, loff_t *ppos)
 {
 	struct hid_debug_list *list = file->private_data;
-	int ret = 0, len;
+	int ret = 0, copied;
 	DECLARE_WAITQUEUE(wait, current);
 
 	mutex_lock(&list->read_mutex);
-	while (ret == 0) {
-		if (list->head == list->tail) {
-			add_wait_queue(&list->hdev->debug_wait, &wait);
-			set_current_state(TASK_INTERRUPTIBLE);
-
-			while (list->head == list->tail) {
-				if (file->f_flags & O_NONBLOCK) {
-					ret = -EAGAIN;
-					break;
-				}
-				if (signal_pending(current)) {
-					ret = -ERESTARTSYS;
-					break;
-				}
-
-				if (!list->hdev || !list->hdev->debug) {
-					ret = -EIO;
-					set_current_state(TASK_RUNNING);
-					goto out;
-				}
-
-				/* allow O_NONBLOCK from other threads */
-				mutex_unlock(&list->read_mutex);
-				schedule();
-				mutex_lock(&list->read_mutex);
-				set_current_state(TASK_INTERRUPTIBLE);
+	if (kfifo_is_empty(&list->hid_debug_fifo)) {
+		add_wait_queue(&list->hdev->debug_wait, &wait);
+		set_current_state(TASK_INTERRUPTIBLE);
+
+		while (kfifo_is_empty(&list->hid_debug_fifo)) {
+			if (file->f_flags & O_NONBLOCK) {
+				ret = -EAGAIN;
+				break;
 			}
 
-			set_current_state(TASK_RUNNING);
-			remove_wait_queue(&list->hdev->debug_wait, &wait);
-		}
-
-		if (ret)
-			goto out;
-
-		/* pass the ringbuffer contents to userspace */
-copy_rest:
-		if (list->tail == list->head)
-			goto out;
-		if (list->tail > list->head) {
-			len = list->tail - list->head;
-			if (len > count)
-				len = count;
-
-			if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
-				ret = -EFAULT;
-				goto out;
+			if (signal_pending(current)) {
+				ret = -ERESTARTSYS;
+				break;
 			}
-			ret += len;
-			list->head += len;
-		} else {
-			len = HID_DEBUG_BUFSIZE - list->head;
-			if (len > count)
-				len = count;
 
-			if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
-				ret = -EFAULT;
+			/* if list->hdev is NULL we cannot remove_wait_queue().
+			 * if list->hdev->debug is 0 then hid_debug_unregister()
+			 * was already called and list->hdev is being destroyed.
+			 * if we add remove_wait_queue() here we can hit a race.
+			 */
+			if (!list->hdev || !list->hdev->debug) {
+				ret = -EIO;
+				set_current_state(TASK_RUNNING);
 				goto out;
 			}
-			list->head = 0;
-			ret += len;
-			count -= len;
-			if (count > 0)
-				goto copy_rest;
+
+			/* allow O_NONBLOCK from other threads */
+			mutex_unlock(&list->read_mutex);
+			schedule();
+			mutex_lock(&list->read_mutex);
+			set_current_state(TASK_INTERRUPTIBLE);
 		}
 
+		__set_current_state(TASK_RUNNING);
+		remove_wait_queue(&list->hdev->debug_wait, &wait);
+
+		if (ret)
+			goto out;
 	}
+
+	/* pass the fifo content to userspace, locking is not needed with only
+	 * one concurrent reader and one concurrent writer
+	 */
+	ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+	if (ret)
+		goto out;
+	ret = copied;
 out:
 	mutex_unlock(&list->read_mutex);
 	return ret;
@@ -1190,7 +1165,7 @@ static __poll_t hid_debug_events_poll(st
 	struct hid_debug_list *list = file->private_data;
 
 	poll_wait(file, &list->hdev->debug_wait, wait);
-	if (list->head != list->tail)
+	if (!kfifo_is_empty(&list->hid_debug_fifo))
 		return EPOLLIN | EPOLLRDNORM;
 	if (!list->hdev->debug)
 		return EPOLLERR | EPOLLHUP;
@@ -1205,7 +1180,7 @@ static int hid_debug_events_release(stru
 	spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
 	list_del(&list->node);
 	spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
-	kfree(list->hid_debug_buf);
+	kfifo_free(&list->hid_debug_fifo);
 	kfree(list);
 
 	return 0;
@@ -1256,4 +1231,3 @@ void hid_debug_exit(void)
 {
 	debugfs_remove_recursive(hid_debug_root);
 }
-
--- a/include/linux/hid-debug.h
+++ b/include/linux/hid-debug.h
@@ -24,7 +24,10 @@
 
 #ifdef CONFIG_DEBUG_FS
 
+#include <linux/kfifo.h>
+
 #define HID_DEBUG_BUFSIZE 512
+#define HID_DEBUG_FIFOSIZE 512
 
 void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
 void hid_dump_report(struct hid_device *, int , u8 *, int);
@@ -37,11 +40,8 @@ void hid_debug_init(void);
 void hid_debug_exit(void);
 void hid_debug_event(struct hid_device *, char *);
 
-
 struct hid_debug_list {
-	char *hid_debug_buf;
-	int head;
-	int tail;
+	DECLARE_KFIFO_PTR(hid_debug_fifo, char);
 	struct fasync_struct *fasync;
 	struct hid_device *hdev;
 	struct list_head node;
@@ -64,4 +64,3 @@ struct hid_debug_list {
 #endif
 
 #endif
-



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 325/352] dmaengine: bcm2835: Fix interrupt race on RT
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (323 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 324/352] HID: debug: fix the ring buffer implementation Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 326/352] dmaengine: bcm2835: Fix abort of transactions Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Frank Pavlic,
	Martin Sperl, Florian Meier, Clive Messer, Matthias Reichl,
	Stefan Wahren, Florian Kauer, Vinod Koul

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lukas Wunner <lukas@wunner.de>

commit f7da7782aba92593f7b82f03d2409a1c5f4db91b upstream.

If IRQ handlers are threaded (either because CONFIG_PREEMPT_RT_BASE is
enabled or "threadirqs" was passed on the command line) and if system
load is sufficiently high that wakeup latency of IRQ threads degrades,
SPI DMA transactions on the BCM2835 occasionally break like this:

ks8851 spi0.0: SPI transfer timed out
bcm2835-dma 3f007000.dma: DMA transfer could not be terminated
ks8851 spi0.0 eth2: ks8851_rdfifo: spi_sync() failed

The root cause is an assumption made by the DMA driver which is
documented in a code comment in bcm2835_dma_terminate_all():

/*
 * Stop DMA activity: we assume the callback will not be called
 * after bcm_dma_abort() returns (even if it does, it will see
 * c->desc is NULL and exit.)
 */

That assumption falls apart if the IRQ handler bcm2835_dma_callback() is
threaded: A client may terminate a descriptor and issue a new one
before the IRQ handler had a chance to run. In fact the IRQ handler may
miss an *arbitrary* number of descriptors. The result is the following
race condition:

1. A descriptor finishes, its interrupt is deferred to the IRQ thread.
2. A client calls dma_terminate_async() which sets channel->desc = NULL.
3. The client issues a new descriptor. Because channel->desc is NULL,
   bcm2835_dma_issue_pending() immediately starts the descriptor.
4. Finally the IRQ thread runs and writes BCM2835_DMA_INT to the CS
   register to acknowledge the interrupt. This clears the ACTIVE flag,
   so the newly issued descriptor is paused in the middle of the
   transaction. Because channel->desc is not NULL, the IRQ thread
   finalizes the descriptor and tries to start the next one.

I see two possible solutions: The first is to call synchronize_irq()
in bcm2835_dma_issue_pending() to wait until the IRQ thread has
finished before issuing a new descriptor. The downside of this approach
is unnecessary latency if clients desire rapidly terminating and
re-issuing descriptors and don't have any use for an IRQ callback.
(The SPI TX DMA channel is a case in point.)

A better alternative is to make the IRQ thread recognize that it has
missed descriptors and avoid finalizing the newly issued descriptor.
So first of all, set the ACTIVE flag when acknowledging the interrupt.
This keeps a newly issued descriptor running.

If the descriptor was finished, the channel remains idle despite the
ACTIVE flag being set. However the ACTIVE flag can then no longer be
used to check whether the channel is idle, so instead check whether
the register containing the current control block address is zero
and finalize the current descriptor only if so.

That way, there is no impact on latency and throughput if the client
doesn't care for the interrupt: Only minimal additional overhead is
introduced for non-cyclic descriptors as one further MMIO read is
necessary per interrupt to check for idleness of the channel. Cyclic
descriptors are sped up slightly by removing one MMIO write per
interrupt.

Fixes: 96286b576690 ("dmaengine: Add support for BCM2835")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.14+
Cc: Frank Pavlic <f.pavlic@kunbus.de>
Cc: Martin Sperl <kernel@martin.sperl.org>
Cc: Florian Meier <florian.meier@koalo.de>
Cc: Clive Messer <clive.m.messer@gmail.com>
Cc: Matthias Reichl <hias@horus.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Florian Kauer <florian.kauer@koalo.de>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/bcm2835-dma.c |   33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -421,7 +421,12 @@ static int bcm2835_dma_abort(void __iome
 	long int timeout = 10000;
 
 	cs = readl(chan_base + BCM2835_DMA_CS);
-	if (!(cs & BCM2835_DMA_ACTIVE))
+
+	/*
+	 * A zero control block address means the channel is idle.
+	 * (The ACTIVE flag in the CS register is not a reliable indicator.)
+	 */
+	if (!readl(chan_base + BCM2835_DMA_ADDR))
 		return 0;
 
 	/* Write 0 to the active bit - Pause the DMA */
@@ -485,8 +490,15 @@ static irqreturn_t bcm2835_dma_callback(
 
 	spin_lock_irqsave(&c->vc.lock, flags);
 
-	/* Acknowledge interrupt */
-	writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
+	/*
+	 * Clear the INT flag to receive further interrupts. Keep the channel
+	 * active in case the descriptor is cyclic or in case the client has
+	 * already terminated the descriptor and issued a new one. (May happen
+	 * if this IRQ handler is threaded.) If the channel is finished, it
+	 * will remain idle despite the ACTIVE flag being set.
+	 */
+	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+	       c->chan_base + BCM2835_DMA_CS);
 
 	d = c->desc;
 
@@ -494,11 +506,7 @@ static irqreturn_t bcm2835_dma_callback(
 		if (d->cyclic) {
 			/* call the cyclic callback */
 			vchan_cyclic_callback(&d->vd);
-
-			/* Keep the DMA engine running */
-			writel(BCM2835_DMA_ACTIVE,
-			       c->chan_base + BCM2835_DMA_CS);
-		} else {
+		} else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
 			vchan_cookie_complete(&c->desc->vd);
 			bcm2835_dma_start_desc(c);
 		}
@@ -798,11 +806,7 @@ static int bcm2835_dma_terminate_all(str
 	list_del_init(&c->node);
 	spin_unlock(&d->lock);
 
-	/*
-	 * Stop DMA activity: we assume the callback will not be called
-	 * after bcm_dma_abort() returns (even if it does, it will see
-	 * c->desc is NULL and exit.)
-	 */
+	/* stop DMA activity */
 	if (c->desc) {
 		vchan_terminate_vdesc(&c->desc->vd);
 		c->desc = NULL;
@@ -810,8 +814,7 @@ static int bcm2835_dma_terminate_all(str
 
 		/* Wait for stopping */
 		while (--timeout) {
-			if (!(readl(c->chan_base + BCM2835_DMA_CS) &
-						BCM2835_DMA_ACTIVE))
+			if (!readl(c->chan_base + BCM2835_DMA_ADDR))
 				break;
 
 			cpu_relax();



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 326/352] dmaengine: bcm2835: Fix abort of transactions
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (324 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 325/352] dmaengine: bcm2835: Fix interrupt race on RT Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 327/352] dmaengine: imx-dma: fix wrong callback invoke Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Frank Pavlic,
	Martin Sperl, Florian Meier, Clive Messer, Matthias Reichl,
	Stefan Wahren, Florian Kauer, Vinod Koul

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lukas Wunner <lukas@wunner.de>

commit 9e528c799d17a4ac37d788c81440b50377dd592d upstream.

There are multiple issues with bcm2835_dma_abort() (which is called on
termination of a transaction):

* The algorithm to abort the transaction first pauses the channel by
  clearing the ACTIVE flag in the CS register, then waits for the PAUSED
  flag to clear.  Page 49 of the spec documents the latter as follows:

  "Indicates if the DMA is currently paused and not transferring data.
   This will occur if the active bit has been cleared [...]"
   https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

  So the function is entering an infinite loop because it is waiting for
  PAUSED to clear which is always set due to the function having cleared
  the ACTIVE flag.  The only thing that's saving it from itself is the
  upper bound of 10000 loop iterations.

  The code comment says that the intention is to "wait for any current
  AXI transfer to complete", so the author probably wanted to check the
  WAITING_FOR_OUTSTANDING_WRITES flag instead.  Amend the function
  accordingly.

* The CS register is only read at the beginning of the function.  It
  needs to be read again after pausing the channel and before checking
  for outstanding writes, otherwise writes which were issued between
  the register read at the beginning of the function and pausing the
  channel may not be waited for.

* The function seeks to abort the transfer by writing 0 to the NEXTCONBK
  register and setting the ABORT and ACTIVE flags.  Thereby, the 0 in
  NEXTCONBK is sought to be loaded into the CONBLK_AD register.  However
  experimentation has shown this approach to not work:  The CONBLK_AD
  register remains the same as before and the CS register contains
  0x00000030 (PAUSED | DREQ_STOPS_DMA).  In other words, the control
  block is not aborted but merely paused and it will be resumed once the
  next DMA transaction is started.  That is absolutely not the desired
  behavior.

  A simpler approach is to set the channel's RESET flag instead.  This
  reliably zeroes the NEXTCONBK as well as the CS register.  It requires
  less code and only a single MMIO write.  This is also what popular
  user space DMA drivers do, e.g.:
  https://github.com/metachris/RPIO/blob/master/source/c_pwm/pwm.c

  Note that the spec is contradictory whether the NEXTCONBK register
  is writeable at all.  On the one hand, page 41 claims:

  "The value loaded into the NEXTCONBK register can be overwritten so
  that the linked list of Control Block data structures can be
  dynamically altered. However it is only safe to do this when the DMA
  is paused."

  On the other hand, page 40 specifies:

  "Only three registers in each channel's register set are directly
  writeable (CS, CONBLK_AD and DEBUG). The other registers (TI,
  SOURCE_AD, DEST_AD, TXFR_LEN, STRIDE & NEXTCONBK), are automatically
  loaded from a Control Block data structure held in external memory."

Fixes: 96286b576690 ("dmaengine: Add support for BCM2835")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.14+
Cc: Frank Pavlic <f.pavlic@kunbus.de>
Cc: Martin Sperl <kernel@martin.sperl.org>
Cc: Florian Meier <florian.meier@koalo.de>
Cc: Clive Messer <clive.m.messer@gmail.com>
Cc: Matthias Reichl <hias@horus.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Florian Kauer <florian.kauer@koalo.de>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/bcm2835-dma.c |   41 +++++++++--------------------------------
 1 file changed, 9 insertions(+), 32 deletions(-)

--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -415,13 +415,11 @@ static void bcm2835_dma_fill_cb_chain_wi
 	}
 }
 
-static int bcm2835_dma_abort(void __iomem *chan_base)
+static int bcm2835_dma_abort(struct bcm2835_chan *c)
 {
-	unsigned long cs;
+	void __iomem *chan_base = c->chan_base;
 	long int timeout = 10000;
 
-	cs = readl(chan_base + BCM2835_DMA_CS);
-
 	/*
 	 * A zero control block address means the channel is idle.
 	 * (The ACTIVE flag in the CS register is not a reliable indicator.)
@@ -433,25 +431,16 @@ static int bcm2835_dma_abort(void __iome
 	writel(0, chan_base + BCM2835_DMA_CS);
 
 	/* Wait for any current AXI transfer to complete */
-	while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
+	while ((readl(chan_base + BCM2835_DMA_CS) &
+		BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
 		cpu_relax();
-		cs = readl(chan_base + BCM2835_DMA_CS);
-	}
 
-	/* We'll un-pause when we set of our next DMA */
+	/* Peripheral might be stuck and fail to signal AXI write responses */
 	if (!timeout)
-		return -ETIMEDOUT;
-
-	if (!(cs & BCM2835_DMA_ACTIVE))
-		return 0;
-
-	/* Terminate the control block chain */
-	writel(0, chan_base + BCM2835_DMA_NEXTCB);
-
-	/* Abort the whole DMA */
-	writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
-	       chan_base + BCM2835_DMA_CS);
+		dev_err(c->vc.chan.device->dev,
+			"failed to complete outstanding writes\n");
 
+	writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
 	return 0;
 }
 
@@ -796,7 +785,6 @@ static int bcm2835_dma_terminate_all(str
 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
 	struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
 	unsigned long flags;
-	int timeout = 10000;
 	LIST_HEAD(head);
 
 	spin_lock_irqsave(&c->vc.lock, flags);
@@ -810,18 +798,7 @@ static int bcm2835_dma_terminate_all(str
 	if (c->desc) {
 		vchan_terminate_vdesc(&c->desc->vd);
 		c->desc = NULL;
-		bcm2835_dma_abort(c->chan_base);
-
-		/* Wait for stopping */
-		while (--timeout) {
-			if (!readl(c->chan_base + BCM2835_DMA_ADDR))
-				break;
-
-			cpu_relax();
-		}
-
-		if (!timeout)
-			dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
+		bcm2835_dma_abort(c);
 	}
 
 	vchan_get_all_descriptors(&c->vc, &head);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 327/352] dmaengine: imx-dma: fix wrong callback invoke
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (325 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 326/352] dmaengine: bcm2835: Fix abort of transactions Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 328/352] futex: Handle early deadlock return correctly Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leonid Iziumtsev, Vinod Koul

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>

commit 341198eda723c8c1cddbb006a89ad9e362502ea2 upstream.

Once the "ld_queue" list is not empty, next descriptor will migrate
into "ld_active" list. The "desc" variable will be overwritten
during that transition. And later the dmaengine_desc_get_callback_invoke()
will use it as an argument. As result we invoke wrong callback.

That behaviour was in place since:
commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet").
But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job")
things got worse, since possible delay between tasklet_schedule()
from DMA irq handler and actual tasklet function execution got bigger.
And that gave more time for new DMA request to be submitted and
to be put into "ld_queue" list.

It has been noticed that DMA issue is causing problems for "mxc-mmc"
driver. While stressing the system with heavy network traffic and
writing/reading to/from sd card simultaneously the timeout may happen:

10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900)

That often lead to file system corruption.

Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/imx-dma.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long
 {
 	struct imxdma_channel *imxdmac = (void *)data;
 	struct imxdma_engine *imxdma = imxdmac->imxdma;
-	struct imxdma_desc *desc;
+	struct imxdma_desc *desc, *next_desc;
 	unsigned long flags;
 
 	spin_lock_irqsave(&imxdma->lock, flags);
@@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long
 	list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
 
 	if (!list_empty(&imxdmac->ld_queue)) {
-		desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
-					node);
+		next_desc = list_first_entry(&imxdmac->ld_queue,
+					     struct imxdma_desc, node);
 		list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
-		if (imxdma_xfer_desc(desc) < 0)
+		if (imxdma_xfer_desc(next_desc) < 0)
 			dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
 				 __func__, imxdmac->channel);
 	}



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 328/352] futex: Handle early deadlock return correctly
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (326 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 327/352] dmaengine: imx-dma: fix wrong callback invoke Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 329/352] irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Peter Zijlstra,
	Thomas Gleixner, Martin Schwidefsky, linux-s390, Stefan Liebler,
	Sebastian Sewior

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 1a1fb985f2e2b85ec0d3dc2e519ee48389ec2434 upstream.

commit 56222b212e8e ("futex: Drop hb->lock before enqueueing on the
rtmutex") changed the locking rules in the futex code so that the hash
bucket lock is not longer held while the waiter is enqueued into the
rtmutex wait list. This made the lock and the unlock path symmetric, but
unfortunately the possible early exit from __rt_mutex_proxy_start() due to
a detected deadlock was not updated accordingly. That allows a concurrent
unlocker to observe inconsitent state which triggers the warning in the
unlock path.

futex_lock_pi()                         futex_unlock_pi()
  lock(hb->lock)
  queue(hb_waiter)				lock(hb->lock)
  lock(rtmutex->wait_lock)
  unlock(hb->lock)
                                        // acquired hb->lock
                                        hb_waiter = futex_top_waiter()
                                        lock(rtmutex->wait_lock)
  __rt_mutex_proxy_start()
     ---> fail
          remove(rtmutex_waiter);
     ---> returns -EDEADLOCK
  unlock(rtmutex->wait_lock)
                                        // acquired wait_lock
                                        wake_futex_pi()
                                        rt_mutex_next_owner()
					  --> returns NULL
                                          --> WARN

  lock(hb->lock)
  unqueue(hb_waiter)

The problem is caused by the remove(rtmutex_waiter) in the failure case of
__rt_mutex_proxy_start() as this lets the unlocker observe a waiter in the
hash bucket but no waiter on the rtmutex, i.e. inconsistent state.

The original commit handles this correctly for the other early return cases
(timeout, signal) by delaying the removal of the rtmutex waiter until the
returning task reacquired the hash bucket lock.

Treat the failure case of __rt_mutex_proxy_start() in the same way and let
the existing cleanup code handle the eventual handover of the rtmutex
gracefully. The regular rt_mutex_proxy_start() gains the rtmutex waiter
removal for the failure case, so that the other callsites are still
operating correctly.

Add proper comments to the code so all these details are fully documented.

Thanks to Peter for helping with the analysis and writing the really
valuable code comments.

Fixes: 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex")
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Co-developed-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: linux-s390@vger.kernel.org
Cc: Stefan Liebler <stli@linux.ibm.com>
Cc: Sebastian Sewior <bigeasy@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1901292311410.1950@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/futex.c           |   28 ++++++++++++++++++----------
 kernel/locking/rtmutex.c |   37 ++++++++++++++++++++++++++++++++-----
 2 files changed, 50 insertions(+), 15 deletions(-)

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2850,35 +2850,39 @@ retry_private:
 	 * and BUG when futex_unlock_pi() interleaves with this.
 	 *
 	 * Therefore acquire wait_lock while holding hb->lock, but drop the
-	 * latter before calling rt_mutex_start_proxy_lock(). This still fully
-	 * serializes against futex_unlock_pi() as that does the exact same
-	 * lock handoff sequence.
+	 * latter before calling __rt_mutex_start_proxy_lock(). This
+	 * interleaves with futex_unlock_pi() -- which does a similar lock
+	 * handoff -- such that the latter can observe the futex_q::pi_state
+	 * before __rt_mutex_start_proxy_lock() is done.
 	 */
 	raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
 	spin_unlock(q.lock_ptr);
+	/*
+	 * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
+	 * such that futex_unlock_pi() is guaranteed to observe the waiter when
+	 * it sees the futex_q::pi_state.
+	 */
 	ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
 	raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
 
 	if (ret) {
 		if (ret == 1)
 			ret = 0;
-
-		spin_lock(q.lock_ptr);
-		goto no_block;
+		goto cleanup;
 	}
 
-
 	if (unlikely(to))
 		hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
 
 	ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
 
+cleanup:
 	spin_lock(q.lock_ptr);
 	/*
-	 * If we failed to acquire the lock (signal/timeout), we must
+	 * If we failed to acquire the lock (deadlock/signal/timeout), we must
 	 * first acquire the hb->lock before removing the lock from the
-	 * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
-	 * wait lists consistent.
+	 * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
+	 * lists consistent.
 	 *
 	 * In particular; it is important that futex_unlock_pi() can not
 	 * observe this inconsistency.
@@ -3002,6 +3006,10 @@ retry:
 		 * there is no point where we hold neither; and therefore
 		 * wake_futex_pi() must observe a state consistent with what we
 		 * observed.
+		 *
+		 * In particular; this forces __rt_mutex_start_proxy() to
+		 * complete such that we're guaranteed to observe the
+		 * rt_waiter. Also see the WARN in wake_futex_pi().
 		 */
 		raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 		spin_unlock(&hb->lock);
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1726,12 +1726,33 @@ void rt_mutex_proxy_unlock(struct rt_mut
 	rt_mutex_set_owner(lock, NULL);
 }
 
+/**
+ * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task
+ * @lock:		the rt_mutex to take
+ * @waiter:		the pre-initialized rt_mutex_waiter
+ * @task:		the task to prepare
+ *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: does _NOT_ remove the @waiter on failure; must either call
+ * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this.
+ *
+ * Returns:
+ *  0 - task blocked on lock
+ *  1 - acquired the lock for task, caller should wake it up
+ * <0 - error
+ *
+ * Special API call for PI-futex support.
+ */
 int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 			      struct rt_mutex_waiter *waiter,
 			      struct task_struct *task)
 {
 	int ret;
 
+	lockdep_assert_held(&lock->wait_lock);
+
 	if (try_to_take_rt_mutex(lock, task, NULL))
 		return 1;
 
@@ -1749,9 +1770,6 @@ int __rt_mutex_start_proxy_lock(struct r
 		ret = 0;
 	}
 
-	if (unlikely(ret))
-		remove_waiter(lock, waiter);
-
 	debug_rt_mutex_print_deadlock(waiter);
 
 	return ret;
@@ -1763,12 +1781,18 @@ int __rt_mutex_start_proxy_lock(struct r
  * @waiter:		the pre-initialized rt_mutex_waiter
  * @task:		the task to prepare
  *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter
+ * on failure.
+ *
  * Returns:
  *  0 - task blocked on lock
  *  1 - acquired the lock for task, caller should wake it up
  * <0 - error
  *
- * Special API call for FUTEX_REQUEUE_PI support.
+ * Special API call for PI-futex support.
  */
 int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 			      struct rt_mutex_waiter *waiter,
@@ -1778,6 +1802,8 @@ int rt_mutex_start_proxy_lock(struct rt_
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+	if (unlikely(ret))
+		remove_waiter(lock, waiter);
 	raw_spin_unlock_irq(&lock->wait_lock);
 
 	return ret;
@@ -1845,7 +1871,8 @@ int rt_mutex_wait_proxy_lock(struct rt_m
  * @lock:		the rt_mutex we were woken on
  * @waiter:		the pre-initialized rt_mutex_waiter
  *
- * Attempt to clean up after a failed rt_mutex_wait_proxy_lock().
+ * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or
+ * rt_mutex_wait_proxy_lock().
  *
  * Unless we acquired the lock; we're still enqueued on the wait-list and can
  * in fact still be granted ownership until we're removed. Therefore we can



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 329/352] irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (327 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 328/352] futex: Handle early deadlock return correctly Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 330/352] arm64: dts: allwinner: a64: Fix USB OTG regulator Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zheng Xiang, Marc Zyngier

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 9791ec7df0e7b4d80706ccea8f24b6542f6059e9 upstream.

On systems or VMs where multiple devices share a single DevID
(because they sit behind a PCI bridge, or because the HW is
broken in funky ways), we reuse the save its_device structure
in order to reflect this.

It turns out that there is a distinct lack of locking when looking
up the its_device, and two device being probed concurrently can result
in double allocations. That's obviously not nice.

A solution for this is to have a per-ITS mutex that serializes device
allocation.

A similar issue exists on the freeing side, which can run concurrently
with the allocation. On top of now taking the appropriate lock, we
also make sure that a shared device is never freed, as we have no way
to currently track the life cycle of such object.

Reported-by: Zheng Xiang <zhengxiang9@huawei.com>
Tested-by: Zheng Xiang <zhengxiang9@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/irqchip/irq-gic-v3-its.c |   32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -97,9 +97,14 @@ struct its_device;
  * The ITS structure - contains most of the infrastructure, with the
  * top-level MSI domain, the command queue, the collections, and the
  * list of devices writing to it.
+ *
+ * dev_alloc_lock has to be taken for device allocations, while the
+ * spinlock must be taken to parse data structures such as the device
+ * list.
  */
 struct its_node {
 	raw_spinlock_t		lock;
+	struct mutex		dev_alloc_lock;
 	struct list_head	entry;
 	void __iomem		*base;
 	phys_addr_t		phys_base;
@@ -156,6 +161,7 @@ struct its_device {
 	void			*itt;
 	u32			nr_ites;
 	u32			device_id;
+	bool			shared;
 };
 
 static struct {
@@ -2422,6 +2428,7 @@ static int its_msi_prepare(struct irq_do
 	struct its_device *its_dev;
 	struct msi_domain_info *msi_info;
 	u32 dev_id;
+	int err = 0;
 
 	/*
 	 * We ignore "dev" entierely, and rely on the dev_id that has
@@ -2444,6 +2451,7 @@ static int its_msi_prepare(struct irq_do
 		return -EINVAL;
 	}
 
+	mutex_lock(&its->dev_alloc_lock);
 	its_dev = its_find_device(its, dev_id);
 	if (its_dev) {
 		/*
@@ -2451,18 +2459,22 @@ static int its_msi_prepare(struct irq_do
 		 * another alias (PCI bridge of some sort). No need to
 		 * create the device.
 		 */
+		its_dev->shared = true;
 		pr_debug("Reusing ITT for devID %x\n", dev_id);
 		goto out;
 	}
 
 	its_dev = its_create_device(its, dev_id, nvec, true);
-	if (!its_dev)
-		return -ENOMEM;
+	if (!its_dev) {
+		err = -ENOMEM;
+		goto out;
+	}
 
 	pr_debug("ITT %d entries, %d bits\n", nvec, ilog2(nvec));
 out:
+	mutex_unlock(&its->dev_alloc_lock);
 	info->scratchpad[0].ptr = its_dev;
-	return 0;
+	return err;
 }
 
 static struct msi_domain_ops its_msi_domain_ops = {
@@ -2566,6 +2578,7 @@ static void its_irq_domain_free(struct i
 {
 	struct irq_data *d = irq_domain_get_irq_data(domain, virq);
 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+	struct its_node *its = its_dev->its;
 	int i;
 
 	for (i = 0; i < nr_irqs; i++) {
@@ -2580,8 +2593,14 @@ static void its_irq_domain_free(struct i
 		irq_domain_reset_irq_data(data);
 	}
 
-	/* If all interrupts have been freed, start mopping the floor */
-	if (bitmap_empty(its_dev->event_map.lpi_map,
+	mutex_lock(&its->dev_alloc_lock);
+
+	/*
+	 * If all interrupts have been freed, start mopping the
+	 * floor. This is conditionned on the device not being shared.
+	 */
+	if (!its_dev->shared &&
+	    bitmap_empty(its_dev->event_map.lpi_map,
 			 its_dev->event_map.nr_lpis)) {
 		its_lpi_free(its_dev->event_map.lpi_map,
 			     its_dev->event_map.lpi_base,
@@ -2593,6 +2612,8 @@ static void its_irq_domain_free(struct i
 		its_free_device(its_dev);
 	}
 
+	mutex_unlock(&its->dev_alloc_lock);
+
 	irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
@@ -3517,6 +3538,7 @@ static int __init its_probe_one(struct r
 	}
 
 	raw_spin_lock_init(&its->lock);
+	mutex_init(&its->dev_alloc_lock);
 	INIT_LIST_HEAD(&its->entry);
 	INIT_LIST_HEAD(&its->its_device_list);
 	typer = gic_read_typer(its_base + GITS_TYPER);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 330/352] arm64: dts: allwinner: a64: Fix USB OTG regulator
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (328 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 329/352] irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 331/352] usb: phy: am335x: fix race condition in _probe Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jernej Skrabec <jernej.skrabec@siol.net>

commit b1360dcfdaa1d55952e5ec8dd9d99f88965d7ac9 upstream.

Currently, AXP803 driver assumes that reg_drivevbus is input which is
wrong. Unfortunate consequence of that is that none of the USB ports
work on the board, even USB HOST port, because USB PHY driver probing
fails due to missing regulator.

Fix that by adding "x-powers,drive-vbus-en" property to AXP803 node.

Fixes: 14ff5d8f9151 ("arm64: dts: allwinner: a64: Orange Pi Win: Enable USB OTG socket")

Cc: stable@vger.kernel.org
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
@@ -188,6 +188,7 @@
 		reg = <0x3a3>;
 		interrupt-parent = <&r_intc>;
 		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+		x-powers,drive-vbus-en; /* set N_VBUSEN as output pin */
 	};
 };
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 331/352] usb: phy: am335x: fix race condition in _probe
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (329 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 330/352] arm64: dts: allwinner: a64: Fix USB OTG regulator Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 332/352] usb: dwc3: gadget: Handle 0 xfer length for OUT EP Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bin Liu, Felipe Balbi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bin Liu <b-liu@ti.com>

commit a53469a68eb886e84dd8b69a1458a623d3591793 upstream.

power off the phy should be done before populate the phy. Otherwise,
am335x_init() could be called by the phy owner to power on the phy first,
then am335x_phy_probe() turns off the phy again without the caller knowing
it.

Fixes: 2fc711d76352 ("usb: phy: am335x: Enable USB remote wakeup using PHY wakeup")
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/phy/phy-am335x.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platf
 	if (ret)
 		return ret;
 
-	ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
-	if (ret)
-		return ret;
 	am_phy->usb_phy_gen.phy.init = am335x_init;
 	am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
 
@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platf
 	device_set_wakeup_enable(dev, false);
 	phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
 
-	return 0;
+	return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 332/352] usb: dwc3: gadget: Handle 0 xfer length for OUT EP
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (330 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 331/352] usb: phy: am335x: fix race condition in _probe Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 333/352] usb: gadget: udc: net2272: Fix bitwise and boolean operations Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejas Joglekar, Felipe Balbi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejas Joglekar <tejas.joglekar@synopsys.com>

commit 1e19cdc8060227b0802bda6bc0bd22b23679ba32 upstream.

For OUT endpoints, zero-length transfers require MaxPacketSize buffer as
per the DWC_usb3 programming guide 3.30a section 4.2.3.3.

This patch fixes this by explicitly checking zero length
transfer to correctly pad up to MaxPacketSize.

Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Cc: stable@vger.kernel.org

Signed-off-by: Tejas Joglekar <joglekar@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/gadget.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1119,7 +1119,7 @@ static void dwc3_prepare_one_trb_linear(
 	unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
 	unsigned int rem = length % maxp;
 
-	if (rem && usb_endpoint_dir_out(dep->endpoint.desc)) {
+	if ((!length || rem) && usb_endpoint_dir_out(dep->endpoint.desc)) {
 		struct dwc3	*dwc = dep->dwc;
 		struct dwc3_trb	*trb;
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 333/352] usb: gadget: udc: net2272: Fix bitwise and boolean operations
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (331 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 332/352] usb: dwc3: gadget: Handle 0 xfer length for OUT EP Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 334/352] usb: gadget: musb: fix short isoc packets with inventra dma Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Felipe Balbi

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gustavo A. R. Silva <gustavo@embeddedor.com>

commit 07c69f1148da7de3978686d3af9263325d9d60bd upstream.

(!x & y) strikes again.

Fix bitwise and boolean operations by enclosing the expression:

	intcsr & (1 << NET2272_PCI_IRQ)

in parentheses, before applying the boolean operator '!'.

Notice that this code has been there since 2011. So, it would
be helpful if someone can double-check this.

This issue was detected with the help of Coccinelle.

Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/net2272.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -2083,7 +2083,7 @@ static irqreturn_t net2272_irq(int irq,
 #if defined(PLX_PCI_RDK2)
 	/* see if PCI int for us by checking irqstat */
 	intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
-	if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+	if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
 		spin_unlock(&dev->lock);
 		return IRQ_NONE;
 	}



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 334/352] usb: gadget: musb: fix short isoc packets with inventra dma
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (332 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 333/352] usb: gadget: udc: net2272: Fix bitwise and boolean operations Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 335/352] staging: speakup: fix tty-operation NULL derefs Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Elder, Bin Liu

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Elder <paul.elder@ideasonboard.com>

commit c418fd6c01fbc5516a2cd1eaf1df1ec86869028a upstream.

Handling short packets (length < max packet size) in the Inventra DMA
engine in the MUSB driver causes the MUSB DMA controller to hang. An
example of a problem that is caused by this problem is when streaming
video out of a UVC gadget, only the first video frame is transferred.

For short packets (mode-0 or mode-1 DMA), MUSB_TXCSR_TXPKTRDY must be
set manually by the driver. This was previously done in musb_g_tx
(musb_gadget.c), but incorrectly (all csr flags were cleared, and only
MUSB_TXCSR_MODE and MUSB_TXCSR_TXPKTRDY were set). Fixing that problem
allows some requests to be transferred correctly, but multiple requests
were often put together in one USB packet, and caused problems if the
packet size was not a multiple of 4. Instead, set MUSB_TXCSR_TXPKTRDY
in dma_controller_irq (musbhsdma.c), just like host mode transfers.

This topic was originally tackled by Nicolas Boichat [0] [1] and is
discussed further at [2] as part of his GSoC project [3].

[0] https://groups.google.com/forum/?hl=en#!topic/beagleboard-gsoc/k8Azwfp75CU
[1] https://gitorious.org/beagleboard-usbsniffer/beagleboard-usbsniffer-kernel/commit/b0be3b6cc195ba732189b04f1d43ec843c3e54c9?p=beagleboard-usbsniffer:beagleboard-usbsniffer-kernel.git;a=patch;h=b0be3b6cc195ba732189b04f1d43ec843c3e54c9
[2] http://beagleboard-usbsniffer.blogspot.com/2010/07/musb-isochronous-transfers-fixed.html
[3] http://elinux.org/BeagleBoard/GSoC/USBSniffer

Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/musb/musb_gadget.c |   13 +------------
 drivers/usb/musb/musbhsdma.c   |   21 +++++++++++----------
 2 files changed, 12 insertions(+), 22 deletions(-)

--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epn
 	}
 
 	if (request) {
-		u8	is_dma = 0;
-		bool	short_packet = false;
 
 		trace_musb_req_tx(req);
 
 		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
-			is_dma = 1;
 			csr |= MUSB_TXCSR_P_WZC_BITS;
 			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
 				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
@@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epn
 		 */
 		if ((request->zero && request->length)
 			&& (request->length % musb_ep->packet_sz == 0)
-			&& (request->actual == request->length))
-				short_packet = true;
+			&& (request->actual == request->length)) {
 
-		if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
-			(is_dma && (!dma->desired_mode ||
-				(request->actual &
-					(musb_ep->packet_sz - 1)))))
-				short_packet = true;
-
-		if (short_packet) {
 			/*
 			 * On DMA completion, FIFO may not be
 			 * available yet...
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -346,12 +346,10 @@ static irqreturn_t dma_controller_irq(in
 				channel->status = MUSB_DMA_STATUS_FREE;
 
 				/* completed */
-				if ((devctl & MUSB_DEVCTL_HM)
-					&& (musb_channel->transmit)
-					&& ((channel->desired_mode == 0)
-					    || (channel->actual_len &
-					    (musb_channel->max_packet_sz - 1)))
-				    ) {
+				if (musb_channel->transmit &&
+					(!channel->desired_mode ||
+					(channel->actual_len %
+					    musb_channel->max_packet_sz))) {
 					u8  epnum  = musb_channel->epnum;
 					int offset = musb->io.ep_offset(epnum,
 								    MUSB_TXCSR);
@@ -363,11 +361,14 @@ static irqreturn_t dma_controller_irq(in
 					 */
 					musb_ep_select(mbase, epnum);
 					txcsr = musb_readw(mbase, offset);
-					txcsr &= ~(MUSB_TXCSR_DMAENAB
+					if (channel->desired_mode == 1) {
+						txcsr &= ~(MUSB_TXCSR_DMAENAB
 							| MUSB_TXCSR_AUTOSET);
-					musb_writew(mbase, offset, txcsr);
-					/* Send out the packet */
-					txcsr &= ~MUSB_TXCSR_DMAMODE;
+						musb_writew(mbase, offset, txcsr);
+						/* Send out the packet */
+						txcsr &= ~MUSB_TXCSR_DMAMODE;
+						txcsr |= MUSB_TXCSR_DMAENAB;
+					}
 					txcsr |=  MUSB_TXCSR_TXPKTRDY;
 					musb_writew(mbase, offset, txcsr);
 				}



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 335/352] staging: speakup: fix tty-operation NULL derefs
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (333 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 334/352] usb: gadget: musb: fix short isoc packets with inventra dma Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 336/352] scsi: sd_zbc: Fix zone information messages Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Okash Khawaja, Samuel Thibault, Johan Hovold

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit a1960e0f1639cb1f7a3d94521760fc73091f6640 upstream.

The send_xchar() and tiocmset() tty operations are optional. Add the
missing sanity checks to prevent user-space triggerable NULL-pointer
dereferences.

Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
Cc: stable <stable@vger.kernel.org>     # 4.13
Cc: Okash Khawaja <okash.khawaja@gmail.com>
Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/speakup/spk_ttyio.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch
 		return;
 	}
 
-	speakup_tty->ops->send_xchar(speakup_tty, ch);
+	if (speakup_tty->ops->send_xchar)
+		speakup_tty->ops->send_xchar(speakup_tty, ch);
 	mutex_unlock(&speakup_tty_mutex);
 }
 
@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned
 		return;
 	}
 
-	speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+	if (speakup_tty->ops->tiocmset)
+		speakup_tty->ops->tiocmset(speakup_tty, set, clear);
 	mutex_unlock(&speakup_tty_mutex);
 }
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 336/352] scsi: sd_zbc: Fix zone information messages
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (334 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 335/352] staging: speakup: fix tty-operation NULL derefs Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 337/352] scsi: cxlflash: Prevent deadlock when adapter probe fails Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Martin K. Petersen

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Damien Le Moal <damien.lemoal@wdc.com>

commit 88fc41c407158a7d2eaa4b2f7cfa289749d456c6 upstream.

Commit bf5054569653 ("block: Introduce blk_revalidate_disk_zones()")
inadvertently broke the message output of sd_zbc_print_zones() because the
zone information initialization of the scsi disk structure was moved to the
second scan run while sd_zbc_print_zones() is called on the first
scan. This leads to the following incorrect message to be printed for any
ZBC or ZAC zoned disks.

"...[sdX] 4294967295 zones of 0 logical blocks + 1 runt zone"

Fix this by initializing sdkp zone size and number of zones early on the
first scan. This does not impact the execution of
blk_revalidate_zones(). This functions is still called only once the block
device capacity is set on the second revalidate run on boot, or if the disk
zone configuration changed (i.e. the disk changed).

Fixes: bf5054569653 ("block: Introduce blk_revalidate_disk_zones()")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sd_zbc.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -462,12 +462,16 @@ int sd_zbc_read_zones(struct scsi_disk *
 	sdkp->device->use_10_for_rw = 0;
 
 	/*
-	 * If something changed, revalidate the disk zone bitmaps once we have
-	 * the capacity, that is on the second revalidate execution during disk
-	 * scan and always during normal revalidate.
+	 * Revalidate the disk zone bitmaps once the block device capacity is
+	 * set on the second revalidate execution during disk scan and if
+	 * something changed when executing a normal revalidate.
 	 */
-	if (sdkp->first_scan)
+	if (sdkp->first_scan) {
+		sdkp->zone_blocks = zone_blocks;
+		sdkp->nr_zones = nr_zones;
 		return 0;
+	}
+
 	if (sdkp->zone_blocks != zone_blocks ||
 	    sdkp->nr_zones != nr_zones ||
 	    disk->queue->nr_zones != nr_zones) {



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 337/352] scsi: cxlflash: Prevent deadlock when adapter probe fails
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (335 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 336/352] scsi: sd_zbc: Fix zone information messages Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 338/352] scsi: aic94xx: fix module loading Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vaibhav Jain, Martin K. Petersen

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vaibhav Jain <vaibhav@linux.ibm.com>

commit bb61b843ffd46978d7ca5095453e572714934eeb upstream.

Presently when an error is encountered during probe of the cxlflash
adapter, a deadlock is seen with cpu thread stuck inside
cxlflash_remove(). Below is the trace of the deadlock as logged by
khungtaskd:

cxlflash 0006:00:00.0: cxlflash_probe: init_afu failed rc=-16
INFO: task kworker/80:1:890 blocked for more than 120 seconds.
       Not tainted 5.0.0-rc4-capi2-kexec+ #2
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/80:1    D    0   890      2 0x00000808
Workqueue: events work_for_cpu_fn

Call Trace:
 0x4d72136320 (unreliable)
 __switch_to+0x2cc/0x460
 __schedule+0x2bc/0xac0
 schedule+0x40/0xb0
 cxlflash_remove+0xec/0x640 [cxlflash]
 cxlflash_probe+0x370/0x8f0 [cxlflash]
 local_pci_probe+0x6c/0x140
 work_for_cpu_fn+0x38/0x60
 process_one_work+0x260/0x530
 worker_thread+0x280/0x5d0
 kthread+0x1a8/0x1b0
 ret_from_kernel_thread+0x5c/0x80
INFO: task systemd-udevd:5160 blocked for more than 120 seconds.

The deadlock occurs as cxlflash_remove() is called from cxlflash_probe()
without setting 'cxlflash_cfg->state' to STATE_PROBED and the probe thread
starts to wait on 'cxlflash_cfg->reset_waitq'. Since the device was never
successfully probed the 'cxlflash_cfg->state' never changes from
STATE_PROBING hence the deadlock occurs.

We fix this deadlock by setting the variable 'cxlflash_cfg->state' to
STATE_PROBED in case an error occurs during cxlflash_probe() and just
before calling cxlflash_remove().

Cc: stable@vger.kernel.org
Fixes: c21e0bbfc485("cxlflash: Base support for IBM CXL Flash Adapter")
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/cxlflash/main.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -3694,6 +3694,7 @@ static int cxlflash_probe(struct pci_dev
 	host->max_cmd_len = CXLFLASH_MAX_CDB_LEN;
 
 	cfg = shost_priv(host);
+	cfg->state = STATE_PROBING;
 	cfg->host = host;
 	rc = alloc_mem(cfg);
 	if (rc) {
@@ -3782,6 +3783,7 @@ out:
 	return rc;
 
 out_remove:
+	cfg->state = STATE_PROBED;
 	cxlflash_remove(pdev);
 	goto out;
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 338/352] scsi: aic94xx: fix module loading
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (336 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 337/352] scsi: cxlflash: Prevent deadlock when adapter probe fails Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 339/352] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Bottomley, Martin K. Petersen

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 42caa0edabd6a0a392ec36a5f0943924e4954311 upstream.

The aic94xx driver is currently failing to load with errors like

sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/0000:02:00.3/0000:07:02.0/revision'

Because the PCI code had recently added a file named 'revision' to every
PCI device.  Fix this by renaming the aic94xx revision file to
aic_revision.  This is safe to do for us because as far as I can tell,
there's nothing in userspace relying on the current aic94xx revision file
so it can be renamed without breaking anything.

Fixes: 702ed3be1b1b (PCI: Create revision file in sysfs)
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/aic94xx/aic94xx_init.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -281,7 +281,7 @@ static ssize_t asd_show_dev_rev(struct d
 	return snprintf(buf, PAGE_SIZE, "%s\n",
 			asd_dev_rev[asd_ha->revision_id]);
 }
-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
+static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
 
 static ssize_t asd_show_dev_bios_build(struct device *dev,
 				       struct device_attribute *attr,char *buf)
@@ -478,7 +478,7 @@ static int asd_create_dev_attrs(struct a
 {
 	int err;
 
-	err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+	err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
 	if (err)
 		return err;
 
@@ -500,13 +500,13 @@ err_update_bios:
 err_biosb:
 	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
 err_rev:
-	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
 	return err;
 }
 
 static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
 {
-	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
 	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
 	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
 	device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 339/352] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (337 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 338/352] scsi: aic94xx: fix module loading Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 340/352] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felix Wilhelm, stable, Paolo Bonzini

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <pbonzini@redhat.com>

commit 353c0956a618a07ba4bbe7ad00ff29fe70e8412a upstream.

Bugzilla: 1671930

Emulation of certain instructions (VMXON, VMCLEAR, VMPTRLD, VMWRITE with
memory operand, INVEPT, INVVPID) can incorrectly inject a page fault
when passed an operand that points to an MMIO address.  The page fault
will use uninitialized kernel stack memory as the CR2 and error code.

The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR
exit to userspace; however, it is not an easy fix, so for now just
ensure that the error code and CR2 are zero.

Embargoed until Feb 7th 2019.

Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/x86.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5041,6 +5041,13 @@ int kvm_read_guest_virt(struct kvm_vcpu
 {
 	u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
 
+	/*
+	 * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+	 * is returned, but our callers are not ready for that and they blindly
+	 * call kvm_inject_page_fault.  Ensure that they at least do not leak
+	 * uninitialized kernel stack memory into cr2 and error code.
+	 */
+	memset(exception, 0, sizeof(*exception));
 	return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
 					  exception);
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 340/352] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (338 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 339/352] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 341/352] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, stable, Jann Horn, Paolo Bonzini

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jannh@google.com>

commit cfa39381173d5f969daf43582c95ad679189cbc9 upstream.

kvm_ioctl_create_device() does the following:

1. creates a device that holds a reference to the VM object (with a borrowed
   reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
   reference

The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.

This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.

Fixes: 852b6d57dc7f ("kvm: add device control API")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 virt/kvm/kvm_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2919,8 +2919,10 @@ static int kvm_ioctl_create_device(struc
 	if (ops->init)
 		ops->init(dev);
 
+	kvm_get_kvm(kvm);
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
+		kvm_put_kvm(kvm);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
@@ -2928,7 +2930,6 @@ static int kvm_ioctl_create_device(struc
 		return ret;
 	}
 
-	kvm_get_kvm(kvm);
 	cd->fd = ret;
 	return 0;
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 341/352] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (339 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 340/352] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 342/352] cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Shier, Jim Mattson,
	Felix Wilhelm, stable, Paolo Bonzini

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Shier <pshier@google.com>

commit ecec76885bcfe3294685dc363fd1273df0d5d65f upstream.

Bugzilla: 1671904

There are multiple code paths where an hrtimer may have been started to
emulate an L1 VMX preemption timer that can result in a call to free_nested
without an intervening L2 exit where the hrtimer is normally
cancelled. Unconditionally cancel in free_nested to cover all cases.

Embargoed until Feb 7th 2019.

Signed-off-by: Peter Shier <pshier@google.com>
Reported-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Message-Id: <20181011184646.154065-1-pshier@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/vmx.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8509,6 +8509,7 @@ static void free_nested(struct kvm_vcpu
 	if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
 		return;
 
+	hrtimer_cancel(&vmx->nested.preemption_timer);
 	vmx->nested.vmxon = false;
 	vmx->nested.smm.vmxon = false;
 	free_vpid(vmx->nested.vpid02);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 342/352] cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (340 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 341/352] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 343/352] perf/x86/intel/uncore: Add Node ID mask Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Igor Mammedov, Josh Poimboeuf,
	Thomas Gleixner, Joe Mario, Jiri Kosina, Peter Zijlstra, kvm

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Josh Poimboeuf <jpoimboe@redhat.com>

commit b284909abad48b07d3071a9fc9b5692b3e64914b upstream.

With the following commit:

  73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")

... the hotplug code attempted to detect when SMT was disabled by BIOS,
in which case it reported SMT as permanently disabled.  However, that
code broke a virt hotplug scenario, where the guest is booted with only
primary CPU threads, and a sibling is brought online later.

The problem is that there doesn't seem to be a way to reliably
distinguish between the HW "SMT disabled by BIOS" case and the virt
"sibling not yet brought online" case.  So the above-mentioned commit
was a bit misguided, as it permanently disabled SMT for both cases,
preventing future virt sibling hotplugs.

Going back and reviewing the original problems which were attempted to
be solved by that commit, when SMT was disabled in BIOS:

  1) /sys/devices/system/cpu/smt/control showed "on" instead of
     "notsupported"; and

  2) vmx_vm_init() was incorrectly showing the L1TF_MSG_SMT warning.

I'd propose that we instead consider #1 above to not actually be a
problem.  Because, at least in the virt case, it's possible that SMT
wasn't disabled by BIOS and a sibling thread could be brought online
later.  So it makes sense to just always default the smt control to "on"
to allow for that possibility (assuming cpuid indicates that the CPU
supports SMT).

The real problem is #2, which has a simple fix: change vmx_vm_init() to
query the actual current SMT state -- i.e., whether any siblings are
currently online -- instead of looking at the SMT "control" sysfs value.

So fix it by:

  a) reverting the original "fix" and its followup fix:

     73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")
     bc2d8d262cba ("cpu/hotplug: Fix SMT supported evaluation")

     and

  b) changing vmx_vm_init() to query the actual current SMT state --
     instead of the sysfs control value -- to determine whether the L1TF
     warning is needed.  This also requires the 'sched_smt_present'
     variable to exported, instead of 'cpu_smt_control'.

Fixes: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")
Reported-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Joe Mario <jmario@redhat.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: kvm@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/e3a85d585da28cc333ecbc1e78ee9216e6da9396.1548794349.git.jpoimboe@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 arch/x86/kernel/cpu/bugs.c |    2 +-
 arch/x86/kvm/vmx.c         |    3 ++-
 include/linux/cpu.h        |    2 --
 kernel/cpu.c               |   33 ++++-----------------------------
 kernel/sched/fair.c        |    1 +
 kernel/smp.c               |    2 --
 6 files changed, 8 insertions(+), 35 deletions(-)

--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -69,7 +69,7 @@ void __init check_bugs(void)
 	 * identify_boot_cpu() initialized SMT support information, let the
 	 * core code know.
 	 */
-	cpu_smt_check_topology_early();
+	cpu_smt_check_topology();
 
 	if (!IS_ENABLED(CONFIG_SMP)) {
 		pr_info("CPU: ");
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -28,6 +28,7 @@
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/sched.h>
+#include <linux/sched/smt.h>
 #include <linux/moduleparam.h>
 #include <linux/mod_devicetable.h>
 #include <linux/trace_events.h>
@@ -11643,7 +11644,7 @@ static int vmx_vm_init(struct kvm *kvm)
 			 * Warn upon starting the first VM in a potentially
 			 * insecure environment.
 			 */
-			if (cpu_smt_control == CPU_SMT_ENABLED)
+			if (sched_smt_active())
 				pr_warn_once(L1TF_MSG_SMT);
 			if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
 				pr_warn_once(L1TF_MSG_L1D);
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
 #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
 extern enum cpuhp_smt_control cpu_smt_control;
 extern void cpu_smt_disable(bool force);
-extern void cpu_smt_check_topology_early(void);
 extern void cpu_smt_check_topology(void);
 #else
 # define cpu_smt_control		(CPU_SMT_ENABLED)
 static inline void cpu_smt_disable(bool force) { }
-static inline void cpu_smt_check_topology_early(void) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif
 
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -376,9 +376,6 @@ void __weak arch_smt_update(void) { }
 
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-EXPORT_SYMBOL_GPL(cpu_smt_control);
-
-static bool cpu_smt_available __read_mostly;
 
 void __init cpu_smt_disable(bool force)
 {
@@ -397,25 +394,11 @@ void __init cpu_smt_disable(bool force)
 
 /*
  * The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code before non boot CPUs
- * are brought up.
- */
-void __init cpu_smt_check_topology_early(void)
-{
-	if (!topology_smt_supported())
-		cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-}
-
-/*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
- * brought online. This ensures the smt/l1tf sysfs entries are consistent
- * with reality. cpu_smt_available is set to true during the bringup of non
- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
- * cpu_smt_control's previous setting.
+ * CPU identification. Called from architecture code.
  */
 void __init cpu_smt_check_topology(void)
 {
-	if (!cpu_smt_available)
+	if (!topology_smt_supported())
 		cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
 }
 
@@ -428,18 +411,10 @@ early_param("nosmt", smt_cmdline_disable
 
 static inline bool cpu_smt_allowed(unsigned int cpu)
 {
-	if (topology_is_primary_thread(cpu))
+	if (cpu_smt_control == CPU_SMT_ENABLED)
 		return true;
 
-	/*
-	 * If the CPU is not a 'primary' thread and the booted_once bit is
-	 * set then the processor has SMT support. Store this information
-	 * for the late check of SMT support in cpu_smt_check_topology().
-	 */
-	if (per_cpu(cpuhp_state, cpu).booted_once)
-		cpu_smt_available = true;
-
-	if (cpu_smt_control == CPU_SMT_ENABLED)
+	if (topology_is_primary_thread(cpu))
 		return true;
 
 	/*
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5934,6 +5934,7 @@ static inline int find_idlest_cpu(struct
 
 #ifdef CONFIG_SCHED_SMT
 DEFINE_STATIC_KEY_FALSE(sched_smt_present);
+EXPORT_SYMBOL_GPL(sched_smt_present);
 
 static inline void set_idle_cores(int cpu, int val)
 {
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -584,8 +584,6 @@ void __init smp_init(void)
 		num_nodes, (num_nodes > 1 ? "s" : ""),
 		num_cpus,  (num_cpus  > 1 ? "s" : ""));
 
-	/* Final decision about SMT support */
-	cpu_smt_check_topology();
 	/* Any cleanup work */
 	smp_cpus_done(setup_max_cpus);
 }



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 343/352] perf/x86/intel/uncore: Add Node ID mask
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (341 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 342/352] cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 344/352] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Song Liu, Kan Liang,
	Peter Zijlstra (Intel),
	Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
	Linus Torvalds, Thomas Gleixner, Ingo Molnar

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kan Liang <kan.liang@linux.intel.com>

commit 9e63a7894fd302082cf3627fe90844421a6cbe7f upstream.

Some PCI uncore PMUs cannot be registered on an 8-socket system (HPE
Superdome Flex).

To understand which Socket the PCI uncore PMUs belongs to, perf retrieves
the local Node ID of the uncore device from CPUNODEID(0xC0) of the PCI
configuration space, and the mapping between Socket ID and Node ID from
GIDNIDMAP(0xD4). The Socket ID can be calculated accordingly.

The local Node ID is only available at bit 2:0, but current code doesn't
mask it. If a BIOS doesn't clear the rest of the bits, an incorrect Node ID
will be fetched.

Filter the Node ID by adding a mask.

Reported-by: Song Liu <songliubraving@fb.com>
Tested-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org> # v3.7+
Fixes: 7c94ee2e0917 ("perf/x86: Add Intel Nehalem and Sandy Bridge-EP uncore support")
Link: https://lkml.kernel.org/r/1548600794-33162-1-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/uncore_snbep.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -1222,6 +1222,8 @@ static struct pci_driver snbep_uncore_pc
 	.id_table	= snbep_uncore_pci_ids,
 };
 
+#define NODE_ID_MASK	0x7
+
 /*
  * build pci bus to socket mapping
  */
@@ -1243,7 +1245,7 @@ static int snbep_pci2phy_map_init(int de
 		err = pci_read_config_dword(ubox_dev, nodeid_loc, &config);
 		if (err)
 			break;
-		nodeid = config;
+		nodeid = config & NODE_ID_MASK;
 		/* get the Node ID mapping */
 		err = pci_read_config_dword(ubox_dev, idmap_loc, &config);
 		if (err)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 344/352] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (342 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 343/352] perf/x86/intel/uncore: Add Node ID mask Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 345/352] x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, He Zhe, Sebastian Andrzej Siewior,
	Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
	Linus Torvalds, Peter Zijlstra, Thomas Gleixner, acme, bp, hpa,
	jolsa, kan.liang, namhyung, Ingo Molnar

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 602cae04c4864bb3487dfe4c2126c8d9e7e1614a upstream.

intel_pmu_cpu_prepare() allocated memory for ->shared_regs among other
members of struct cpu_hw_events. This memory is released in
intel_pmu_cpu_dying() which is wrong. The counterpart of the
intel_pmu_cpu_prepare() callback is x86_pmu_dead_cpu().

Otherwise if the CPU fails on the UP path between CPUHP_PERF_X86_PREPARE
and CPUHP_AP_PERF_X86_STARTING then it won't release the memory but
allocate new memory on the next attempt to online the CPU (leaking the
old memory).
Also, if the CPU down path fails between CPUHP_AP_PERF_X86_STARTING and
CPUHP_PERF_X86_PREPARE then the CPU will go back online but never
allocate the memory that was released in x86_pmu_dying_cpu().

Make the memory allocation/free symmetrical in regard to the CPU hotplug
notifier by moving the deallocation to intel_pmu_cpu_dead().

This started in commit:

   a7e3ed1e47011 ("perf: Add support for supplementary event registers").

In principle the bug was introduced in v2.6.39 (!), but it will almost
certainly not backport cleanly across the big CPU hotplug rewrite between v4.7-v4.15...

[ bigeasy: Added patch description. ]
[ mingo: Added backporting guidance. ]

Reported-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> # With developer hat on
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> # With maintainer hat on
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: acme@kernel.org
Cc: bp@alien8.de
Cc: hpa@zytor.com
Cc: jolsa@kernel.org
Cc: kan.liang@linux.intel.com
Cc: namhyung@kernel.org
Cc: <stable@vger.kernel.org>
Fixes: a7e3ed1e47011 ("perf: Add support for supplementary event registers").
Link: https://lkml.kernel.org/r/20181219165350.6s3jvyxbibpvlhtq@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/core.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,6 +3559,14 @@ static void free_excl_cntrs(int cpu)
 
 static void intel_pmu_cpu_dying(int cpu)
 {
+	fini_debug_store_on_cpu(cpu);
+
+	if (x86_pmu.counter_freezing)
+		disable_counter_freeze();
+}
+
+static void intel_pmu_cpu_dead(int cpu)
+{
 	struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
 	struct intel_shared_regs *pc;
 
@@ -3570,11 +3578,6 @@ static void intel_pmu_cpu_dying(int cpu)
 	}
 
 	free_excl_cntrs(cpu);
-
-	fini_debug_store_on_cpu(cpu);
-
-	if (x86_pmu.counter_freezing)
-		disable_counter_freeze();
 }
 
 static void intel_pmu_sched_task(struct perf_event_context *ctx,
@@ -3663,6 +3666,7 @@ static __initconst const struct x86_pmu
 	.cpu_prepare		= intel_pmu_cpu_prepare,
 	.cpu_starting		= intel_pmu_cpu_starting,
 	.cpu_dying		= intel_pmu_cpu_dying,
+	.cpu_dead		= intel_pmu_cpu_dead,
 };
 
 static struct attribute *intel_pmu_attrs[];
@@ -3703,6 +3707,8 @@ static __initconst const struct x86_pmu
 	.cpu_prepare		= intel_pmu_cpu_prepare,
 	.cpu_starting		= intel_pmu_cpu_starting,
 	.cpu_dying		= intel_pmu_cpu_dying,
+	.cpu_dead		= intel_pmu_cpu_dead,
+
 	.guest_get_msrs		= intel_guest_get_msrs,
 	.sched_task		= intel_pmu_sched_task,
 };



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 345/352] x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (343 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 344/352] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 346/352] perf/core: Dont WARN() for impossible ring-buffer sizes Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Luck, Borislav Petkov,
	H. Peter Anvin, Ingo Molnar, Thomas Gleixner, Vishal Verma,
	x86-ml

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Luck <tony.luck@intel.com>

commit d28af26faa0b1daf3c692603d46bc4687c16f19e upstream.

Internal injection testing crashed with a console log that said:

  mce: [Hardware Error]: CPU 7: Machine Check Exception: f Bank 0: bd80000000100134

This caused a lot of head scratching because the MCACOD (bits 15:0) of
that status is a signature from an L1 data cache error. But Linux says
that it found it in "Bank 0", which on this model CPU only reports L1
instruction cache errors.

The answer was that Linux doesn't initialize "m->bank" in the case that
it finds a fatal error in the mce_no_way_out() pre-scan of banks. If
this was a local machine check, then this partially initialized struct
mce is being passed to mce_panic().

Fix is simple: just initialize m->bank in the case of a fatal error.

Fixes: 40c36e2741d7 ("x86/mce: Fix incorrect "Machine check from unknown source" message")
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: x86-ml <x86@kernel.org>
Cc: stable@vger.kernel.org # v4.18 Note pre-v5.0 arch/x86/kernel/cpu/mce/core.c was called arch/x86/kernel/cpu/mcheck/mce.c
Link: https://lkml.kernel.org/r/20190201003341.10638-1-tony.luck@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/mcheck/mce.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -786,6 +786,7 @@ static int mce_no_way_out(struct mce *m,
 			quirk_no_way_out(i, m, regs);
 
 		if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+			m->bank = i;
 			mce_read_aux(m, i);
 			*msg = tmp;
 			return 1;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 346/352] perf/core: Dont WARN() for impossible ring-buffer sizes
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (344 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 345/352] x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 347/352] perf tests evsel-tp-sched: Fix bitwise operator Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julien Thierry, Mark Rutland,
	Peter Zijlstra (Intel),
	Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
	Linus Torvalds, Namhyung Kim, Thomas Gleixner, Ingo Molnar

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

commit 9dff0aa95a324e262ffb03f425d00e4751f3294e upstream.

The perf tool uses /proc/sys/kernel/perf_event_mlock_kb to determine how
large its ringbuffer mmap should be. This can be configured to arbitrary
values, which can be larger than the maximum possible allocation from
kmalloc.

When this is configured to a suitably large value (e.g. thanks to the
perf fuzzer), attempting to use perf record triggers a WARN_ON_ONCE() in
__alloc_pages_nodemask():

   WARNING: CPU: 2 PID: 5666 at mm/page_alloc.c:4511 __alloc_pages_nodemask+0x3f8/0xbc8

Let's avoid this by checking that the requested allocation is possible
before calling kzalloc.

Reported-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20190110142745.25495-1-mark.rutland@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/events/ring_buffer.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -734,6 +734,9 @@ struct ring_buffer *rb_alloc(int nr_page
 	size = sizeof(struct ring_buffer);
 	size += nr_pages * sizeof(void *);
 
+	if (order_base_2(size) >= MAX_ORDER)
+		goto fail;
+
 	rb = kzalloc(size, GFP_KERNEL);
 	if (!rb)
 		goto fail;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 347/352] perf tests evsel-tp-sched: Fix bitwise operator
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (345 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 346/352] perf/core: Dont WARN() for impossible ring-buffer sizes Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 348/352] serial: fix race between flush_to_ldisc and tty_open Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Jiri Olsa,
	Alexander Shishkin, Namhyung Kim, Peter Zijlstra,
	Arnaldo Carvalho de Melo

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gustavo A. R. Silva <gustavo@embeddedor.com>

commit 489338a717a0dfbbd5a3fabccf172b78f0ac9015 upstream.

Notice that the use of the bitwise OR operator '|' always leads to true
in this particular case, which seems a bit suspicious due to the context
in which this expression is being used.

Fix this by using bitwise AND operator '&' instead.

This bug was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Fixes: 6a6cd11d4e57 ("perf test: Add test for the sched tracepoint format fields")
Link: http://lkml.kernel.org/r/20190122233439.GA5868@embeddedor
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/perf/tests/evsel-tp-sched.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -17,7 +17,7 @@ static int perf_evsel__test_field(struct
 		return -1;
 	}
 
-	is_signed = !!(field->flags | TEP_FIELD_IS_SIGNED);
+	is_signed = !!(field->flags & TEP_FIELD_IS_SIGNED);
 	if (should_be_signed && !is_signed) {
 		pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n",
 			 evsel->name, name, is_signed, should_be_signed);



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 348/352] serial: fix race between flush_to_ldisc and tty_open
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (346 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 347/352] perf tests evsel-tp-sched: Fix bitwise operator Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 349/352] serial: 8250_pci: Make PCI class test non fatal Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li RongQing, Wang Li, Zhang Yu

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fedb5760648a291e949f2380d383b5b2d2749b5e upstream.

There still is a race window after the commit b027e2298bd588
("tty: fix data race between tty_init_dev and flush of buf"),
and we encountered this crash issue if receive_buf call comes
before tty initialization completes in tty_open and
tty->driver_data may be NULL.

CPU0                                    CPU1
----                                    ----
                                  tty_open
                                   tty_init_dev
                                     tty_ldisc_unlock
                                       schedule
flush_to_ldisc
 receive_buf
  tty_port_default_receive_buf
   tty_ldisc_receive_buf
    n_tty_receive_buf_common
      __receive_buf
       uart_flush_chars
        uart_start
        /*tty->driver_data is NULL*/
                                   tty->ops->open
                                   /*init tty->driver_data*/

it can be fixed by extending ldisc semaphore lock in tty_init_dev
to driver_data initialized completely after tty->ops->open(), but
this will lead to get lock on one function and unlock in some other
function, and hard to maintain, so fix this race only by checking
tty->driver_data when receiving, and return if tty->driver_data
is NULL, and n_tty_receive_buf_common maybe calls uart_unthrottle,
so add the same check.

Because the tty layer knows nothing about the driver associated with the
device, the tty layer can not do anything here, it is up to the tty
driver itself to check for this type of race.  Fix up the serial driver
to correctly check to see if it is finished binding with the device when
being called, and if not, abort the tty calls.

[Description and problem report and testing from Li RongQing, I rewrote
the patch to be in the serial layer, not in the tty core - gregkh]

Reported-by: Li RongQing <lirongqing@baidu.com>
Tested-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Wang Li <wangli39@baidu.com>
Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/serial_core.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -130,6 +130,9 @@ static void uart_start(struct tty_struct
 	struct uart_port *port;
 	unsigned long flags;
 
+	if (!state)
+		return;
+
 	port = uart_port_lock(state, flags);
 	__uart_start(tty);
 	uart_port_unlock(port, flags);
@@ -727,6 +730,9 @@ static void uart_unthrottle(struct tty_s
 	upstat_t mask = UPSTAT_SYNC_FIFO;
 	struct uart_port *port;
 
+	if (!state)
+		return;
+
 	port = uart_port_ref(state);
 	if (!port)
 		return;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 349/352] serial: 8250_pci: Make PCI class test non fatal
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (347 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 348/352] serial: fix race between flush_to_ldisc and tty_open Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 350/352] serial: sh-sci: Do not free irqs that have already been freed Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guan Yung Tseng, KHUENY.Gerhard,
	Andy Shevchenko

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 824d17c57b0abbcb9128fb3f7327fae14761914b upstream.

As has been reported the National Instruments serial cards have broken
PCI class.

The commit 7d8905d06405

  ("serial: 8250_pci: Enable device after we check black list")

made the PCI class check mandatory for the case when device is listed in
a quirk list.

Make PCI class test non fatal to allow broken card be enumerated.

Fixes: 7d8905d06405 ("serial: 8250_pci: Enable device after we check black list")
Cc: stable <stable@vger.kernel.org>
Reported-by: Guan Yung Tseng <guan.yung.tseng@ni.com>
Tested-by: Guan Yung Tseng <guan.yung.tseng@ni.com>
Tested-by: KHUENY.Gerhard <Gerhard.KHUENY@bachmann.info>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/8250/8250_pci.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3420,6 +3420,11 @@ static int
 serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
 	int num_iomem, num_port, first_port = -1, i;
+	int rc;
+
+	rc = serial_pci_is_class_communication(dev);
+	if (rc)
+		return rc;
 
 	/*
 	 * Should we try to make guesses for multiport serial devices later?
@@ -3647,10 +3652,6 @@ pciserial_init_one(struct pci_dev *dev,
 
 	board = &pci_boards[ent->driver_data];
 
-	rc = serial_pci_is_class_communication(dev);
-	if (rc)
-		return rc;
-
 	rc = serial_pci_is_blacklisted(dev);
 	if (rc)
 		return rc;



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 350/352] serial: sh-sci: Do not free irqs that have already been freed
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (348 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 349/352] serial: 8250_pci: Make PCI class test non fatal Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 351/352] cacheinfo: Keep the old value if of_property_read_u32 fails Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Brandt

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Brandt <chris.brandt@renesas.com>

commit 4d95987a32db53f3beca76f8c4c8309ef6a5f192 upstream.

Since IRQs might be muxed on some parts, we need to pay attention when we
are freeing them.
Otherwise we get the ugly WARNING "Trying to free already-free IRQ 20".

Fixes: 628c534ae735 ("serial: sh-sci: Improve support for separate TEI and DRI interrupts")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/sh-sci.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1921,7 +1921,7 @@ out_nomem:
 
 static void sci_free_irq(struct sci_port *port)
 {
-	int i;
+	int i, j;
 
 	/*
 	 * Intentionally in reverse order so we iterate over the muxed
@@ -1937,6 +1937,13 @@ static void sci_free_irq(struct sci_port
 		if (unlikely(irq < 0))
 			continue;
 
+		/* Check if already freed (irq was muxed) */
+		for (j = 0; j < i; j++)
+			if (port->irqs[j] == irq)
+				j = i + 1;
+		if (j > i)
+			continue;
+
 		free_irq(port->irqs[i], port);
 		kfree(port->irqstr[i]);
 



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 351/352] cacheinfo: Keep the old value if of_property_read_u32 fails
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (349 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 350/352] serial: sh-sci: Do not free irqs that have already been freed Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-11 14:19 ` [PATCH 4.20 352/352] nfsd: Fix error return values for nfsd4_clone_file_range() Greg Kroah-Hartman
                   ` (3 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Huacai Chen, Sudeep Holla

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huacai Chen <chenhc@lemote.com>

commit 3a34c986324c07dde32903f7bb262e6138e77c2a upstream.

Commit 448a5a552f336bd7b847b1951 ("drivers: base: cacheinfo: use OF
property_read_u32 instead of get_property,read_number") makes cache
size and number_of_sets be 0 if DT doesn't provide there values. I
think this is unreasonable so make them keep the old values, which is
the same as old kernels.

Fixes: 448a5a552f33 ("drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number")
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/cacheinfo.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo
 	ct_idx = get_cacheinfo_idx(this_leaf->type);
 	propname = cache_type_info[ct_idx].size_prop;
 
-	if (of_property_read_u32(np, propname, &this_leaf->size))
-		this_leaf->size = 0;
+	of_property_read_u32(np, propname, &this_leaf->size);
 }
 
 /* not cache_line_size() because that's a macro in include/linux/cache.h */
@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cachein
 	ct_idx = get_cacheinfo_idx(this_leaf->type);
 	propname = cache_type_info[ct_idx].nr_sets_prop;
 
-	if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
-		this_leaf->number_of_sets = 0;
+	of_property_read_u32(np, propname, &this_leaf->number_of_sets);
 }
 
 static void cache_associativity(struct cacheinfo *this_leaf)



^ permalink raw reply	[flat|nested] 380+ messages in thread

* [PATCH 4.20 352/352] nfsd: Fix error return values for nfsd4_clone_file_range()
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (350 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 351/352] cacheinfo: Keep the old value if of_property_read_u32 fails Greg Kroah-Hartman
@ 2019-02-11 14:19 ` Greg Kroah-Hartman
  2019-02-12 15:40 ` [PATCH 4.20 000/352] 4.20.8-stable review shuah
                   ` (2 subsequent siblings)
  354 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 14:19 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, J. Bruce Fields

4.20-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trondmy@gmail.com>

commit e3fdc89ca47ef34dfb6fd5101fec084c3dba5486 upstream.

If the parameter 'count' is non-zero, nfsd4_clone_file_range() will
currently clobber all errors returned by vfs_clone_file_range() and
replace them with EINVAL.

Fixes: 42ec3d4c0218 ("vfs: make remap_file_range functions take and...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: stable@vger.kernel.org # v4.20+
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/vfs.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -544,9 +544,11 @@ __be32 nfsd4_clone_file_range(struct fil
 	loff_t cloned;
 
 	cloned = vfs_clone_file_range(src, src_pos, dst, dst_pos, count, 0);
+	if (cloned < 0)
+		return nfserrno(cloned);
 	if (count && cloned != count)
-		cloned = -EINVAL;
-	return nfserrno(cloned < 0 ? cloned : 0);
+		return nfserrno(-EINVAL);
+	return 0;
 }
 
 ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst,



^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init
  2019-02-11 14:17 ` [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init Greg Kroah-Hartman
@ 2019-02-11 14:34   ` Christian Borntraeger
  2019-02-11 16:53     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Christian Borntraeger @ 2019-02-11 14:34 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: stable, Michael Mueller, Cornelia Huck, Pierre Morel,
	David Hildenbrand, Sasha Levin


On 11.02.2019 15:17, Greg Kroah-Hartman wrote:
> 4.20-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> [ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
> 
> Make sure the debug feature and its allocated resources get
> released upon unsuccessful architecture initialization.
> 
> A related indication of the issue will be reported as kernel
> message.
> 
> Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
> Reviewed-by: David Hildenbrand <david@redhat.com>
> Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>

It does not hurt, but I explicitly did not cc stable for this patch as 
kvm_register_device_ops only fails in case of a code error.


> ---
>  arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> index fe24150ff666..d8d8e0788157 100644
> --- a/arch/s390/kvm/kvm-s390.c
> +++ b/arch/s390/kvm/kvm-s390.c
> @@ -417,19 +417,30 @@ static void kvm_s390_cpu_feat_init(void)
>  
>  int kvm_arch_init(void *opaque)
>  {
> +	int rc;
> +
>  	kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
>  	if (!kvm_s390_dbf)
>  		return -ENOMEM;
>  
>  	if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
> -		debug_unregister(kvm_s390_dbf);
> -		return -ENOMEM;
> +		rc = -ENOMEM;
> +		goto out_debug_unreg;
>  	}
>  
>  	kvm_s390_cpu_feat_init();
>  
>  	/* Register floating interrupt controller interface. */
> -	return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
> +	rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
> +	if (rc) {
> +		pr_err("Failed to register FLIC rc=%d\n", rc);
> +		goto out_debug_unreg;
> +	}
> +	return 0;
> +
> +out_debug_unreg:
> +	debug_unregister(kvm_s390_dbf);
> +	return rc;
>  }
>  
>  void kvm_arch_exit(void)
> 


^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply
  2019-02-11 14:14 ` [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply Greg Kroah-Hartman
@ 2019-02-11 14:39   ` Mark Brown
  2019-02-11 16:50     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Mark Brown @ 2019-02-11 14:39 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 440 bytes --]

On Mon, Feb 11, 2019 at 03:14:53PM +0100, Greg Kroah-Hartman wrote:

> On the Allwinner A64 SoCs, the audio codec has a built-in headphone
> amplifier. This amplifier has a power supply separate from the rest of
> the analog audio circuitry, labeled cpvdd.

> This patch adds a DAPM widget for this supply, and ties it to the
> headphone amp widget.

This is more a new feature than a bug fix, it doesn't look like obvious
stable material.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle
  2019-02-11 14:16 ` [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle Greg Kroah-Hartman
@ 2019-02-11 14:49   ` Steven Rostedt
  2019-02-11 16:55     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Steven Rostedt @ 2019-02-11 14:49 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Dan Carpenter, Sasha Levin

On Mon, 11 Feb 2019 15:16:05 +0100
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> 4.20-stable review patch.  If anyone has any objections, please let me know.
> 

This is not a bug fix and was not meant for stable. Please do not apply.

-- Steve

> ------------------
> 
> [ Upstream commit ca16b0fbb05242f18da9d810c07d3882ffed831c ]
> 
> Dan Carpenter reviewed the trace_stack.c code and figured he found an off by
> one bug.
> 
>  "From reviewing the code, it seems possible for
>   stack_trace_max.nr_entries to be set to .max_entries and in that case we
>   would be reading one element beyond the end of the stack_dump_trace[]
>   array.  If it's not set to .max_entries then the bug doesn't affect
>   runtime."
> 
> Although it looks to be the case, it is not. Because we have:
> 
>  static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
> 	 { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };
> 
>  struct stack_trace stack_trace_max = {
> 	.max_entries		= STACK_TRACE_ENTRIES - 1,
> 	.entries		= &stack_dump_trace[0],
>  };
> 
> And:
> 
> 	stack_trace_max.nr_entries = x;
> 	for (; x < i; x++)
> 		stack_dump_trace[x] = ULONG_MAX;
> 
> Even if nr_entries equals max_entries, indexing with it into the
> stack_dump_trace[] array will not overflow the array. But if it is the case,
> the second part of the conditional that tests stack_dump_trace[nr_entries]
> to ULONG_MAX will always be true.
> 
> By applying Dan's patch, it removes the subtle aspect of it and makes the if
> conditional slightly more efficient.
> 
> Link: http://lkml.kernel.org/r/20180620110758.crunhd5bfep7zuiz@kili.mountain
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  kernel/trace/trace_stack.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
> index 2b0d1ee3241c..e2a153fc1afc 100644
> --- a/kernel/trace/trace_stack.c
> +++ b/kernel/trace/trace_stack.c
> @@ -286,7 +286,7 @@ __next(struct seq_file *m, loff_t *pos)
>  {
>  	long n = *pos - 1;
>  
> -	if (n > stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
> +	if (n >= stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
>  		return NULL;
>  
>  	m->private = (void *)n;


^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack
  2019-02-11 14:14 ` [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack Greg Kroah-Hartman
@ 2019-02-11 15:48   ` Koen Vandeputte
  2019-02-11 17:02     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Koen Vandeputte @ 2019-02-11 15:48 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: stable, Lorenzo Bianconi, Kalle Valo, Sasha Levin


On 11.02.19 15:14, Greg Kroah-Hartman wrote:
> 4.20-stable review patch.  If anyone has any objections, please let me know.
>
> ------------------
>
> [ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ]
>
> In order to properly support dynack in ad-hoc mode running
> wpa_supplicant, take into account authentication frames for
> 'late ack' detection. This patch has been tested on devices
> mounted on offshore high-voltage stations connected through
> ~24Km link
>
> Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
> Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>   drivers/net/wireless/ath/ath9k/dynack.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
> index 7334c9b09e82..cc0dc966c512 100644
> --- a/drivers/net/wireless/ath/ath9k/dynack.c
> +++ b/drivers/net/wireless/ath/ath9k/dynack.c
> @@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
>   	/* late ACK */
>   	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
>   		if (ieee80211_is_assoc_req(hdr->frame_control) ||
> -		    ieee80211_is_assoc_resp(hdr->frame_control)) {
> +		    ieee80211_is_assoc_resp(hdr->frame_control) ||
> +		    ieee80211_is_auth(hdr->frame_control)) {
>   			ath_dbg(common, DYNACK, "late ack\n");
>   			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
>   			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);

Dear Greg,

No idea if this is the proper location to report this or if I should 
inform stable@vger.. , but:

This backport alone is useless without backporting following 2 commits 
below also, unless the 2 wifi devices using dynack start off at very 
close distance.

Their commits messages indicate them as improvements, but they should be 
considered as fixes.


https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=0c60c490830a1a756c80f8de8d33d9c6359d4a36

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=9d3d65a91f027b8a9af5e63752d9b78cb10eb92d


It's safe to add them to all stables involved (4.20, 4.19, 4.14, 4.9)

Thanks,

Koen


^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply
  2019-02-11 14:39   ` Mark Brown
@ 2019-02-11 16:50     ` Greg Kroah-Hartman
  2019-02-11 16:58       ` Mark Brown
  0 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 16:50 UTC (permalink / raw)
  To: Mark Brown; +Cc: linux-kernel, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

On Mon, Feb 11, 2019 at 02:39:24PM +0000, Mark Brown wrote:
> On Mon, Feb 11, 2019 at 03:14:53PM +0100, Greg Kroah-Hartman wrote:
> 
> > On the Allwinner A64 SoCs, the audio codec has a built-in headphone
> > amplifier. This amplifier has a power supply separate from the rest of
> > the analog audio circuitry, labeled cpvdd.
> 
> > This patch adds a DAPM widget for this supply, and ties it to the
> > headphone amp widget.
> 
> This is more a new feature than a bug fix, it doesn't look like obvious
> stable material.

Normally we take "new quirks and device ids", and given that this is a
tiny 2 line patch, that seems to fit that requirement.

If not, I'll be glad to drop it, it's your call.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init
  2019-02-11 14:34   ` Christian Borntraeger
@ 2019-02-11 16:53     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 16:53 UTC (permalink / raw)
  To: Christian Borntraeger
  Cc: linux-kernel, stable, Michael Mueller, Cornelia Huck,
	Pierre Morel, David Hildenbrand, Sasha Levin

On Mon, Feb 11, 2019 at 03:34:20PM +0100, Christian Borntraeger wrote:
> 
> On 11.02.2019 15:17, Greg Kroah-Hartman wrote:
> > 4.20-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > [ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
> > 
> > Make sure the debug feature and its allocated resources get
> > released upon unsuccessful architecture initialization.
> > 
> > A related indication of the issue will be reported as kernel
> > message.
> > 
> > Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
> > Reviewed-by: Cornelia Huck <cohuck@redhat.com>
> > Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
> > Reviewed-by: David Hildenbrand <david@redhat.com>
> > Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
> > Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> It does not hurt, but I explicitly did not cc stable for this patch as 
> kvm_register_device_ops only fails in case of a code error.

Fair enough, I've dropped it from all trees now, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle
  2019-02-11 14:49   ` Steven Rostedt
@ 2019-02-11 16:55     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 16:55 UTC (permalink / raw)
  To: Steven Rostedt; +Cc: linux-kernel, stable, Dan Carpenter, Sasha Levin

On Mon, Feb 11, 2019 at 09:49:07AM -0500, Steven Rostedt wrote:
> On Mon, 11 Feb 2019 15:16:05 +0100
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
> > 4.20-stable review patch.  If anyone has any objections, please let me know.
> > 
> 
> This is not a bug fix and was not meant for stable. Please do not apply.

Thanks for letting me know, now dropped from all queues.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply
  2019-02-11 16:50     ` Greg Kroah-Hartman
@ 2019-02-11 16:58       ` Mark Brown
  2019-02-11 17:12         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Mark Brown @ 2019-02-11 16:58 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 694 bytes --]

On Mon, Feb 11, 2019 at 05:50:08PM +0100, Greg Kroah-Hartman wrote:
> On Mon, Feb 11, 2019 at 02:39:24PM +0000, Mark Brown wrote:

> > This is more a new feature than a bug fix, it doesn't look like obvious
> > stable material.

> Normally we take "new quirks and device ids", and given that this is a
> tiny 2 line patch, that seems to fit that requirement.

It's definitely not a quirk, it's changing from completely ignoring a
supply to actively managing it at runtime which if it has any effect on
existing systems is more likely to break something than fix it.  It's
not like the fixes for build problems which can't be triggered in old
kernels, it'll start us things we never used to do.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack
  2019-02-11 15:48   ` Koen Vandeputte
@ 2019-02-11 17:02     ` Greg Kroah-Hartman
  2019-02-12  9:40       ` Koen Vandeputte
  0 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 17:02 UTC (permalink / raw)
  To: Koen Vandeputte
  Cc: linux-kernel, stable, Lorenzo Bianconi, Kalle Valo, Sasha Levin

On Mon, Feb 11, 2019 at 04:48:30PM +0100, Koen Vandeputte wrote:
> 
> On 11.02.19 15:14, Greg Kroah-Hartman wrote:
> > 4.20-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > [ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ]
> > 
> > In order to properly support dynack in ad-hoc mode running
> > wpa_supplicant, take into account authentication frames for
> > 'late ack' detection. This patch has been tested on devices
> > mounted on offshore high-voltage stations connected through
> > ~24Km link
> > 
> > Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
> > Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
> > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >   drivers/net/wireless/ath/ath9k/dynack.c | 3 ++-
> >   1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
> > index 7334c9b09e82..cc0dc966c512 100644
> > --- a/drivers/net/wireless/ath/ath9k/dynack.c
> > +++ b/drivers/net/wireless/ath/ath9k/dynack.c
> > @@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
> >   	/* late ACK */
> >   	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
> >   		if (ieee80211_is_assoc_req(hdr->frame_control) ||
> > -		    ieee80211_is_assoc_resp(hdr->frame_control)) {
> > +		    ieee80211_is_assoc_resp(hdr->frame_control) ||
> > +		    ieee80211_is_auth(hdr->frame_control)) {
> >   			ath_dbg(common, DYNACK, "late ack\n");
> >   			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
> >   			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
> 
> Dear Greg,
> 
> No idea if this is the proper location to report this or if I should inform
> stable@vger.. , but:
> 
> This backport alone is useless without backporting following 2 commits below
> also, unless the 2 wifi devices using dynack start off at very close
> distance.
> 
> Their commits messages indicate them as improvements, but they should be
> considered as fixes.
> 
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=0c60c490830a1a756c80f8de8d33d9c6359d4a36
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=9d3d65a91f027b8a9af5e63752d9b78cb10eb92d
> 
> 
> It's safe to add them to all stables involved (4.20, 4.19, 4.14, 4.9)

Thanks, that looks reasonable, now queued up.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply
  2019-02-11 16:58       ` Mark Brown
@ 2019-02-11 17:12         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-11 17:12 UTC (permalink / raw)
  To: Mark Brown; +Cc: linux-kernel, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

On Mon, Feb 11, 2019 at 04:58:39PM +0000, Mark Brown wrote:
> On Mon, Feb 11, 2019 at 05:50:08PM +0100, Greg Kroah-Hartman wrote:
> > On Mon, Feb 11, 2019 at 02:39:24PM +0000, Mark Brown wrote:
> 
> > > This is more a new feature than a bug fix, it doesn't look like obvious
> > > stable material.
> 
> > Normally we take "new quirks and device ids", and given that this is a
> > tiny 2 line patch, that seems to fit that requirement.
> 
> It's definitely not a quirk, it's changing from completely ignoring a
> supply to actively managing it at runtime which if it has any effect on
> existing systems is more likely to break something than fix it.  It's
> not like the fixes for build problems which can't be triggered in old
> kernels, it'll start us things we never used to do.

Ok, that's fair enough, now dropped.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through
  2019-02-11 14:15 ` [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through Greg Kroah-Hartman
@ 2019-02-11 20:18   ` Stephen Rothwell
  2019-02-11 20:21     ` Stephen Rothwell
  0 siblings, 1 reply; 380+ messages in thread
From: Stephen Rothwell @ 2019-02-11 20:18 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Jaegeuk Kim, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 919 bytes --]

Hi Greg,

On Mon, 11 Feb 2019 15:15:08 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> 4.20-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> [ Upstream commit f5d5510e7389fa264337fb524346bac9eb93adc8 ]
> 
> After merging the f2fs tree, today's linux-next build
>  (x86_64_allmodconfig) produced this warning:
> 
>  In file included from fs/f2fs/dir.c:11:
>  fs/f2fs/f2fs.h: In function '__mark_inode_dirty_flag':
>  fs/f2fs/f2fs.h:2388:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
>     if (set)
>        ^
>  fs/f2fs/f2fs.h:2390:2: note: here
>    case FI_DATA_EXIST:
>    ^~~~
> 
>  Exposed by my use of -Wimplicit-fallthrough

Does the 4.20 stable tree use -Wimplicit-fallthrough?  I assume not
(since v4.20 doesn't), so this warning does not happen in that tree.
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through
  2019-02-11 20:18   ` Stephen Rothwell
@ 2019-02-11 20:21     ` Stephen Rothwell
  2019-02-12  8:52       ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Stephen Rothwell @ 2019-02-11 20:21 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Jaegeuk Kim, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 307 bytes --]

Hi all,

On Tue, 12 Feb 2019 07:18:58 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Does the 4.20 stable tree use -Wimplicit-fallthrough?  I assume not
> (since v4.20 doesn't), so this warning does not happen in that tree.

Ditto for 4.19, 4.14 and 4.9.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns
  2019-02-11 14:18 ` [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns Greg Kroah-Hartman
@ 2019-02-12  1:02   ` Eric W. Biederman
  2019-02-12  6:22     ` Serge E. Hallyn
  2019-02-12  8:48     ` Greg Kroah-Hartman
  0 siblings, 2 replies; 380+ messages in thread
From: Eric W. Biederman @ 2019-02-12  1:02 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Benjamin Gordon, John Stultz, Kees Cook,
	Serge E. Hallyn, Thomas Gleixner, Arjan van de Ven, Oren Laadan,
	Ruchi Kandoi, Rom Lemarchand, Todd Kjos, Colin Cross,
	Nick Kralevich, Dmitry Shmidt, Elliott Hughes, Alexey Dobriyan,
	Andrew Morton, Linus Torvalds, Sasha Levin

Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:

> 4.20-stable review patch.  If anyone has any objections, please let me
> know.

No objection.  But I think of this as a feature addition rather than a
fix for something.  As a feature that we now allow something we
previously did not does this qualify for a backport to stable?

It is probably no more harmful in this instance than adding PCI IDs to a
driver.  So I am not worried.  I am curious the current guidelines
are.

In most cases a small relaxation of permissions like this requires a lot
of bug fixing as typically code protected by capable(CAP_XXX) has been
written and tested assuming a trusted root user.  Those bug fixes are
many times too large for a stable backport.

Eric


> ------------------
>
> [ Upstream commit 8da0b4f692c6d90b09c91f271517db746a22ff67 ]
>
> Access to timerslack_ns is controlled by a process having CAP_SYS_NICE
> in its effective capability set, but the current check looks in the root
> namespace instead of the process' user namespace.  Since a process is
> allowed to do other activities controlled by CAP_SYS_NICE inside a
> namespace, it should also be able to adjust timerslack_ns.
>
> Link: http://lkml.kernel.org/r/20181030180012.232896-1-bmgordon@google.com
> Signed-off-by: Benjamin Gordon <bmgordon@google.com>
> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
> Cc: John Stultz <john.stultz@linaro.org>
> Cc: "Eric W. Biederman" <ebiederm@xmission.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Arjan van de Ven <arjan@linux.intel.com>
> Cc: Oren Laadan <orenl@cellrox.com>
> Cc: Ruchi Kandoi <kandoiruchi@google.com>
> Cc: Rom Lemarchand <romlem@android.com>
> Cc: Todd Kjos <tkjos@google.com>
> Cc: Colin Cross <ccross@android.com>
> Cc: Nick Kralevich <nnk@google.com>
> Cc: Dmitry Shmidt <dimitrysh@google.com>
> Cc: Elliott Hughes <enh@google.com>
> Cc: Alexey Dobriyan <adobriyan@gmail.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  fs/proc/base.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index ce3465479447..98525af0953e 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -2356,10 +2356,13 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
>  		return -ESRCH;
>  
>  	if (p != current) {
> -		if (!capable(CAP_SYS_NICE)) {
> +		rcu_read_lock();
> +		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
> +			rcu_read_unlock();
>  			count = -EPERM;
>  			goto out;
>  		}
> +		rcu_read_unlock();
>  
>  		err = security_task_setscheduler(p);
>  		if (err) {
> @@ -2392,11 +2395,14 @@ static int timerslack_ns_show(struct seq_file *m, void *v)
>  		return -ESRCH;
>  
>  	if (p != current) {
> -
> -		if (!capable(CAP_SYS_NICE)) {
> +		rcu_read_lock();
> +		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
> +			rcu_read_unlock();
>  			err = -EPERM;
>  			goto out;
>  		}
> +		rcu_read_unlock();
> +
>  		err = security_task_getscheduler(p);
>  		if (err)
>  			goto out;

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns
  2019-02-12  1:02   ` Eric W. Biederman
@ 2019-02-12  6:22     ` Serge E. Hallyn
  2019-02-12  8:48     ` Greg Kroah-Hartman
  1 sibling, 0 replies; 380+ messages in thread
From: Serge E. Hallyn @ 2019-02-12  6:22 UTC (permalink / raw)
  To: Eric W. Biederman
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Benjamin Gordon,
	John Stultz, Kees Cook, Serge E. Hallyn, Thomas Gleixner,
	Arjan van de Ven, Oren Laadan, Ruchi Kandoi, Rom Lemarchand,
	Todd Kjos, Colin Cross, Nick Kralevich, Dmitry Shmidt,
	Elliott Hughes, Alexey Dobriyan, Andrew Morton, Linus Torvalds,
	Sasha Levin

On Mon, Feb 11, 2019 at 07:02:06PM -0600, Eric W. Biederman wrote:
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:
> 
> > 4.20-stable review patch.  If anyone has any objections, please let me
> > know.
> 
> No objection.  But I think of this as a feature addition rather than a
> fix for something.  As a feature that we now allow something we
> previously did not does this qualify for a backport to stable?

Hi,

I had the exact same thought when I saw this this morning, and was planning
on replying tonight.

> It is probably no more harmful in this instance than adding PCI IDs to a
> driver.  So I am not worried.  I am curious the current guidelines
> are.
> 
> In most cases a small relaxation of permissions like this requires a lot
> of bug fixing as typically code protected by capable(CAP_XXX) has been
> written and tested assuming a trusted root user.  Those bug fixes are
> many times too large for a stable backport.
> 
> Eric
> 
> 
> > ------------------
> >
> > [ Upstream commit 8da0b4f692c6d90b09c91f271517db746a22ff67 ]
> >
> > Access to timerslack_ns is controlled by a process having CAP_SYS_NICE
> > in its effective capability set, but the current check looks in the root
> > namespace instead of the process' user namespace.  Since a process is
> > allowed to do other activities controlled by CAP_SYS_NICE inside a
> > namespace, it should also be able to adjust timerslack_ns.
> >
> > Link: http://lkml.kernel.org/r/20181030180012.232896-1-bmgordon@google.com
> > Signed-off-by: Benjamin Gordon <bmgordon@google.com>
> > Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
> > Cc: John Stultz <john.stultz@linaro.org>
> > Cc: "Eric W. Biederman" <ebiederm@xmission.com>
> > Cc: Kees Cook <keescook@chromium.org>
> > Cc: "Serge E. Hallyn" <serge@hallyn.com>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Arjan van de Ven <arjan@linux.intel.com>
> > Cc: Oren Laadan <orenl@cellrox.com>
> > Cc: Ruchi Kandoi <kandoiruchi@google.com>
> > Cc: Rom Lemarchand <romlem@android.com>
> > Cc: Todd Kjos <tkjos@google.com>
> > Cc: Colin Cross <ccross@android.com>
> > Cc: Nick Kralevich <nnk@google.com>
> > Cc: Dmitry Shmidt <dimitrysh@google.com>
> > Cc: Elliott Hughes <enh@google.com>
> > Cc: Alexey Dobriyan <adobriyan@gmail.com>
> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  fs/proc/base.c | 12 +++++++++---
> >  1 file changed, 9 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/proc/base.c b/fs/proc/base.c
> > index ce3465479447..98525af0953e 100644
> > --- a/fs/proc/base.c
> > +++ b/fs/proc/base.c
> > @@ -2356,10 +2356,13 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
> >  		return -ESRCH;
> >  
> >  	if (p != current) {
> > -		if (!capable(CAP_SYS_NICE)) {
> > +		rcu_read_lock();
> > +		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
> > +			rcu_read_unlock();
> >  			count = -EPERM;
> >  			goto out;
> >  		}
> > +		rcu_read_unlock();
> >  
> >  		err = security_task_setscheduler(p);
> >  		if (err) {
> > @@ -2392,11 +2395,14 @@ static int timerslack_ns_show(struct seq_file *m, void *v)
> >  		return -ESRCH;
> >  
> >  	if (p != current) {
> > -
> > -		if (!capable(CAP_SYS_NICE)) {
> > +		rcu_read_lock();
> > +		if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
> > +			rcu_read_unlock();
> >  			err = -EPERM;
> >  			goto out;
> >  		}
> > +		rcu_read_unlock();
> > +
> >  		err = security_task_getscheduler(p);
> >  		if (err)
> >  			goto out;

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns
  2019-02-12  1:02   ` Eric W. Biederman
  2019-02-12  6:22     ` Serge E. Hallyn
@ 2019-02-12  8:48     ` Greg Kroah-Hartman
  1 sibling, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12  8:48 UTC (permalink / raw)
  To: Eric W. Biederman
  Cc: linux-kernel, stable, Benjamin Gordon, John Stultz, Kees Cook,
	Serge E. Hallyn, Thomas Gleixner, Arjan van de Ven, Oren Laadan,
	Ruchi Kandoi, Rom Lemarchand, Todd Kjos, Colin Cross,
	Nick Kralevich, Dmitry Shmidt, Elliott Hughes, Alexey Dobriyan,
	Andrew Morton, Linus Torvalds, Sasha Levin

On Mon, Feb 11, 2019 at 07:02:06PM -0600, Eric W. Biederman wrote:
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:
> 
> > 4.20-stable review patch.  If anyone has any objections, please let me
> > know.
> 
> No objection.  But I think of this as a feature addition rather than a
> fix for something.  As a feature that we now allow something we
> previously did not does this qualify for a backport to stable?
> 
> It is probably no more harmful in this instance than adding PCI IDs to a
> driver.  So I am not worried.  I am curious the current guidelines
> are.
> 
> In most cases a small relaxation of permissions like this requires a lot
> of bug fixing as typically code protected by capable(CAP_XXX) has been
> written and tested assuming a trusted root user.  Those bug fixes are
> many times too large for a stable backport.

Fair enough, patch is now dropped, thanks for the review.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through
  2019-02-11 20:21     ` Stephen Rothwell
@ 2019-02-12  8:52       ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12  8:52 UTC (permalink / raw)
  To: Stephen Rothwell; +Cc: linux-kernel, stable, Jaegeuk Kim, Sasha Levin

On Tue, Feb 12, 2019 at 07:21:00AM +1100, Stephen Rothwell wrote:
> Hi all,
> 
> On Tue, 12 Feb 2019 07:18:58 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> >
> > Does the 4.20 stable tree use -Wimplicit-fallthrough?  I assume not
> > (since v4.20 doesn't), so this warning does not happen in that tree.
> 
> Ditto for 4.19, 4.14 and 4.9.

You are right, I thought this was needed for a later patch in the
series, but it wasn't, so I'll go drop it from all trees now, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack
  2019-02-11 17:02     ` Greg Kroah-Hartman
@ 2019-02-12  9:40       ` Koen Vandeputte
  2019-02-12  9:47         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Koen Vandeputte @ 2019-02-12  9:40 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Lorenzo Bianconi, Kalle Valo, Sasha Levin


On 11.02.19 18:02, Greg Kroah-Hartman wrote:
>>
>> Dear Greg,
>>
>> No idea if this is the proper location to report this or if I should inform
>> stable@vger.. , but:
>>
>> This backport alone is useless without backporting following 2 commits below
>> also, unless the 2 wifi devices using dynack start off at very close
>> distance.
>>
>> Their commits messages indicate them as improvements, but they should be
>> considered as fixes.
>>
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=0c60c490830a1a756c80f8de8d33d9c6359d4a36
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=9d3d65a91f027b8a9af5e63752d9b78cb10eb92d
>>
>>
>> It's safe to add them to all stables involved (4.20, 4.19, 4.14, 4.9)
> Thanks, that looks reasonable, now queued up.
>
> greg k-h


Hi Greg,

Just noticed the primary dynack patch also got merged into 4.4 stable rc

Could you also apply the 2 fixes above to 4.4?


Checked older versions (< 4.4) .. and they are not required there.


Highly appreciated,

Koen


^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack
  2019-02-12  9:40       ` Koen Vandeputte
@ 2019-02-12  9:47         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12  9:47 UTC (permalink / raw)
  To: Koen Vandeputte
  Cc: linux-kernel, stable, Lorenzo Bianconi, Kalle Valo, Sasha Levin

On Tue, Feb 12, 2019 at 10:40:14AM +0100, Koen Vandeputte wrote:
> 
> On 11.02.19 18:02, Greg Kroah-Hartman wrote:
> > > 
> > > Dear Greg,
> > > 
> > > No idea if this is the proper location to report this or if I should inform
> > > stable@vger.. , but:
> > > 
> > > This backport alone is useless without backporting following 2 commits below
> > > also, unless the 2 wifi devices using dynack start off at very close
> > > distance.
> > > 
> > > Their commits messages indicate them as improvements, but they should be
> > > considered as fixes.
> > > 
> > > 
> > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=0c60c490830a1a756c80f8de8d33d9c6359d4a36
> > > 
> > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.0-rc6&id=9d3d65a91f027b8a9af5e63752d9b78cb10eb92d
> > > 
> > > 
> > > It's safe to add them to all stables involved (4.20, 4.19, 4.14, 4.9)
> > Thanks, that looks reasonable, now queued up.
> > 
> > greg k-h
> 
> 
> Hi Greg,
> 
> Just noticed the primary dynack patch also got merged into 4.4 stable rc
> 
> Could you also apply the 2 fixes above to 4.4?
> 
> 
> Checked older versions (< 4.4) .. and they are not required there.

The build breaks when the series in on 4.4, so I dropped the patches
from there, and 3.18.  If you want to send a backported series that
builds properly, I will be glad to queue that up.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (351 preceding siblings ...)
  2019-02-11 14:19 ` [PATCH 4.20 352/352] nfsd: Fix error return values for nfsd4_clone_file_range() Greg Kroah-Hartman
@ 2019-02-12 15:40 ` shuah
  2019-02-12 18:32   ` Greg Kroah-Hartman
  2019-02-12 16:25 ` Naresh Kamboju
  2019-02-12 16:41 ` Guenter Roeck
  354 siblings, 1 reply; 380+ messages in thread
From: shuah @ 2019-02-12 15:40 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
	stable, shuah

On 2/11/19 7:13 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.20.8 release.
> There are 352 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (352 preceding siblings ...)
  2019-02-12 15:40 ` [PATCH 4.20 000/352] 4.20.8-stable review shuah
@ 2019-02-12 16:25 ` Naresh Kamboju
  2019-02-12 18:38   ` Greg Kroah-Hartman
  2019-02-12 16:41 ` Guenter Roeck
  354 siblings, 1 reply; 380+ messages in thread
From: Naresh Kamboju @ 2019-02-12 16:25 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable

On Mon, 11 Feb 2019 at 19:51, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.20.8 release.
> There are 352 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 4.20.8-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.20.y
git commit: 2a1c4a78ff2929597b3ae4347873168b976cbe90
git describe: v4.20.7-351-g2a1c4a78ff29
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.20-oe/build/v4.20.7-351-g2a1c4a78ff29


No regressions (compared to build v4.20.7)

No fixes (compared to build v4.20.7)


Ran 13246 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm

Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-containers-tests
* ltp-io-tests
* ltp-hugetlb-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-sched-tests
* ltp-timers-tests
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-ipc-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* spectre-meltdown-checker-test

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
                   ` (353 preceding siblings ...)
  2019-02-12 16:25 ` Naresh Kamboju
@ 2019-02-12 16:41 ` Guenter Roeck
  2019-02-12 18:38   ` Greg Kroah-Hartman
  354 siblings, 1 reply; 380+ messages in thread
From: Guenter Roeck @ 2019-02-12 16:41 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable

On 2/11/19 6:13 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.20.8 release.
> There are 352 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> Anything received after that time might be too late.
> 

Build results:
	total: 159 pass: 159 fail: 0
Qemu test results:
	total: 343 pass: 343 fail: 0

Guenter

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-12 15:40 ` [PATCH 4.20 000/352] 4.20.8-stable review shuah
@ 2019-02-12 18:32   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12 18:32 UTC (permalink / raw)
  To: shuah
  Cc: linux-kernel, torvalds, akpm, linux, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Feb 12, 2019 at 08:40:03AM -0700, shuah wrote:
> On 2/11/19 7:13 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.20.8 release.
> > There are 352 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> 
> Compiled and booted on my test system. No dmesg regressions.

thanks for testing all of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-12 16:41 ` Guenter Roeck
@ 2019-02-12 18:38   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12 18:38 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Feb 12, 2019 at 08:41:50AM -0800, Guenter Roeck wrote:
> On 2/11/19 6:13 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.20.8 release.
> > There are 352 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 159 pass: 159 fail: 0
> Qemu test results:
> 	total: 343 pass: 343 fail: 0

Thanks for testing all of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 000/352] 4.20.8-stable review
  2019-02-12 16:25 ` Naresh Kamboju
@ 2019-02-12 18:38   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-12 18:38 UTC (permalink / raw)
  To: Naresh Kamboju
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable

On Tue, Feb 12, 2019 at 09:55:11PM +0530, Naresh Kamboju wrote:
> On Mon, 11 Feb 2019 at 19:51, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 4.20.8 release.
> > There are 352 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Feb 13 14:17:03 UTC 2019.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> >         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz
> > or in the git tree and branch at:
> >         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
> 
> Results from Linaro’s test farm.
> No regressions on arm64, arm, x86_64, and i386.
> 
> Summary
> ------------------------------------------------------------------------
> 
> kernel: 4.20.8-rc1
> git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> git branch: linux-4.20.y
> git commit: 2a1c4a78ff2929597b3ae4347873168b976cbe90
> git describe: v4.20.7-351-g2a1c4a78ff29
> Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.20-oe/build/v4.20.7-351-g2a1c4a78ff29
> 
> 
> No regressions (compared to build v4.20.7)
> 
> No fixes (compared to build v4.20.7)

Thanks for testing all of these and letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available.
  2019-02-11 14:13 ` [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available Greg Kroah-Hartman
@ 2019-02-14 13:58   ` Emil Velikov
  2019-02-14 14:19     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 380+ messages in thread
From: Emil Velikov @ 2019-02-14 13:58 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Daniel Vetter, Deepak Sharma, Sean Paul,
	Sasha Levin

Hi Greg,

On 2019/02/11, Greg Kroah-Hartman wrote:
> 4.20-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> [ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ]
> 
> Modify vgem_init to take platform dev as parent in drm_dev_init.
> This will make drm device available at "/sys/devices/platform/vgem"
> in x86 chromebook.
> 
> v2: rebase, address checkpatch typo and line over 80 characters
> 
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Signed-off-by: Deepak Sharma <deepak.sharma@amd.com>
> Reviewed-by: Sean Paul <seanpaul@chromium.org>
> Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Zero objections to picking this for stable, although I'm curious what
flagged this commit as stable material.

Especially since it's closer to a feature than a bug-fix.

Can you share some light? Perhaps a link to a thread/document since I
would imagine you've been asked before.

Thanks
Emil

^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available.
  2019-02-14 13:58   ` Emil Velikov
@ 2019-02-14 14:19     ` Greg Kroah-Hartman
  2019-02-14 15:12       ` Daniel Vetter
  0 siblings, 1 reply; 380+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-14 14:19 UTC (permalink / raw)
  To: Emil Velikov
  Cc: linux-kernel, stable, Daniel Vetter, Deepak Sharma, Sean Paul,
	Sasha Levin

On Thu, Feb 14, 2019 at 01:58:02PM +0000, Emil Velikov wrote:
> Hi Greg,
> 
> On 2019/02/11, Greg Kroah-Hartman wrote:
> > 4.20-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > [ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ]
> > 
> > Modify vgem_init to take platform dev as parent in drm_dev_init.
> > This will make drm device available at "/sys/devices/platform/vgem"
> > in x86 chromebook.
> > 
> > v2: rebase, address checkpatch typo and line over 80 characters
> > 
> > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > Signed-off-by: Deepak Sharma <deepak.sharma@amd.com>
> > Reviewed-by: Sean Paul <seanpaul@chromium.org>
> > Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
> > Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> > Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> Zero objections to picking this for stable, although I'm curious what
> flagged this commit as stable material.
> 
> Especially since it's closer to a feature than a bug-fix.
> 
> Can you share some light? Perhaps a link to a thread/document since I
> would imagine you've been asked before.

Sasha has a presentation all about how this gets picked up, but I can't
find the link right now.  Sasha?


^ permalink raw reply	[flat|nested] 380+ messages in thread

* Re: [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available.
  2019-02-14 14:19     ` Greg Kroah-Hartman
@ 2019-02-14 15:12       ` Daniel Vetter
  0 siblings, 0 replies; 380+ messages in thread
From: Daniel Vetter @ 2019-02-14 15:12 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Emil Velikov, Linux Kernel Mailing List, stable, Deepak Sharma,
	Sean Paul, Sasha Levin

On Thu, Feb 14, 2019 at 3:19 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Feb 14, 2019 at 01:58:02PM +0000, Emil Velikov wrote:
> > Hi Greg,
> >
> > On 2019/02/11, Greg Kroah-Hartman wrote:
> > > 4.20-stable review patch.  If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > [ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ]
> > >
> > > Modify vgem_init to take platform dev as parent in drm_dev_init.
> > > This will make drm device available at "/sys/devices/platform/vgem"
> > > in x86 chromebook.
> > >
> > > v2: rebase, address checkpatch typo and line over 80 characters
> > >
> > > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > > Signed-off-by: Deepak Sharma <deepak.sharma@amd.com>
> > > Reviewed-by: Sean Paul <seanpaul@chromium.org>
> > > Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
> > > Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> > > Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com
> > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> >
> > Zero objections to picking this for stable, although I'm curious what
> > flagged this commit as stable material.
> >
> > Especially since it's closer to a feature than a bug-fix.
> >
> > Can you share some light? Perhaps a link to a thread/document since I
> > would imagine you've been asked before.
>
> Sasha has a presentation all about how this gets picked up, but I can't
> find the link right now.  Sasha?

https://lwn.net/Articles/764647/

Afaiui the autoselected patches do get posted to dri-devel. At least I
see some mails show up there.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch

^ permalink raw reply	[flat|nested] 380+ messages in thread

end of thread, other threads:[~2019-02-14 15:12 UTC | newest]

Thread overview: 380+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-11 14:13 [PATCH 4.20 000/352] 4.20.8-stable review Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 001/352] drm/bufs: Fix Spectre v1 vulnerability Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 002/352] drm/v3d: Fix a use-after-free race accessing the schedulers fences Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 003/352] staging: iio: adc: ad7280a: handle error from __ad7280_read32() Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 004/352] drm/vgem: Fix vgem_init to get drm device available Greg Kroah-Hartman
2019-02-14 13:58   ` Emil Velikov
2019-02-14 14:19     ` Greg Kroah-Hartman
2019-02-14 15:12       ` Daniel Vetter
2019-02-11 14:13 ` [PATCH 4.20 005/352] pinctrl: bcm2835: Use raw spinlock for RT compatibility Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 006/352] clk: sunxi-ng: h6: Set video PLLs limits Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 007/352] ASoC: Intel: mrfld: fix uninitialized variable access Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 008/352] gpiolib: Fix possible use after free on label Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 009/352] drm/sun4i: Initialize registers in tcon-top driver Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 010/352] ath10k: fixup extended per sta tx statistics Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 011/352] genirq/affinity: Spread IRQs to all available NUMA nodes Greg Kroah-Hartman
2019-02-11 14:13 ` [PATCH 4.20 012/352] gpu: ipu-v3: image-convert: Prevent race between run and unprepare Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 013/352] drm/amd/display: Fix potential nullptr error Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 014/352] nds32: Fix gcc 8.0 compiler option incompatible Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 015/352] wil6210: fix reset flow for Talyn-mb Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 016/352] wil6210: fix memory leak in wil_find_tx_bcast_2 Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 017/352] ath10k: assign n_cipher_suites for WCN3990 Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 018/352] ath9k: dynack: use authentication messages for late ack Greg Kroah-Hartman
2019-02-11 15:48   ` Koen Vandeputte
2019-02-11 17:02     ` Greg Kroah-Hartman
2019-02-12  9:40       ` Koen Vandeputte
2019-02-12  9:47         ` Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 019/352] scsi: lpfc: Correct LCB RJT handling Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 020/352] scsi: mpt3sas: Call sas_remove_host before removing the target devices Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 021/352] scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 022/352] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 023/352] clk: boston: fix possible memory leak in clk_boston_setup() Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 024/352] dlm: Dont swamp the CPU with callbacks queued during recovery Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 025/352] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 026/352] powerpc/pseries: add of_node_put() in dlpar_detach_node() Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 027/352] bpftool: Improve handling of ENOENT on map dumps Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 028/352] s390/qeth: utilize virtual MAC for Layer2 OSD devices Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 029/352] crypto: aes_ti - disable interrupts while accessing S-box Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 030/352] drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 031/352] serial: fsl_lpuart: clear parity enable bit when disable parity Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 032/352] ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 033/352] MIPS: Boston: Disable EG20T prefetch Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 034/352] dpaa2-ptp: defer probe when portal allocation failed Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 035/352] iwlwifi: fw: do not set sgi bits for HE connection Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 036/352] staging:iio:ad2s90: Make probe handle spi_setup failure Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 037/352] fpga: altera-cvp: Fix registration for CvP incapable devices Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 038/352] Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1 Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 039/352] fpga: altera-cvp: fix bad IO access on x86_64 Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 040/352] vbox: fix link error with gcc -Og Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 041/352] platform/chrome: dont report EC_MKBP_EVENT_SENSOR_FIFO as wakeup Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 042/352] i40e: suppress bogus error message Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 043/352] i40e: prevent overlapping tx_timeout recover Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 044/352] scsi: hisi_sas: change the time of SAS SSP connection Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 045/352] staging: iio: ad7780: update voltage on read Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 046/352] usbnet: smsc95xx: fix rx packet alignment Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 047/352] drm/rockchip: fix for mailbox read size Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 048/352] ARM: OMAP2+: hwmod: Fix some section annotations Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 049/352] drm/amd/display: fix gamma not being applied correctly Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 050/352] drm/amd/display: calculate stream->phy_pix_clk before clock mapping Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 051/352] bpf: libbpf: retry map creation without the name Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 052/352] net/mlx5: EQ, Use the right place to store/read IRQ affinity hint Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 053/352] modpost: validate symbol names also in find_elf_symbol Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 054/352] perf tools: Add Hygon Dhyana support Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 055/352] scsi: cxgb4i: fix thermal configuration dependencies Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 056/352] soc/tegra: Dont leak device tree node reference Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 057/352] media: rc: ensure close() is called on rc_unregister_device Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 058/352] media: video-i2c: avoid accessing released memory area when removing driver Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 059/352] media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 060/352] staging: erofs: fix the definition of DBG_BUGON Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 061/352] staging: erofs: fix race when the managed cache is enabled Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 062/352] x86/resctrl: Fixup the user-visible strings Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 063/352] media: vivid: fill in media_device bus_info Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 064/352] RDMA/core: Sync unregistration with netlink commands Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 065/352] drm: rcar-du: Fix external clock error checks Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 066/352] ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply Greg Kroah-Hartman
2019-02-11 14:39   ` Mark Brown
2019-02-11 16:50     ` Greg Kroah-Hartman
2019-02-11 16:58       ` Mark Brown
2019-02-11 17:12         ` Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 067/352] clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 068/352] clk: meson: meson8b: fix the width of the cpu_scale_div clock Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 069/352] clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 070/352] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 071/352] dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll Greg Kroah-Hartman
2019-02-11 14:14 ` [PATCH 4.20 072/352] powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 073/352] iio: adc: meson-saradc: check for devm_kasprintf failure Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 074/352] iio: adc: meson-saradc: fix internal clock names Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 075/352] iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 076/352] media: adv*/tc358743/ths8200: fill in min width/height/pixelclock Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 077/352] ACPI: SPCR: Consider baud rate 0 as preconfigured state Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 078/352] staging: pi433: fix potential null dereference Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 079/352] f2fs: avoid GC causing encrypted file corrupted Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 080/352] f2fs: move dir data flush to write checkpoint process Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 081/352] f2fs: avoid build warn of fall_through Greg Kroah-Hartman
2019-02-11 20:18   ` Stephen Rothwell
2019-02-11 20:21     ` Stephen Rothwell
2019-02-12  8:52       ` Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 082/352] f2fs: fix race between write_checkpoint and write_begin Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 083/352] f2fs: fix wrong return value of f2fs_acl_create Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 084/352] i2c: sh_mobile: add support for r8a77990 (R-Car E3) Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 085/352] arm64: io: Ensure calls to delay routines are ordered against prior readX() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 086/352] net: aquantia: return err if set MPI_DEINIT state fails Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 087/352] sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 088/352] soc: bcm: brcmstb: Dont leak device tree node reference Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 089/352] nfsd4: fix crash on writing v4_end_grace before nfsd startup Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 090/352] drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 091/352] perf: arm_spe: handle devm_kasprintf() failure Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 092/352] arm64: io: Ensure value passed to __iormb() is held in a 64-bit register Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 093/352] Thermal: do not clear passive state during system sleep Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 094/352] thermal: Fix locking in cooling device sysfs update cur_state Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 095/352] firmware/efi: Add NULL pointer checks in efivars API functions Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 096/352] s390/zcrypt: improve special ap message cmd handling Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 097/352] mt76x0: dfs: fix IBI_R11 configuration on non-radar channels Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 098/352] arm64: ftrace: dont adjust the LR value Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 099/352] drm/v3d: Fix prime imports of buffers from other drivers Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 100/352] ARM: dts: mmp2: fix TWSI2 Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 101/352] ARM: mmp/mmp2: dt: enable the clock Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 102/352] ARM: dts: aspeed: add missing memory unit-address Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 103/352] spi: fix spi-at91-usart.c build errors when PINCTRL is not set Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 104/352] x86/fpu: Add might_fault() to user_insn() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 105/352] media: i2c: TDA1997x: select CONFIG_HDMI Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 106/352] media: DaVinci-VPBE: fix error handling in vpbe_initialize() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 107/352] platform/x86: Fix config space access for intel_atomisp2_pm Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 108/352] smack: fix access permissions for keyring Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 109/352] xtensa: xtfpga.dtsi: fix dtc warnings about SPI Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 110/352] usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 111/352] dmaengine: sprd: Support DMA link-list cyclic callback Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 112/352] usb: dwc2: Disable power down feature on Samsung SoCs Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 113/352] usb: hub: delay hub autosuspend if USB3 port is still link training Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 114/352] timekeeping: Use proper seqcount initializer Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 115/352] usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 116/352] clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 117/352] media: imx274: select REGMAP_I2C Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 118/352] mac80211: fix deauth TX when we disconnect Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 119/352] pinctrl: nuvoton: check for devm_kasprintf() failure Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 120/352] drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 121/352] tipc: fix node keep alive interval calculation Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 122/352] arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 123/352] driver core: Move async_synchronize_full call Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 124/352] kobject: return error code if writing /sys/.../uevent fails Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 125/352] IB/hfi1: Unreserve a reserved request when it is completed Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 126/352] usb: dwc3: trace: add missing break statement to make compiler happy Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 127/352] gpio: mt7621: report failure of devm_kasprintf() Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 128/352] gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 129/352] pinctrl: sx150x: handle failure case of devm_kstrdup Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 130/352] iommu/amd: Fix amd_iommu=force_isolation Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 131/352] media: v4l2-device: Link subdevices to their parent devices if available Greg Kroah-Hartman
2019-02-11 14:15 ` [PATCH 4.20 132/352] ARM: OMAP1: ams-delta: Fix audio permanently muted Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 133/352] ARM: dts: Fix OMAP4430 SDP Ethernet startup Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 134/352] mips: bpf: fix encoding bug for mm_srlv32_op Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 135/352] media: coda: fix H.264 deblocking filter controls Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 136/352] arm64: dts: meson: Fix IRQ trigger type for macirq Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 137/352] ARM: dts: Fix up the D-Link DIR-685 MTD partition info Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 138/352] tracing: Have trace_stack nr_entries compare not be so subtle Greg Kroah-Hartman
2019-02-11 14:49   ` Steven Rostedt
2019-02-11 16:55     ` Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 139/352] watchdog: renesas_wdt: dont set divider while watchdog is running Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 140/352] ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 141/352] usb: dwc3: gadget: Disable CSP for stream OUT ep Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 142/352] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 143/352] iommu/arm-smmu: Add support for qcom,smmu-v2 variant Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 144/352] iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 145/352] sata_rcar: fix deferred probing Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 146/352] clk: imx6sl: ensure MMDC CH0 handshake is bypassed Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 147/352] platform/x86: mlx-platform: Fix tachometer registers Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 148/352] cpuidle: big.LITTLE: fix refcount leak Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 149/352] OPP: Use opp_table->regulators to verify no regulator case Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 150/352] tee: optee: avoid possible double list_del() Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 151/352] drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 152/352] drm/msm: dpu: Only check flush register against pending flushes Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 153/352] lightnvm: pblk: fix resubmission of overwritten write err lbas Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 154/352] lightnvm: pblk: add lock protection to list operations Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 155/352] i2c-axxia: check for error conditions first Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 156/352] lightnvm: Fix uninitialized return value in nvm_get_chunk_meta() Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 157/352] phy: sun4i-usb: add support for missing USB PHY index Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 158/352] mlxsw: spectrum_acl: Limit priority value Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 159/352] udf: Fix BUG on corrupted inode Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 160/352] switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 161/352] selftests/bpf: use __bpf_constant_htons in test_prog.c Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 162/352] ARM: pxa: avoid section mismatch warning Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 163/352] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 164/352] ARM: mmp: fix timer_init calls Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 165/352] fix dma-buf/udmabuf selftest Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 166/352] clk: qcom: Leave mmss noc on for 8998 Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 167/352] f2fs: fix to reorder set_page_dirty and wait_on_page_writeback Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 168/352] ipv6: Fix handling of LLA with VRF and sockets bound to VRF Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 169/352] tools: bpftool: fix -Wmissing declaration warnings Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 170/352] KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 171/352] mmc: bcm2835: Recover from MMC_SEND_EXT_CSD Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 172/352] mmc: bcm2835: reset host on timeout Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 173/352] mmc: meson-mx-sdio: check devm_kasprintf for failure Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 174/352] memstick: Prevent memstick host from getting runtime suspended during card detection Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 175/352] mmc: sdhci-of-esdhc: Fix timeout checks Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 176/352] mmc: sdhci-omap: " Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 177/352] mmc: sdhci-xenon: " Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 178/352] mmc: jz4740: Get CD/WP GPIOs from descriptors Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 179/352] usb: renesas_usbhs: add support for RZ/G2E Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 180/352] btrfs: harden agaist duplicate fsid on scanned devices Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 181/352] btrfs: reada: reorder dev-replace locks before radix tree preload Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 182/352] serial: sh-sci: Fix locking in sci_submit_rx() Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 183/352] serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 184/352] tty: serial: samsung: Properly set flags in autoCTS mode Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 185/352] perf stat: Fix CSV mode column output for non-cgroup events Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 186/352] perf test: Fix perf_event_attr test failure Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 187/352] perf dso: Fix unchecked usage of strncpy() Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 188/352] perf header: " Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 189/352] btrfs: use tagged writepage to mitigate livelock of snapshot Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 190/352] perf probe: Fix unchecked usage of strncpy() Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 191/352] i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) Greg Kroah-Hartman
2019-02-11 14:16 ` [PATCH 4.20 192/352] bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 193/352] KVM: s390: unregister debug feature on failing arch init Greg Kroah-Hartman
2019-02-11 14:34   ` Christian Borntraeger
2019-02-11 16:53     ` Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 194/352] tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 195/352] pinctrl: rza1: Handle devm_kasprintf() failure cases Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 196/352] mac80211: Properly handle SKB with radiotap only Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 197/352] livepatch: check kzalloc return values Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 198/352] arm64: KVM: Skip MMIO insn after emulation Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 199/352] usb: musb: dsps: fix otg state machine Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 200/352] usb: musb: dsps: fix runtime pm for peripheral mode Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 201/352] perf header: Fix up argument to ctime() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 202/352] perf tools: Cast off_t to s64 to avoid warning on bionic libc Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 203/352] percpu: convert spin_lock_irq to spin_lock_irqsave Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 204/352] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 205/352] net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 206/352] drm/amd/display: Add retry to read ddc_clock pin Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 207/352] drm/amd/display: Wait edp HPD to high in detect_sink Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 208/352] Bluetooth: hci_bcm: Handle deferred probing for the clock supply Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 209/352] drm/amd/display: fix YCbCr420 blank color Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 210/352] powerpc/uaccess: fix warning/error with access_ok() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 211/352] mac80211: fix radiotap vendor presence bitmap handling Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 212/352] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 213/352] mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 214/352] scsi: smartpqi: correct host serial num for ssa Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 215/352] scsi: smartpqi: correct volume status Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 216/352] scsi: smartpqi: increase fw status register read timeout Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 217/352] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 218/352] net: hns3: add max vector number check for pf Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 219/352] net: hns3: fix the descriptor index when get rss type Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 220/352] net: hns3: dont restore rules when flow director is disabled Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 221/352] powerpc/perf: Fix thresholding counter data for unknown type Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 222/352] iwlwifi: mvm: fix setting HE ppe FW config Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 223/352] powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 224/352] mlx5: update timecounter at least twice per counter overflow Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 225/352] drbd: narrow rcu_read_lock in drbd_sync_handshake Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 226/352] drbd: disconnect, if the wrong UUIDs are attached on a connected peer Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 227/352] drbd: skip spurious timeout (ping-timeo) when failing promote Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 228/352] drbd: Avoid Clang warning about pointless switch statment Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 229/352] ath10k: fix kernel panic due to use after free Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 230/352] ath10k: fix tx_stats memory leak Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 231/352] drm/amd/display: validate extended dongle caps Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 232/352] video: clps711x-fb: release disp device node in probe() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 233/352] md: fix raid10 hang issue caused by barrier Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 234/352] fbdev: fbmem: behave better with small rotated displays and many CPUs Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 235/352] i40e: define proper net_device::neigh_priv_len Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 236/352] ice: Do not enable NAPI on q_vectors that have no rings Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 237/352] igb: Fix an issue that PME is not enabled during runtime suspend Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 238/352] ACPI/APEI: Clear GHES block_status before panic() Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 239/352] fbdev: fbcon: Fix unregister crash when more than one framebuffer Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 240/352] bpf: sk_msg, zap ingress queue on psock down Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 241/352] powerpc/mm: Fix reporting of kernel execute faults on the 8xx Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 242/352] bpf: sk_msg, fix socket data_ready events Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 243/352] pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 244/352] pinctrl: meson: meson8b: " Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 245/352] KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 246/352] powerpc/fadump: Do not allow hot-remove memory from fadump reserved area Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 247/352] selftests: kvm: report failed stage when exit reason is unexpected Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 248/352] kvm: Change offset in kvm_write_guest_offset_cached to unsigned Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 249/352] NFS: nfs_compare_mount_options always compare auth flavors Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 250/352] perf build: Dont unconditionally link the libbfd feature test to -liberty and -lz Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 251/352] hwmon: (lm80) fix a missing check of the status of SMBus read Greg Kroah-Hartman
2019-02-11 14:17 ` [PATCH 4.20 252/352] hwmon: (lm80) fix a missing check of bus read in lm80 probe Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 253/352] seq_buf: Make seq_buf_puts() null-terminate the buffer Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 254/352] crypto: ux500 - Use proper enum in cryp_set_dma_transfer Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 255/352] crypto: ux500 - Use proper enum in hash_set_dma_transfer Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 256/352] MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 257/352] cifs: check ntwrk_buf_start for NULL before dereferencing it Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 258/352] f2fs: fix use-after-free issue when accessing sbi->stat_info Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 259/352] um: Avoid marking pages with "changed protection" Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 260/352] niu: fix missing checks of niu_pci_eeprom_read Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 261/352] f2fs: fix sbi->extent_list corruption issue Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 262/352] cgroup: fix parsing empty mount option string Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 263/352] perf python: Do not force closing original perf descriptor in evlist.get_pollfd() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 264/352] scripts/decode_stacktrace: only strip base path when a prefix of the path Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 265/352] arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 266/352] ocfs2: dont clear bh uptodate for block read Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 267/352] ocfs2: improve ocfs2 Makefile Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 268/352] mm/page_alloc.c: dont call kasan_free_pages() at deferred mem init Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 269/352] zram: fix lockdep warning of free block handling Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 270/352] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 271/352] gdrom: fix a memory leak bug Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 272/352] fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 273/352] block/swim3: Fix -EBUSY error when re-opening device after unmount Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 274/352] thermal: bcm2835: enable hwmon explicitly Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 275/352] kdb: Dont back trace on a cpu that didnt round up Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 276/352] thermal: tsens: qcom: do not create duplicate regmap debugfs entries Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 277/352] PCI: imx: Enable MSI from downstream components Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 278/352] block/swim3: Fix regression on PowerBook G3 Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 279/352] thermal: generic-adc: Fix adc to temp interpolation Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 280/352] HID: lenovo: Add checks to fix of_led_classdev_register Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 281/352] arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 282/352] fs/proc/base.c: use ns_capable instead of capable for timerslack_ns Greg Kroah-Hartman
2019-02-12  1:02   ` Eric W. Biederman
2019-02-12  6:22     ` Serge E. Hallyn
2019-02-12  8:48     ` Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 283/352] kernel/hung_task.c: break RCU locks based on jiffies Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 284/352] proc/sysctl: fix return error for proc_doulongvec_minmax() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 285/352] kernel/hung_task.c: force console verbose before panic Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 286/352] fs/epoll: drop ovflist branch prediction Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 287/352] exec: load_script: dont blindly truncate shebang string Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 288/352] kernel/kcov.c: mark write_comp_data() as notrace Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 289/352] scripts/gdb: fix lx-version string output Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 290/352] xprtrdma: Dont wake pending tasks until disconnect is done Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 291/352] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 292/352] dccp: fool proof ccid_hc_[rt]x_parse_options() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 293/352] enic: fix checksum validation for IPv6 Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 294/352] lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 295/352] net: dp83640: expire old TX-skb Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 296/352] net: dsa: Fix lockdep false positive splat Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 297/352] net: dsa: Fix NULL checking in dsa_slave_set_eee() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 298/352] net: dsa: mv88e6xxx: Fix counting of ATU violations Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 299/352] net: dsa: slave: Dont propagate flag changes on down slave interfaces Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 300/352] net: systemport: Fix WoL with password after deep sleep Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 301/352] rds: fix refcount bug in rds_sock_addref Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 302/352] Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 303/352] rxrpc: bad unlock balance in rxrpc_recvmsg Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 304/352] sctp: check and update stream->out_curr when allocating stream_out Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 305/352] sctp: walk the list of asoc safely Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 306/352] skge: potential memory corruption in skge_get_regs() Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 307/352] virtio_net: Account for tx bytes and packets on sending xdp_frames Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 308/352] bnxt_en: Disable interrupts when allocating CP rings or NQs Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 309/352] net: cls_flower: Remove filter from mask before freeing it Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 310/352] net: dsa: b53: Fix for failure when irq is not defined in dt Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 311/352] net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows Greg Kroah-Hartman
2019-02-11 14:18 ` [PATCH 4.20 312/352] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 313/352] xfs: eof trim writeback mapping as soon as it is cached Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 314/352] ALSA: compress: Fix stop handling on compressed capture streams Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 315/352] ALSA: usb-audio: Add support for new T+A USB DAC Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 316/352] ALSA: hda - Serialize codec registrations Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 317/352] ALSA: hda/realtek - Fix lose hp_pins for disable auto mute Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 318/352] ALSA: hda/realtek - Use a common helper for hp pin reference Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 319/352] ALSA: hda/realtek - Headset microphone support for System76 darp5 Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 320/352] fuse: call pipe_buf_release() under pipe lock Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 321/352] fuse: decrement NR_WRITEBACK_TEMP on the right page Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 322/352] fuse: handle zero sized retrieve correctly Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 323/352] cuse: fix ioctl Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 324/352] HID: debug: fix the ring buffer implementation Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 325/352] dmaengine: bcm2835: Fix interrupt race on RT Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 326/352] dmaengine: bcm2835: Fix abort of transactions Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 327/352] dmaengine: imx-dma: fix wrong callback invoke Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 328/352] futex: Handle early deadlock return correctly Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 329/352] irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 330/352] arm64: dts: allwinner: a64: Fix USB OTG regulator Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 331/352] usb: phy: am335x: fix race condition in _probe Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 332/352] usb: dwc3: gadget: Handle 0 xfer length for OUT EP Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 333/352] usb: gadget: udc: net2272: Fix bitwise and boolean operations Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 334/352] usb: gadget: musb: fix short isoc packets with inventra dma Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 335/352] staging: speakup: fix tty-operation NULL derefs Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 336/352] scsi: sd_zbc: Fix zone information messages Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 337/352] scsi: cxlflash: Prevent deadlock when adapter probe fails Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 338/352] scsi: aic94xx: fix module loading Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 339/352] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 340/352] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 341/352] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 342/352] cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 343/352] perf/x86/intel/uncore: Add Node ID mask Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 344/352] perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 345/352] x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 346/352] perf/core: Dont WARN() for impossible ring-buffer sizes Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 347/352] perf tests evsel-tp-sched: Fix bitwise operator Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 348/352] serial: fix race between flush_to_ldisc and tty_open Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 349/352] serial: 8250_pci: Make PCI class test non fatal Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 350/352] serial: sh-sci: Do not free irqs that have already been freed Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 351/352] cacheinfo: Keep the old value if of_property_read_u32 fails Greg Kroah-Hartman
2019-02-11 14:19 ` [PATCH 4.20 352/352] nfsd: Fix error return values for nfsd4_clone_file_range() Greg Kroah-Hartman
2019-02-12 15:40 ` [PATCH 4.20 000/352] 4.20.8-stable review shuah
2019-02-12 18:32   ` Greg Kroah-Hartman
2019-02-12 16:25 ` Naresh Kamboju
2019-02-12 18:38   ` Greg Kroah-Hartman
2019-02-12 16:41 ` Guenter Roeck
2019-02-12 18:38   ` Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).