* [PATCH 4.19 001/125] powerpc/64s: Dont init FSCR_DSCR in __init_FSCR()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 002/125] gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY Greg Kroah-Hartman
` (127 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Ellerman, Alistair Popple,
Thadeu Lima de Souza Cascardo
From: Michael Ellerman <mpe@ellerman.id.au>
commit 0828137e8f16721842468e33df0460044a0c588b upstream.
__init_FSCR() was added originally in commit 2468dcf641e4 ("powerpc:
Add support for context switching the TAR register") (Feb 2013), and
only set FSCR_TAR.
At that point FSCR (Facility Status and Control Register) was not
context switched, so the setting was permanent after boot.
Later we added initialisation of FSCR_DSCR to __init_FSCR(), in commit
54c9b2253d34 ("powerpc: Set DSCR bit in FSCR setup") (Mar 2013), again
that was permanent after boot.
Then commit 2517617e0de6 ("powerpc: Fix context switch DSCR on
POWER8") (Aug 2013) added a limited context switch of FSCR, just the
FSCR_DSCR bit was context switched based on thread.dscr_inherit. That
commit said "This clears the H/FSCR DSCR bit initially", but it
didn't, it left the initialisation of FSCR_DSCR in __init_FSCR().
However the initial context switch from init_task to pid 1 would clear
FSCR_DSCR because thread.dscr_inherit was 0.
That commit also introduced the requirement that FSCR_DSCR be clear
for user processes, so that we can take the facility unavailable
interrupt in order to manage dscr_inherit.
Then in commit 152d523e6307 ("powerpc: Create context switch helpers
save_sprs() and restore_sprs()") (Dec 2015) FSCR was added to
thread_struct. However it still wasn't fully context switched, we just
took the existing value and set FSCR_DSCR if the new thread had
dscr_inherit set. FSCR was still initialised at boot to FSCR_DSCR |
FSCR_TAR, but that value was not propagated into the thread_struct, so
the initial context switch set FSCR_DSCR back to 0.
Finally commit b57bd2de8c6c ("powerpc: Improve FSCR init and context
switching") (Jun 2016) added a full context switch of the FSCR, and
added an initialisation of init_task.thread.fscr to FSCR_TAR |
FSCR_EBB, but omitted FSCR_DSCR.
The end result is that swapper runs with FSCR_DSCR set because of the
initialisation in __init_FSCR(), but no other processes do, they use
the value from init_task.thread.fscr.
Having FSCR_DSCR set for swapper allows it to access SPR 3 from
userspace, but swapper never runs userspace, so it has no useful
effect. It's also confusing to have the value initialised in two
places to two different values.
So remove FSCR_DSCR from __init_FSCR(), this at least gets us to the
point where there's a single value of FSCR, even if it's still set in
two places.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Tested-by: Alistair Popple <alistair@popple.id.au>
Link: https://lore.kernel.org/r/20200527145843.2761782-1-mpe@ellerman.id.au
Cc: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/cpu_setup_power.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -183,7 +183,7 @@ __init_LPCR_ISA300:
__init_FSCR:
mfspr r3,SPRN_FSCR
- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB
+ ori r3,r3,FSCR_TAR|FSCR_EBB
mtspr SPRN_FSCR,r3
blr
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 002/125] gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 001/125] powerpc/64s: Dont init FSCR_DSCR in __init_FSCR() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 003/125] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
` (126 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Tomlinson, David S. Miller
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[ Upstream commit 272502fcb7cda01ab07fc2fcff82d1d2f73d43cc ]
When receiving an IPv4 packet inside an IPv6 GRE packet, and the
IP6_TNL_F_RCV_DSCP_COPY flag is set on the tunnel, the IPv4 header would
get corrupted. This is due to the common ip6_tnl_rcv() function assuming
that the inner header is always IPv6. This patch checks the tunnel
protocol for IPv4 inner packets, but still defaults to IPv6.
Fixes: 308edfdf1563 ("gre6: Cleanup GREv6 receive path, call common GRE functions")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_tunnel.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -865,7 +865,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struc
struct metadata_dst *tun_dst,
bool log_ecn_err)
{
- return __ip6_tnl_rcv(t, skb, tpi, tun_dst, ip6ip6_dscp_ecn_decapsulate,
+ int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
+ const struct ipv6hdr *ipv6h,
+ struct sk_buff *skb);
+
+ dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate;
+ if (tpi->proto == htons(ETH_P_IP))
+ dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate;
+
+ return __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
log_ecn_err);
}
EXPORT_SYMBOL(ip6_tnl_rcv);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 003/125] net: Fix potential wrong skb->protocol in skb_vlan_untag()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 001/125] powerpc/64s: Dont init FSCR_DSCR in __init_FSCR() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 002/125] gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 004/125] net: qrtr: fix usage of idr in port assignment to socket Greg Kroah-Hartman
` (125 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miaohe Lin, David S. Miller
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit 55eff0eb7460c3d50716ed9eccf22257b046ca92 ]
We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
we may access the wrong data.
Fixes: 0d5501c1c828 ("net: Always untag vlan-tagged traffic on input.")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5128,8 +5128,8 @@ struct sk_buff *skb_vlan_untag(struct sk
skb = skb_share_check(skb, GFP_ATOMIC);
if (unlikely(!skb))
goto err_free;
-
- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
+ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
+ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
goto err_free;
vhdr = (struct vlan_hdr *)skb->data;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 004/125] net: qrtr: fix usage of idr in port assignment to socket
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 003/125] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 005/125] net/smc: Prevent kernel-infoleak in __smc_diag_dump() Greg Kroah-Hartman
` (124 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+f31428628ef672716ea8,
Necip Fazil Yildiran, Dmitry Vyukov, David S. Miller
From: Necip Fazil Yildiran <necip@google.com>
[ Upstream commit 8dfddfb79653df7c38a9c8c4c034f242a36acee9 ]
Passing large uint32 sockaddr_qrtr.port numbers for port allocation
triggers a warning within idr_alloc() since the port number is cast
to int, and thus interpreted as a negative number. This leads to
the rejection of such valid port numbers in qrtr_port_assign() as
idr_alloc() fails.
To avoid the problem, switch to idr_alloc_u32() instead.
Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
Reported-by: syzbot+f31428628ef672716ea8@syzkaller.appspotmail.com
Signed-off-by: Necip Fazil Yildiran <necip@google.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/qrtr.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -554,23 +554,25 @@ static void qrtr_port_remove(struct qrtr
*/
static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
{
+ u32 min_port;
int rc;
mutex_lock(&qrtr_port_lock);
if (!*port) {
- rc = idr_alloc(&qrtr_ports, ipc,
- QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
- GFP_ATOMIC);
- if (rc >= 0)
- *port = rc;
+ min_port = QRTR_MIN_EPH_SOCKET;
+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
+ if (!rc)
+ *port = min_port;
} else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
rc = -EACCES;
} else if (*port == QRTR_PORT_CTRL) {
- rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
+ min_port = 0;
+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
} else {
- rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC);
- if (rc >= 0)
- *port = rc;
+ min_port = *port;
+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
+ if (!rc)
+ *port = min_port;
}
mutex_unlock(&qrtr_port_lock);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 005/125] net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 004/125] net: qrtr: fix usage of idr in port assignment to socket Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 006/125] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
` (123 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Peilin Ye,
Ursula Braun, David S. Miller
From: Peilin Ye <yepeilin.cs@gmail.com>
[ Upstream commit ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab ]
__smc_diag_dump() is potentially copying uninitialized kernel stack memory
into socket buffers, since the compiler may leave a 4-byte hole near the
beginning of `struct smcd_diag_dmbinfo`. Fix it by initializing `dinfo`
with memset().
Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/smc/smc_diag.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/net/smc/smc_diag.c
+++ b/net/smc/smc_diag.c
@@ -169,13 +169,15 @@ static int __smc_diag_dump(struct sock *
(req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) &&
!list_empty(&smc->conn.lgr->list)) {
struct smc_connection *conn = &smc->conn;
- struct smcd_diag_dmbinfo dinfo = {
- .linkid = *((u32 *)conn->lgr->id),
- .peer_gid = conn->lgr->peer_gid,
- .my_gid = conn->lgr->smcd->local_gid,
- .token = conn->rmb_desc->token,
- .peer_token = conn->peer_token
- };
+ struct smcd_diag_dmbinfo dinfo;
+
+ memset(&dinfo, 0, sizeof(dinfo));
+
+ dinfo.linkid = *((u32 *)conn->lgr->id);
+ dinfo.peer_gid = conn->lgr->peer_gid;
+ dinfo.my_gid = conn->lgr->smcd->local_gid;
+ dinfo.token = conn->rmb_desc->token;
+ dinfo.peer_token = conn->peer_token;
if (nla_put(skb, SMC_DIAG_DMBINFO, sizeof(dinfo), &dinfo) < 0)
goto errout;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 006/125] tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 005/125] net/smc: Prevent kernel-infoleak in __smc_diag_dump() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 007/125] net: ena: Make missed_tx stat incremental Greg Kroah-Hartman
` (122 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jon Maloy, Ying Xue, Richard Alpe,
Cong Wang, David S. Miller, syzbot+0e7181deafa7e0b79923
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 47733f9daf4fe4f7e0eb9e273f21ad3a19130487 ]
__tipc_nl_compat_dumpit() has two callers, and it expects them to
pass a valid nlmsghdr via arg->data. This header is artificial and
crafted just for __tipc_nl_compat_dumpit().
tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
as some nested attribute, TIPC_NLA_SOCK. But the other caller
tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
on this call path.
Fix this by just adding a similar nlmsghdr without any payload in
tipc_nl_compat_dumpit().
This bug exists since day 1, but the recent commit 6ea67769ff33
("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
easier to appear.
Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Richard Alpe <richard.alpe@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/netlink_compat.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -255,8 +255,9 @@ err_out:
static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
struct tipc_nl_compat_msg *msg)
{
- int err;
+ struct nlmsghdr *nlh;
struct sk_buff *arg;
+ int err;
if (msg->req_type && (!msg->req_size ||
!TLV_CHECK_TYPE(msg->req, msg->req_type)))
@@ -285,6 +286,15 @@ static int tipc_nl_compat_dumpit(struct
return -ENOMEM;
}
+ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI);
+ if (!nlh) {
+ kfree_skb(arg);
+ kfree_skb(msg->rep);
+ msg->rep = NULL;
+ return -EMSGSIZE;
+ }
+ nlmsg_end(arg, nlh);
+
err = __tipc_nl_compat_dumpit(cmd, msg, arg);
if (err) {
kfree_skb(msg->rep);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 007/125] net: ena: Make missed_tx stat incremental
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 006/125] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 008/125] ipvlan: fix device features Greg Kroah-Hartman
` (121 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shay Agroskin, David S. Miller
From: Shay Agroskin <shayagr@amazon.com>
[ Upstream commit ccd143e5150f24b9ba15145c7221b61dd9e41021 ]
Most statistics in ena driver are incremented, meaning that a stat's
value is a sum of all increases done to it since driver/queue
initialization.
This patch makes all statistics this way, effectively making missed_tx
statistic incremental.
Also added a comment regarding rx_drops and tx_drops to make it
clearer how these counters are calculated.
Fixes: 11095fdb712b ("net: ena: add statistics for missed tx packets")
Signed-off-by: Shay Agroskin <shayagr@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2736,7 +2736,7 @@ static int check_missing_comp_in_tx_queu
}
u64_stats_update_begin(&tx_ring->syncp);
- tx_ring->tx_stats.missed_tx = missed_tx;
+ tx_ring->tx_stats.missed_tx += missed_tx;
u64_stats_update_end(&tx_ring->syncp);
return rc;
@@ -3544,6 +3544,9 @@ static void ena_keep_alive_wd(void *adap
rx_drops = ((u64)desc->rx_drops_high << 32) | desc->rx_drops_low;
u64_stats_update_begin(&adapter->syncp);
+ /* These stats are accumulated by the device, so the counters indicate
+ * all drops since last reset.
+ */
adapter->dev_stats.rx_drops = rx_drops;
u64_stats_update_end(&adapter->syncp);
}
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 008/125] ipvlan: fix device features
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 007/125] net: ena: Make missed_tx stat incremental Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 009/125] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
` (120 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mahesh Bandewar, Eric Dumazet,
David S. Miller
From: Mahesh Bandewar <maheshb@google.com>
[ Upstream commit d0f5c7076e01fef6fcb86988d9508bf3ce258bd4 ]
Processing NETDEV_FEAT_CHANGE causes IPvlan links to lose
NETIF_F_LLTX feature because of the incorrect handling of
features in ipvlan_fix_features().
--before--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Actual changes:
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: off [fixed]
lpaa10:~#
--after--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Could not change any device features
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~#
Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipvlan/ipvlan_main.c | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -177,12 +177,21 @@ static void ipvlan_port_destroy(struct n
kfree(port);
}
+#define IPVLAN_ALWAYS_ON_OFLOADS \
+ (NETIF_F_SG | NETIF_F_HW_CSUM | \
+ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
+
+#define IPVLAN_ALWAYS_ON \
+ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
+
#define IPVLAN_FEATURES \
- (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
+ (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
+ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
+
#define IPVLAN_STATE_MASK \
((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
@@ -196,7 +205,9 @@ static int ipvlan_init(struct net_device
dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
(phy_dev->state & IPVLAN_STATE_MASK);
dev->features = phy_dev->features & IPVLAN_FEATURES;
- dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED;
+ dev->features |= IPVLAN_ALWAYS_ON;
+ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
+ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
dev->gso_max_size = phy_dev->gso_max_size;
dev->gso_max_segs = phy_dev->gso_max_segs;
dev->hard_header_len = phy_dev->hard_header_len;
@@ -297,7 +308,14 @@ static netdev_features_t ipvlan_fix_feat
{
struct ipvl_dev *ipvlan = netdev_priv(dev);
- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+ features |= NETIF_F_ALL_FOR_ALL;
+ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+ features = netdev_increment_features(ipvlan->phy_dev->features,
+ features, features);
+ features |= IPVLAN_ALWAYS_ON;
+ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
+
+ return features;
}
static void ipvlan_change_rx_flags(struct net_device *dev, int change)
@@ -802,10 +820,9 @@ static int ipvlan_device_event(struct no
case NETDEV_FEAT_CHANGE:
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
- ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
ipvlan->dev->gso_max_size = dev->gso_max_size;
ipvlan->dev->gso_max_segs = dev->gso_max_segs;
- netdev_features_change(ipvlan->dev);
+ netdev_update_features(ipvlan->dev);
}
break;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 009/125] ALSA: pci: delete repeated words in comments
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 008/125] ipvlan: fix device features Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 010/125] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt Greg Kroah-Hartman
` (119 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Takashi Iwai, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c7fabbc51352f50cc58242a6dc3b9c1a3599849b ]
Drop duplicated words in sound/pci/.
{and, the, at}
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20200806021926.32418-1-rdunlap@infradead.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/cs46xx/cs46xx_lib.c | 2 +-
sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +-
sound/pci/hda/hda_codec.c | 2 +-
sound/pci/hda/hda_generic.c | 2 +-
sound/pci/hda/patch_sigmatel.c | 2 +-
sound/pci/ice1712/prodigy192.c | 2 +-
sound/pci/oxygen/xonar_dg.c | 2 +-
7 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 146e1a3498c73..419da70cd942a 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
rate = 48000 / 9;
/*
- * We can not capture at at rate greater than the Input Rate (48000).
+ * We can not capture at a rate greater than the Input Rate (48000).
* Return an error if an attempt is made to stray outside that limit.
*/
if (rate > 48000)
diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
index 8d0a3d3573457..8ef51a29380af 100644
--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
+++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
@@ -1739,7 +1739,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
struct dsp_spos_instance * ins = chip->dsp_spos_instance;
if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
- /* remove AsynchFGTxSCB and and PCMSerialInput_II */
+ /* remove AsynchFGTxSCB and PCMSerialInput_II */
cs46xx_dsp_disable_spdif_out (chip);
/* save state */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index f3a6b1d869d8a..dbeb62362f1c3 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3410,7 +3410,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
* @nid: NID to check / update
*
* Check whether the given NID is in the amp list. If it's in the list,
- * check the current AMP status, and update the the power-status according
+ * check the current AMP status, and update the power-status according
* to the mute status.
*
* This function is supposed to be set or called from the check_power_status
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 2609161707a41..97adb7e340f99 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -825,7 +825,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
}
}
-/* sync power of each widget in the the given path */
+/* sync power of each widget in the given path */
static hda_nid_t path_power_update(struct hda_codec *codec,
struct nid_path *path,
bool allow_powerdown)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d8168aa2cef38..85c33f528d7b3 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -845,7 +845,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
static struct snd_kcontrol_new beep_vol_ctl =
HDA_CODEC_VOLUME(NULL, 0, 0, 0);
- /* check for mute support for the the amp */
+ /* check for mute support for the amp */
if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
const struct snd_kcontrol_new *temp;
if (spec->anabeep_nid == nid)
diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
index 3919aed39ca03..5e52086d7b986 100644
--- a/sound/pci/ice1712/prodigy192.c
+++ b/sound/pci/ice1712/prodigy192.c
@@ -31,7 +31,7 @@
* Experimentally I found out that only a combination of
* OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
* VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
- * sampling rate. That means the the FPGA doubles the
+ * sampling rate. That means that the FPGA doubles the
* MCK01 rate.
*
* Copyright (c) 2003 Takashi Iwai <tiwai@suse.de>
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index 4cf3200e988b0..df44135e1b0c9 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -39,7 +39,7 @@
* GPIO 4 <- headphone detect
* GPIO 5 -> enable ADC analog circuit for the left channel
* GPIO 6 -> enable ADC analog circuit for the right channel
- * GPIO 7 -> switch green rear output jack between CS4245 and and the first
+ * GPIO 7 -> switch green rear output jack between CS4245 and the first
* channel of CS4361 (mechanical relay)
* GPIO 8 -> enable output to speakers
*
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 010/125] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 009/125] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 011/125] ASoC: img-parallel-out: Fix a reference count leak Greg Kroah-Hartman
` (118 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Mark Brown, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit c4c59b95b7f7d4cef5071b151be2dadb33f3287b ]
pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Link: https://lore.kernel.org/r/20200614033749.2975-1-wu000273@umn.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/img/img-i2s-in.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
index c22880aea82a2..7e48c740bf550 100644
--- a/sound/soc/img/img-i2s-in.c
+++ b/sound/soc/img/img-i2s-in.c
@@ -346,8 +346,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
ret = pm_runtime_get_sync(i2s->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(i2s->dev);
return ret;
+ }
for (i = 0; i < i2s->active_channels; i++)
img_i2s_in_ch_disable(i2s, i);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 011/125] ASoC: img-parallel-out: Fix a reference count leak
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 010/125] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 012/125] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
` (117 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Mark Brown, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit 6b9fbb073636906eee9fe4d4c05a4f445b9e2a23 ]
pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Link: https://lore.kernel.org/r/20200614033344.1814-1-wu000273@umn.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/img/img-parallel-out.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
index acc005217be06..f56752662b199 100644
--- a/sound/soc/img/img-parallel-out.c
+++ b/sound/soc/img/img-parallel-out.c
@@ -166,8 +166,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
}
ret = pm_runtime_get_sync(prl->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(prl->dev);
return ret;
+ }
reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 012/125] ASoC: tegra: Fix reference count leaks.
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 011/125] ASoC: img-parallel-out: Fix a reference count leak Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 013/125] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs Greg Kroah-Hartman
` (116 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Jon Hunter, Mark Brown,
Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]
Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20200613204422.24484-1-wu000273@umn.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra30_ahub.c | 4 +++-
sound/soc/tegra/tegra30_i2s.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 43679aeeb12be..88e838ac937dc 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -655,8 +655,10 @@ static int tegra30_ahub_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(ahub->regmap_ahub);
ret |= regcache_sync(ahub->regmap_apbif);
pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 0b176ea24914b..bf155c5092f06 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -551,8 +551,10 @@ static int tegra30_i2s_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(i2s->regmap);
pm_runtime_put(dev);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 013/125] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 012/125] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 014/125] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep Greg Kroah-Hartman
` (115 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Lee Jones, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 3ea2e4eab64cefa06055bb0541fcdedad4b48565 ]
Intel Emmitsburg PCH has the same LPSS than Intel Ice Lake.
Add the new IDs to the list of supported devices.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/intel-lpss-pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 742d6c1973f4f..adea7ff63132f 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -176,6 +176,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
{ PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info },
{ PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
{ PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
+ /* EBG */
+ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info },
/* GLK */
{ PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
{ PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 014/125] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 013/125] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 015/125] powerpc/xive: Ignore kmemleak false positives Greg Kroah-Hartman
` (114 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit e2ee9edc282961783d519c760bbaa20fed4dec38 ]
The original qcom kernel changed the PDM GPIOs to be pull-down
during sleep at some point. Reportedly this was done because
there was some "leakage at PDM outputs during sleep":
https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=0f87e08c1cd3e6484a6f7fb3e74e37340bdcdee0
I cannot say how effective this is, but everything seems to work
fine with this change so let's apply the same to mainline just
to be sure.
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20200605185916.318494-3-stephan@gerhold.net
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
index 60d218c5275c1..6754817658fa4 100644
--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
@@ -529,7 +529,7 @@
pins = "gpio63", "gpio64", "gpio65", "gpio66",
"gpio67", "gpio68";
drive-strength = <2>;
- bias-disable;
+ bias-pull-down;
};
};
};
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 015/125] powerpc/xive: Ignore kmemleak false positives
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 014/125] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
` (113 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy,
Michael Ellerman, Sasha Levin
From: Alexey Kardashevskiy <aik@ozlabs.ru>
[ Upstream commit f0993c839e95dd6c7f054a1015e693c87e33e4fb ]
xive_native_provision_pages() allocates memory and passes the pointer to
OPAL so kmemleak cannot find the pointer usage in the kernel memory and
produces a false positive report (below) (even if the kernel did scan
OPAL memory, it is unable to deal with __pa() addresses anyway).
This silences the warning.
unreferenced object 0xc000200350c40000 (size 65536):
comm "qemu-system-ppc", pid 2725, jiffies 4294946414 (age 70776.530s)
hex dump (first 32 bytes):
02 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 ....P...........
01 00 08 07 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000081ff046c>] xive_native_alloc_vp_block+0x120/0x250
[<00000000d555d524>] kvmppc_xive_compute_vp_id+0x248/0x350 [kvm]
[<00000000d69b9c9f>] kvmppc_xive_connect_vcpu+0xc0/0x520 [kvm]
[<000000006acbc81c>] kvm_arch_vcpu_ioctl+0x308/0x580 [kvm]
[<0000000089c69580>] kvm_vcpu_ioctl+0x19c/0xae0 [kvm]
[<00000000902ae91e>] ksys_ioctl+0x184/0x1b0
[<00000000f3e68bd7>] sys_ioctl+0x48/0xb0
[<0000000001b2c127>] system_call_exception+0x124/0x1f0
[<00000000d2b2ee40>] system_call_common+0xe8/0x214
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200612043303.84894-1-aik@ozlabs.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/sysdev/xive/native.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
index cb1f51ad48e40..411f785cdfb51 100644
--- a/arch/powerpc/sysdev/xive/native.c
+++ b/arch/powerpc/sysdev/xive/native.c
@@ -22,6 +22,7 @@
#include <linux/delay.h>
#include <linux/cpumask.h>
#include <linux/mm.h>
+#include <linux/kmemleak.h>
#include <asm/prom.h>
#include <asm/io.h>
@@ -627,6 +628,7 @@ static bool xive_native_provision_pages(void)
pr_err("Failed to allocate provisioning page\n");
return false;
}
+ kmemleak_ignore(p);
opal_xive_donate_page(chip, __pa(p));
}
return true;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 015/125] powerpc/xive: Ignore kmemleak false positives Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 16:25 ` Sean Young
2020-09-01 15:09 ` [PATCH 4.19 017/125] blktrace: ensure our debugfs dir exists Greg Kroah-Hartman
` (112 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
The value av7110->debi_virt is stored in DMA memory, and it is assigned
to data, and thus data[0] can be modified at any time by malicious
hardware. In this case, "if (data[0] < 2)" can be passed, but then
data[0] can be changed into a large number, which may cause buffer
overflow when the code "av7110->ci_slot[data[0]]" is used.
To fix this possible bug, data[0] is assigned to a local variable, which
replaces the use of data[0].
Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ttpci/av7110.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
index d6816effb8786..d02b5fd940c12 100644
--- a/drivers/media/pci/ttpci/av7110.c
+++ b/drivers/media/pci/ttpci/av7110.c
@@ -424,14 +424,15 @@ static void debiirq(unsigned long cookie)
case DATA_CI_GET:
{
u8 *data = av7110->debi_virt;
+ u8 data_0 = data[0];
- if ((data[0] < 2) && data[2] == 0xff) {
+ if (data_0 < 2 && data[2] == 0xff) {
int flags = 0;
if (data[5] > 0)
flags |= CA_CI_MODULE_PRESENT;
if (data[5] > 5)
flags |= CA_CI_MODULE_READY;
- av7110->ci_slot[data[0]].flags = flags;
+ av7110->ci_slot[data_0].flags = flags;
} else
ci_get_data(&av7110->ci_rbuffer,
av7110->debi_virt,
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 15:09 ` [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
@ 2020-09-01 16:25 ` Sean Young
2020-09-01 16:35 ` Greg Kroah-Hartman
0 siblings, 1 reply; 147+ messages in thread
From: Sean Young @ 2020-09-01 16:25 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Jia-Ju Bai, Mauro Carvalho Chehab, Sasha Levin
Greg,
On Tue, Sep 01, 2020 at 05:09:31PM +0200, Greg Kroah-Hartman wrote:
> From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
>
> [ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
>
> The value av7110->debi_virt is stored in DMA memory, and it is assigned
> to data, and thus data[0] can be modified at any time by malicious
> hardware. In this case, "if (data[0] < 2)" can be passed, but then
> data[0] can be changed into a large number, which may cause buffer
> overflow when the code "av7110->ci_slot[data[0]]" is used.
>
> To fix this possible bug, data[0] is assigned to a local variable, which
> replaces the use of data[0].
See the discussion here:
https://lkml.org/lkml/2020/8/31/479
It does not seem worthwhile merging to the stable trees.
Thanks
Sean
>
> Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
> Signed-off-by: Sean Young <sean@mess.org>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/media/pci/ttpci/av7110.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
> index d6816effb8786..d02b5fd940c12 100644
> --- a/drivers/media/pci/ttpci/av7110.c
> +++ b/drivers/media/pci/ttpci/av7110.c
> @@ -424,14 +424,15 @@ static void debiirq(unsigned long cookie)
> case DATA_CI_GET:
> {
> u8 *data = av7110->debi_virt;
> + u8 data_0 = data[0];
>
> - if ((data[0] < 2) && data[2] == 0xff) {
> + if (data_0 < 2 && data[2] == 0xff) {
> int flags = 0;
> if (data[5] > 0)
> flags |= CA_CI_MODULE_PRESENT;
> if (data[5] > 5)
> flags |= CA_CI_MODULE_READY;
> - av7110->ci_slot[data[0]].flags = flags;
> + av7110->ci_slot[data_0].flags = flags;
> } else
> ci_get_data(&av7110->ci_rbuffer,
> av7110->debi_virt,
> --
> 2.25.1
>
>
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 16:25 ` Sean Young
@ 2020-09-01 16:35 ` Greg Kroah-Hartman
2020-09-01 21:16 ` Pavel Machek
0 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 16:35 UTC (permalink / raw)
To: Sean Young
Cc: linux-kernel, stable, Jia-Ju Bai, Mauro Carvalho Chehab, Sasha Levin
On Tue, Sep 01, 2020 at 05:25:12PM +0100, Sean Young wrote:
> Greg,
>
> On Tue, Sep 01, 2020 at 05:09:31PM +0200, Greg Kroah-Hartman wrote:
> > From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
> >
> > [ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
> >
> > The value av7110->debi_virt is stored in DMA memory, and it is assigned
> > to data, and thus data[0] can be modified at any time by malicious
> > hardware. In this case, "if (data[0] < 2)" can be passed, but then
> > data[0] can be changed into a large number, which may cause buffer
> > overflow when the code "av7110->ci_slot[data[0]]" is used.
> >
> > To fix this possible bug, data[0] is assigned to a local variable, which
> > replaces the use of data[0].
>
> See the discussion here:
>
> https://lkml.org/lkml/2020/8/31/479
>
> It does not seem worthwhile merging to the stable trees.
It doesn't hurt either :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 16:35 ` Greg Kroah-Hartman
@ 2020-09-01 21:16 ` Pavel Machek
2020-09-02 1:23 ` Jia-Ju Bai
0 siblings, 1 reply; 147+ messages in thread
From: Pavel Machek @ 2020-09-01 21:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Sean Young, linux-kernel, stable, Jia-Ju Bai,
Mauro Carvalho Chehab, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1403 bytes --]
On Tue 2020-09-01 18:35:23, Greg Kroah-Hartman wrote:
> On Tue, Sep 01, 2020 at 05:25:12PM +0100, Sean Young wrote:
> > Greg,
> >
> > On Tue, Sep 01, 2020 at 05:09:31PM +0200, Greg Kroah-Hartman wrote:
> > > From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
> > >
> > > [ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
> > >
> > > The value av7110->debi_virt is stored in DMA memory, and it is assigned
> > > to data, and thus data[0] can be modified at any time by malicious
> > > hardware. In this case, "if (data[0] < 2)" can be passed, but then
> > > data[0] can be changed into a large number, which may cause buffer
> > > overflow when the code "av7110->ci_slot[data[0]]" is used.
> > >
> > > To fix this possible bug, data[0] is assigned to a local variable, which
> > > replaces the use of data[0].
> >
> > See the discussion here:
> >
> > https://lkml.org/lkml/2020/8/31/479
> >
> > It does not seem worthwhile merging to the stable trees.
>
> It doesn't hurt either :)
Update stable kernel rules.
If "patch does not match description and is pretty obviously useless"
but "does not hurt" is acceptable for stable tree, people should know.
You are pushing known junk into stable. Stop that.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 21:16 ` Pavel Machek
@ 2020-09-02 1:23 ` Jia-Ju Bai
0 siblings, 0 replies; 147+ messages in thread
From: Jia-Ju Bai @ 2020-09-02 1:23 UTC (permalink / raw)
To: Pavel Machek, Greg Kroah-Hartman
Cc: Sean Young, linux-kernel, stable, Jia-Ju Bai,
Mauro Carvalho Chehab, Sasha Levin
On 2020/9/2 5:16, Pavel Machek wrote:
> On Tue 2020-09-01 18:35:23, Greg Kroah-Hartman wrote:
>> On Tue, Sep 01, 2020 at 05:25:12PM +0100, Sean Young wrote:
>>> Greg,
>>>
>>> On Tue, Sep 01, 2020 at 05:09:31PM +0200, Greg Kroah-Hartman wrote:
>>>> From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
>>>>
>>>> [ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
>>>>
>>>> The value av7110->debi_virt is stored in DMA memory, and it is assigned
>>>> to data, and thus data[0] can be modified at any time by malicious
>>>> hardware. In this case, "if (data[0] < 2)" can be passed, but then
>>>> data[0] can be changed into a large number, which may cause buffer
>>>> overflow when the code "av7110->ci_slot[data[0]]" is used.
>>>>
>>>> To fix this possible bug, data[0] is assigned to a local variable, which
>>>> replaces the use of data[0].
>>> See the discussion here:
>>>
>>> https://lkml.org/lkml/2020/8/31/479
>>>
>>> It does not seem worthwhile merging to the stable trees.
>> It doesn't hurt either :)
> Update stable kernel rules.
>
> If "patch does not match description and is pretty obviously useless"
> but "does not hurt" is acceptable for stable tree, people should know.
>
> You are pushing known junk into stable. Stop that.
Sorry for my useless patch...
Recently I submitted a new patch wiith READ_ONCE() to fix the problem
that Pavel said:
https://lkml.org/lkml/2020/8/30/67
If you think this new patch is still useless, reverting the code is fine
to me.
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 017/125] blktrace: ensure our debugfs dir exists
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 016/125] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 018/125] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
` (111 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luis Chamberlain, Christoph Hellwig,
Bart Van Assche, Jens Axboe, Sasha Levin
From: Luis Chamberlain <mcgrof@kernel.org>
[ Upstream commit b431ef837e3374da0db8ff6683170359aaa0859c ]
We make an assumption that a debugfs directory exists, but since
this can fail ensure it exists before allowing blktrace setup to
complete. Otherwise we end up stuffing blktrace files on the debugfs
root directory. In the worst case scenario this *in theory* can create
an eventual panic *iff* in the future a similarly named file is created
prior on the debugfs root directory. This theoretical crash can happen
due to a recursive removal followed by a specific dentry removal.
This doesn't fix any known crash, however I have seen the files
go into the main debugfs root directory in cases where the debugfs
directory was not created due to other internal bugs with blktrace
now fixed.
blktrace is also completely useless without this directory, so
this ensures to userspace we only setup blktrace if the kernel
can stuff files where they are supposed to go into.
debugfs directory creations typically aren't checked for, and we have
maintainers doing sweep removals of these checks, but since we need this
check to ensure proper userspace blktrace functionality we make sure
to annotate the justification for the check.
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/blktrace.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7a4ca2deb39bc..1442f6152abc2 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -529,6 +529,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
if (!dir)
goto err;
+ /*
+ * As blktrace relies on debugfs for its interface the debugfs directory
+ * is required, contrary to the usual mantra of not checking for debugfs
+ * files or directories.
+ */
+ if (IS_ERR_OR_NULL(dir)) {
+ pr_warn("debugfs_dir not present for %s so skipping\n",
+ buts->name);
+ ret = -ENOENT;
+ goto err;
+ }
+
bt->dev = dev;
atomic_set(&bt->dropped, 0);
INIT_LIST_HEAD(&bt->running_list);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 018/125] scsi: target: tcmu: Fix crash on ARM during cmd completion
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 017/125] blktrace: ensure our debugfs dir exists Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 019/125] iommu/iova: Dont BUG on invalid PFNs Greg Kroah-Hartman
` (110 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, JiangYu, Mike Christie,
Bodo Stroesser, Martin K. Petersen, Sasha Levin
From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
[ Upstream commit 5a0c256d96f020e4771f6fd5524b80f89a2d3132 ]
If tcmu_handle_completions() has to process a padding shorter than
sizeof(struct tcmu_cmd_entry), the current call to
tcmu_flush_dcache_range() with sizeof(struct tcmu_cmd_entry) as length
param is wrong and causes crashes on e.g. ARM, because
tcmu_flush_dcache_range() in this case calls
flush_dcache_page(vmalloc_to_page(start)); with start being an invalid
address above the end of the vmalloc'ed area.
The fix is to use the minimum of remaining ring space and sizeof(struct
tcmu_cmd_entry) as the length param.
The patch was tested on kernel 4.19.118.
See https://bugzilla.kernel.org/show_bug.cgi?id=208045#c10
Link: https://lore.kernel.org/r/20200629093756.8947-1-bstroesser@ts.fujitsu.com
Tested-by: JiangYu <lnsyyj@hotmail.com>
Acked-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_user.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 9c05e820857aa..91dbac7446a47 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1231,7 +1231,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
- tcmu_flush_dcache_range(entry, sizeof(*entry));
+ /*
+ * Flush max. up to end of cmd ring since current entry might
+ * be a padding that is shorter than sizeof(*entry)
+ */
+ size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
+ udev->cmdr_size);
+ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
+ ring_left : sizeof(*entry));
if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
UPDATE_HEAD(udev->cmdr_last_cleaned,
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 019/125] iommu/iova: Dont BUG on invalid PFNs
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 018/125] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 020/125] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
` (109 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prakash Gupta, Robin Murphy,
Joerg Roedel, Sasha Levin
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit d3e3d2be688b4b5864538de61e750721a311e4fc ]
Unlike the other instances which represent a complete loss of
consistency within the rcache mechanism itself, or a fundamental
and obvious misconfiguration by an IOMMU driver, the BUG_ON() in
iova_magazine_free_pfns() can be provoked at more or less any time
in a "spooky action-at-a-distance" manner by any old device driver
passing nonsense to dma_unmap_*() which then propagates through to
queue_iova().
Not only is this well outside the IOVA layer's control, it's also
nowhere near fatal enough to justify panicking anyway - all that
really achieves is to make debugging the offending driver more
difficult. Let's simply WARN and otherwise ignore bogus PFNs.
Reported-by: Prakash Gupta <guptap@codeaurora.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Prakash Gupta <guptap@codeaurora.org>
Link: https://lore.kernel.org/r/acbd2d092b42738a03a21b417ce64e27f8c91c86.1591103298.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iova.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index 34c058c24b9d2..ce5cd05253db9 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -814,7 +814,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad)
for (i = 0 ; i < mag->size; ++i) {
struct iova *iova = private_find_iova(iovad, mag->pfns[i]);
- BUG_ON(!iova);
+ if (WARN_ON(!iova))
+ continue;
+
private_free_iova(iovad, iova);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 020/125] drm/amdkfd: Fix reference count leaks.
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 019/125] iommu/iova: Dont BUG on invalid PFNs Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 021/125] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
` (108 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]
kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 0805c423a5ce0..5cf499a07806a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -592,8 +592,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
ret = kobject_init_and_add(dev->kobj_node, &node_type,
sys_props.kobj_nodes, "%d", id);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(dev->kobj_node);
return ret;
+ }
dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
if (!dev->kobj_mem)
@@ -640,8 +642,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(mem->kobj, &mem_type,
dev->kobj_mem, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(mem->kobj);
return ret;
+ }
mem->attr.name = "properties";
mem->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -659,8 +663,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(cache->kobj, &cache_type,
dev->kobj_cache, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(cache->kobj);
return ret;
+ }
cache->attr.name = "properties";
cache->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -678,8 +684,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(iolink->kobj, &iolink_type,
dev->kobj_iolink, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(iolink->kobj);
return ret;
+ }
iolink->attr.name = "properties";
iolink->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -759,8 +767,10 @@ static int kfd_topology_update_sysfs(void)
ret = kobject_init_and_add(sys_props.kobj_topology,
&sysprops_type, &kfd_device->kobj,
"topology");
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(sys_props.kobj_topology);
return ret;
+ }
sys_props.kobj_nodes = kobject_create_and_add("nodes",
sys_props.kobj_topology);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 021/125] drm/radeon: fix multiple reference count leak
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 020/125] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 022/125] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
` (107 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Alex Deucher, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit 6f2e8acdb48ed166b65d47837c31b177460491ec ]
On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index de656f5553839..b9927101e8450 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -882,8 +882,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (encoder) {
@@ -1028,8 +1030,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = radeon_best_single_encoder(connector);
@@ -1166,8 +1170,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = radeon_best_single_encoder(connector);
@@ -1250,8 +1256,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (radeon_connector->detected_hpd_without_ddc) {
@@ -1665,8 +1673,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && radeon_check_hpd_status_unchanged(connector)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 022/125] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 021/125] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 023/125] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
` (106 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ]
in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index bb41936df0d97..2beaaf4bee687 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -835,7 +835,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
r = pm_runtime_get_sync(dev->dev);
if (r < 0)
- return r;
+ goto pm_put;
fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
if (unlikely(!fpriv)) {
@@ -883,6 +883,7 @@ error_pasid:
out_suspend:
pm_runtime_mark_last_busy(dev->dev);
+pm_put:
pm_runtime_put_autosuspend(dev->dev);
return r;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 023/125] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 022/125] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 024/125] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
` (105 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit 5509ac65f2fe5aa3c0003237ec629ca55024307c ]
in amdgpu_drm_ioctl the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 5e29f14f4b301..63b1e325b45c5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1085,11 +1085,12 @@ long amdgpu_drm_ioctl(struct file *filp,
dev = file_priv->minor->dev;
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0)
- return ret;
+ goto out;
ret = drm_ioctl(filp, cmd, arg);
pm_runtime_mark_last_busy(dev->dev);
+out:
pm_runtime_put_autosuspend(dev->dev);
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 024/125] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 023/125] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 025/125] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
` (104 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]
in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 686a26de50f91..049a1961c3fa5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -275,7 +275,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0)
- return ret;
+ goto out;
ret = drm_crtc_helper_set_config(set, ctx);
@@ -290,7 +290,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
take the current one */
if (active && !adev->have_disp_power_ref) {
adev->have_disp_power_ref = true;
- return ret;
+ goto out;
}
/* if we have no active crtcs, then drop the power ref
we got before */
@@ -299,6 +299,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
adev->have_disp_power_ref = false;
}
+out:
/* drop the power reference we got coming in here */
pm_runtime_put_autosuspend(dev->dev);
return ret;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 025/125] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 024/125] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 026/125] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
` (103 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]
The call to pm_runtime_get_sync increments the counter even in case of
failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index c770d73352a79..c15286858f0bf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -718,8 +718,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (encoder) {
@@ -856,8 +858,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = amdgpu_connector_best_single_encoder(connector);
@@ -979,8 +983,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
@@ -1329,8 +1335,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 026/125] scsi: lpfc: Fix shost refcount mismatch when deleting vport
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 025/125] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 027/125] xfs: Dont allow logging of XFS_ISTALE inodes Greg Kroah-Hartman
` (102 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
Martin K. Petersen, Sasha Levin
From: Dick Kennedy <dick.kennedy@broadcom.com>
[ Upstream commit 03dbfe0668e6692917ac278883e0586cd7f7d753 ]
When vports are deleted, it is observed that there is memory/kthread
leakage as the vport isn't fully being released.
There is a shost reference taken in scsi_add_host_dma that is not released
during scsi_remove_host. It was noticed that other drivers resolve this by
doing a scsi_host_put after calling scsi_remove_host.
The vport_delete routine is taking two references one that corresponds to
an access to the scsi_host in the vport_delete routine and another that is
released after the adapter mailbox command completes that destroys the VPI
that corresponds to the vport.
Remove one of the references taken such that the second reference that is
put will complete the missing scsi_add_host_dma reference and the shost
will be terminated.
Link: https://lore.kernel.org/r/20200630215001.70793-8-jsmart2021@gmail.com
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_vport.c | 26 ++++++++------------------
1 file changed, 8 insertions(+), 18 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index 1ff0f7de91058..64545b300dfc7 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -653,27 +653,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
vport->port_state < LPFC_VPORT_READY)
return -EAGAIN;
}
+
/*
- * This is a bit of a mess. We want to ensure the shost doesn't get
- * torn down until we're done with the embedded lpfc_vport structure.
- *
- * Beyond holding a reference for this function, we also need a
- * reference for outstanding I/O requests we schedule during delete
- * processing. But once we scsi_remove_host() we can no longer obtain
- * a reference through scsi_host_get().
- *
- * So we take two references here. We release one reference at the
- * bottom of the function -- after delinking the vport. And we
- * release the other at the completion of the unreg_vpi that get's
- * initiated after we've disposed of all other resources associated
- * with the port.
+ * Take early refcount for outstanding I/O requests we schedule during
+ * delete processing for unreg_vpi. Always keep this before
+ * scsi_remove_host() as we can no longer obtain a reference through
+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
*/
if (!scsi_host_get(shost))
return VPORT_INVAL;
- if (!scsi_host_get(shost)) {
- scsi_host_put(shost);
- return VPORT_INVAL;
- }
+
lpfc_free_sysfs_attr(vport);
lpfc_debugfs_terminate(vport);
@@ -820,8 +809,9 @@ skip_logo:
if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
lpfc_mbx_unreg_vpi(vport))
scsi_host_put(shost);
- } else
+ } else {
scsi_host_put(shost);
+ }
lpfc_free_vpi(phba, vport->vpi);
vport->work_port_events = 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 027/125] xfs: Dont allow logging of XFS_ISTALE inodes
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 026/125] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 028/125] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
` (101 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Chinner, Brian Foster,
Darrick J. Wong, Sasha Levin
From: Dave Chinner <dchinner@redhat.com>
[ Upstream commit 96355d5a1f0ee6dcc182c37db4894ec0c29f1692 ]
In tracking down a problem in this patchset, I discovered we are
reclaiming dirty stale inodes. This wasn't discovered until inodes
were always attached to the cluster buffer and then the rcu callback
that freed inodes was assert failing because the inode still had an
active pointer to the cluster buffer after it had been reclaimed.
Debugging the issue indicated that this was a pre-existing issue
resulting from the way the inodes are handled in xfs_inactive_ifree.
When we free a cluster buffer from xfs_ifree_cluster, all the inodes
in cache are marked XFS_ISTALE. Those that are clean have nothing
else done to them and so eventually get cleaned up by background
reclaim. i.e. it is assumed we'll never dirty/relog an inode marked
XFS_ISTALE.
On journal commit dirty stale inodes as are handled by both
buffer and inode log items to run though xfs_istale_done() and
removed from the AIL (buffer log item commit) or the log item will
simply unpin it because the buffer log item will clean it. What happens
to any specific inode is entirely dependent on which log item wins
the commit race, but the result is the same - stale inodes are
clean, not attached to the cluster buffer, and not in the AIL. Hence
inode reclaim can just free these inodes without further care.
However, if the stale inode is relogged, it gets dirtied again and
relogged into the CIL. Most of the time this isn't an issue, because
relogging simply changes the inode's location in the current
checkpoint. Problems arise, however, when the CIL checkpoints
between two transactions in the xfs_inactive_ifree() deferops
processing. This results in the XFS_ISTALE inode being redirtied
and inserted into the CIL without any of the other stale cluster
buffer infrastructure being in place.
Hence on journal commit, it simply gets unpinned, so it remains
dirty in memory. Everything in inode writeback avoids XFS_ISTALE
inodes so it can't be written back, and it is not tracked in the AIL
so there's not even a trigger to attempt to clean the inode. Hence
the inode just sits dirty in memory until inode reclaim comes along,
sees that it is XFS_ISTALE, and goes to reclaim it. This reclaiming
of a dirty inode caused use after free, list corruptions and other
nasty issues later in this patchset.
Hence this patch addresses a violation of the "never log XFS_ISTALE
inodes" caused by the deferops processing rolling a transaction
and relogging a stale inode in xfs_inactive_free. It also adds a
bunch of asserts to catch this problem in debug kernels so that
we don't reintroduce this problem in future.
Reproducer for this issue was generic/558 on a v4 filesystem.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/xfs_icache.c | 3 ++-
fs/xfs/xfs_inode.c | 25 ++++++++++++++++++++++---
fs/xfs/xfs_trans_inode.c | 2 ++
3 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 901f27ac94abc..56e9043bddc71 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1127,7 +1127,7 @@ restart:
goto out_ifunlock;
xfs_iunpin_wait(ip);
}
- if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) {
+ if (xfs_inode_clean(ip)) {
xfs_ifunlock(ip);
goto reclaim;
}
@@ -1214,6 +1214,7 @@ reclaim:
xfs_ilock(ip, XFS_ILOCK_EXCL);
xfs_qm_dqdetach(ip);
xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ ASSERT(xfs_inode_clean(ip));
__xfs_inode_free(ip);
return error;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index f2d06e1e49066..cd81d6d9848d1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1772,10 +1772,31 @@ xfs_inactive_ifree(
return error;
}
+ /*
+ * We do not hold the inode locked across the entire rolling transaction
+ * here. We only need to hold it for the first transaction that
+ * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the
+ * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode
+ * here breaks the relationship between cluster buffer invalidation and
+ * stale inode invalidation on cluster buffer item journal commit
+ * completion, and can result in leaving dirty stale inodes hanging
+ * around in memory.
+ *
+ * We have no need for serialising this inode operation against other
+ * operations - we freed the inode and hence reallocation is required
+ * and that will serialise on reallocating the space the deferops need
+ * to free. Hence we can unlock the inode on the first commit of
+ * the transaction rather than roll it right through the deferops. This
+ * avoids relogging the XFS_ISTALE inode.
+ *
+ * We check that xfs_ifree() hasn't grown an internal transaction roll
+ * by asserting that the inode is still locked when it returns.
+ */
xfs_ilock(ip, XFS_ILOCK_EXCL);
- xfs_trans_ijoin(tp, ip, 0);
+ xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
error = xfs_ifree(tp, ip);
+ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
if (error) {
/*
* If we fail to free the inode, shut down. The cancel
@@ -1788,7 +1809,6 @@ xfs_inactive_ifree(
xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
}
xfs_trans_cancel(tp);
- xfs_iunlock(ip, XFS_ILOCK_EXCL);
return error;
}
@@ -1806,7 +1826,6 @@ xfs_inactive_ifree(
xfs_notice(mp, "%s: xfs_trans_commit returned error %d",
__func__, error);
- xfs_iunlock(ip, XFS_ILOCK_EXCL);
return 0;
}
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index 542927321a61b..ae453dd236a69 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -39,6 +39,7 @@ xfs_trans_ijoin(
ASSERT(iip->ili_lock_flags == 0);
iip->ili_lock_flags = lock_flags;
+ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
/*
* Get a log_item_desc to point at the new item.
@@ -90,6 +91,7 @@ xfs_trans_log_inode(
ASSERT(ip->i_itemp != NULL);
ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
/*
* Don't bother with i_lock for the I_DIRTY_TIME check here, as races
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 028/125] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 027/125] xfs: Dont allow logging of XFS_ISTALE inodes Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 029/125] f2fs: fix error path in do_recover_data() Greg Kroah-Hartman
` (100 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Desnes A. Nunes do Rosario,
Sachin Sant, Michael Ellerman, Sasha Levin
From: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
[ Upstream commit 3337bf41e0dd70b4064cdf60acdfcdc2d050066c ]
An extra count on ebb_state.stats.pmc_count[PMC_INDEX(pmc)] is being per-
formed when count_pmc() is used to reset PMCs on a few selftests. This
extra pmc_count can occasionally invalidate results, such as the ones from
cycles_test shown hereafter. The ebb_check_count() failed with an above
the upper limit error due to the extra value on ebb_state.stats.pmc_count.
Furthermore, this extra count is also indicated by extra PMC1 trace_log on
the output of the cycle test (as well as on pmc56_overflow_test):
==========
...
[21]: counter = 8
[22]: register SPRN_MMCR0 = 0x0000000080000080
[23]: register SPRN_PMC1 = 0x0000000080000004
[24]: counter = 9
[25]: register SPRN_MMCR0 = 0x0000000080000080
[26]: register SPRN_PMC1 = 0x0000000080000004
[27]: counter = 10
[28]: register SPRN_MMCR0 = 0x0000000080000080
[29]: register SPRN_PMC1 = 0x0000000080000004
>> [30]: register SPRN_PMC1 = 0x000000004000051e
PMC1 count (0x280000546) above upper limit 0x2800003e8 (+0x15e)
[FAIL] Test FAILED on line 52
failure: cycles
==========
Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200626164737.21943-1-desnesn@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 --
tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | 2 --
.../selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 --
.../selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 --
tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 --
.../selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 --
.../selftests/powerpc/pmu/ebb/lost_exception_test.c | 1 -
.../testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 -------
.../selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 --
.../testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 --
.../selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | 2 --
11 files changed, 26 deletions(-)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
index 94110b1dcd3d8..031baa43646fb 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
index 7c57a8d79535d..361e0be9df9ae 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
@@ -42,8 +42,6 @@ int cycles(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
index ecf5ee3283a3e..fe7d0dc2a1a26 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
printf("EBBs while frozen %d\n", ebbs_while_frozen);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
index c0faba520b35c..b9b30f974b5ea 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
index 46681fec549b8..2694ae161a84a 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
index a991d2ea8d0a1..174e4f4dae6c0 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
FAIL_IF(ebb_state.stats.ebb_count == 0);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
index 2ed7ad33f7a3b..dddb95938304e 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
@@ -75,7 +75,6 @@ static int test_body(void)
ebb_freeze_pmcs();
ebb_global_disable();
- count_pmc(4, sample_period);
mtspr(SPRN_PMC4, 0xdead);
dump_summary_ebb_state();
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
index 6ff8c8ff27d66..035c02273cd49 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
@@ -70,13 +70,6 @@ int multi_counter(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
- count_pmc(2, sample_period);
- count_pmc(3, sample_period);
- count_pmc(4, sample_period);
- count_pmc(5, sample_period);
- count_pmc(6, sample_period);
-
dump_ebb_state();
for (i = 0; i < 6; i++)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
index 037cb6154f360..3e9d4ac965c85 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
@@ -61,8 +61,6 @@ static int cycles_child(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_summary_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
index c5fa64790c22e..d90891fe96a32 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
@@ -82,8 +82,6 @@ static int test_body(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
if (mmcr0_mismatch)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
index 30e1ac62e8cb4..8ca92b9ee5b01 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
@@ -76,8 +76,6 @@ int pmc56_overflow(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(2, sample_period);
-
dump_ebb_state();
printf("PMC5/6 overflow %d\n", pmc56_overflowed);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 029/125] f2fs: fix error path in do_recover_data()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 028/125] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 030/125] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync Greg Kroah-Hartman
` (99 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 9627a7b31f3c4ff8bc8f3be3683983ffe6eaebe6 ]
- don't panic kernel if f2fs_get_node_page() fails in
f2fs_recover_inline_data() or f2fs_recover_inline_xattr();
- return error number of f2fs_truncate_blocks() to
f2fs_recover_inline_data()'s caller;
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/f2fs.h | 4 ++--
fs/f2fs/inline.c | 19 ++++++++++++-------
fs/f2fs/node.c | 6 ++++--
fs/f2fs/recovery.c | 10 ++++++++--
4 files changed, 26 insertions(+), 13 deletions(-)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 6b5b685af5990..53ffa6fe207a3 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2921,7 +2921,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
+int f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
int f2fs_recover_xattr_data(struct inode *inode, struct page *page);
int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page);
int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
@@ -3314,7 +3314,7 @@ int f2fs_read_inline_data(struct inode *inode, struct page *page);
int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page);
int f2fs_convert_inline_inode(struct inode *inode);
int f2fs_write_inline_data(struct inode *inode, struct page *page);
-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage);
+int f2fs_recover_inline_data(struct inode *inode, struct page *npage);
struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
struct fscrypt_name *fname, struct page **res_page);
int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent,
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index c1ba29d10789d..2fabeb0bb28fd 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -256,7 +256,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)
return 0;
}
-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
+int f2fs_recover_inline_data(struct inode *inode, struct page *npage)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
struct f2fs_inode *ri = NULL;
@@ -278,7 +278,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
ri && (ri->i_inline & F2FS_INLINE_DATA)) {
process_inline:
ipage = f2fs_get_node_page(sbi, inode->i_ino);
- f2fs_bug_on(sbi, IS_ERR(ipage));
+ if (IS_ERR(ipage))
+ return PTR_ERR(ipage);
f2fs_wait_on_page_writeback(ipage, NODE, true);
@@ -291,21 +292,25 @@ process_inline:
set_page_dirty(ipage);
f2fs_put_page(ipage, 1);
- return true;
+ return 1;
}
if (f2fs_has_inline_data(inode)) {
ipage = f2fs_get_node_page(sbi, inode->i_ino);
- f2fs_bug_on(sbi, IS_ERR(ipage));
+ if (IS_ERR(ipage))
+ return PTR_ERR(ipage);
f2fs_truncate_inline_inode(inode, ipage, 0);
clear_inode_flag(inode, FI_INLINE_DATA);
f2fs_put_page(ipage, 1);
} else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
- if (f2fs_truncate_blocks(inode, 0, false))
- return false;
+ int ret;
+
+ ret = f2fs_truncate_blocks(inode, 0, false);
+ if (ret)
+ return ret;
goto process_inline;
}
- return false;
+ return 0;
}
struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index f0714c1258c79..2ff02541c53d5 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -2451,7 +2451,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink)
return nr - nr_shrink;
}
-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+int f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
{
void *src_addr, *dst_addr;
size_t inline_size;
@@ -2459,7 +2459,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
struct f2fs_inode *ri;
ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino);
- f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(ipage));
+ if (IS_ERR(ipage))
+ return PTR_ERR(ipage);
ri = F2FS_INODE(page);
if (ri->i_inline & F2FS_INLINE_XATTR) {
@@ -2478,6 +2479,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
update_inode:
f2fs_update_inode(inode, ipage);
f2fs_put_page(ipage, 1);
+ return 0;
}
int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
index 733f005b85d65..ad0486beee2c0 100644
--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -471,7 +471,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
/* step 1: recover xattr */
if (IS_INODE(page)) {
- f2fs_recover_inline_xattr(inode, page);
+ err = f2fs_recover_inline_xattr(inode, page);
+ if (err)
+ goto out;
} else if (f2fs_has_xattr_block(ofs_of_node(page))) {
err = f2fs_recover_xattr_data(inode, page);
if (!err)
@@ -480,8 +482,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
}
/* step 2: recover inline data */
- if (f2fs_recover_inline_data(inode, page))
+ err = f2fs_recover_inline_data(inode, page);
+ if (err) {
+ if (err == 1)
+ err = 0;
goto out;
+ }
/* step 3: recover data indices */
start = f2fs_start_bidx_of_node(ofs_of_node(page), inode);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 030/125] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 029/125] f2fs: fix error path in do_recover_data() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 031/125] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
` (98 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, kjlu, wu000273,
Allison Randal, Thomas Gleixner, Enrico Weigelt, Andrew F. Davis,
Tomi Valkeinen, Alexios Zavras, YueHaibing,
Bartlomiej Zolnierkiewicz, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit 78c2ce9bde70be5be7e3615a2ae7024ed8173087 ]
On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Cc: kjlu@umn.edu
Cc: wu000273@umn.edu
Cc: Allison Randal <allison@lohutok.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Enrico Weigelt <info@metux.net>
cc: "Andrew F. Davis" <afd@ti.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200614030528.128064-1-pakki001@umn.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 7 +++++--
drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 7 +++++--
drivers/video/fbdev/omap2/omapfb/dss/dss.c | 7 +++++--
drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | 5 +++--
drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | 5 +++--
drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +++++--
6 files changed, 26 insertions(+), 12 deletions(-)
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
index a06d9c25765c5..0bd582e845f31 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
@@ -531,8 +531,11 @@ int dispc_runtime_get(void)
DSSDBG("dispc_runtime_get\n");
r = pm_runtime_get_sync(&dispc.pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&dispc.pdev->dev);
+ return r;
+ }
+ return 0;
}
EXPORT_SYMBOL(dispc_runtime_get);
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
index 8e1d60d48dbb0..50792d31533bf 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
@@ -1148,8 +1148,11 @@ static int dsi_runtime_get(struct platform_device *dsidev)
DSSDBG("dsi_runtime_get\n");
r = pm_runtime_get_sync(&dsi->pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&dsi->pdev->dev);
+ return r;
+ }
+ return 0;
}
static void dsi_runtime_put(struct platform_device *dsidev)
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
index b6c6c24979dd6..faebf9a773ba5 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
@@ -779,8 +779,11 @@ int dss_runtime_get(void)
DSSDBG("dss_runtime_get\n");
r = pm_runtime_get_sync(&dss.pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&dss.pdev->dev);
+ return r;
+ }
+ return 0;
}
void dss_runtime_put(void)
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
index 28de56e21c74b..9fd9a02bb871d 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
@@ -50,9 +50,10 @@ static int hdmi_runtime_get(void)
DSSDBG("hdmi_runtime_get\n");
r = pm_runtime_get_sync(&hdmi.pdev->dev);
- WARN_ON(r < 0);
- if (r < 0)
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&hdmi.pdev->dev);
return r;
+ }
return 0;
}
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
index 2e2fcc3d6d4f7..13f3a5ce55294 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
@@ -54,9 +54,10 @@ static int hdmi_runtime_get(void)
DSSDBG("hdmi_runtime_get\n");
r = pm_runtime_get_sync(&hdmi.pdev->dev);
- WARN_ON(r < 0);
- if (r < 0)
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&hdmi.pdev->dev);
return r;
+ }
return 0;
}
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
index 392464da12e41..96714b4596d2d 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
@@ -402,8 +402,11 @@ static int venc_runtime_get(void)
DSSDBG("venc_runtime_get\n");
r = pm_runtime_get_sync(&venc.pdev->dev);
- WARN_ON(r < 0);
- return r < 0 ? r : 0;
+ if (WARN_ON(r < 0)) {
+ pm_runtime_put_sync(&venc.pdev->dev);
+ return r;
+ }
+ return 0;
}
static void venc_runtime_put(void)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 031/125] PCI: Fix pci_create_slot() reference count leak
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 030/125] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 032/125] ARM: dts: ls1021a: output PPS signal on FIPER2 Greg Kroah-Hartman
` (97 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Bjorn Helgaas, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit 8a94644b440eef5a7b9c104ac8aa7a7f413e35e5 ]
kobject_init_and_add() takes a reference even when it fails. If it returns
an error, kobject_put() must be called to clean up the memory associated
with the object.
When kobject_init_and_add() fails, call kobject_put() instead of kfree().
b8eb718348b8 ("net-sysfs: Fix reference count leak in
rx|netdev_queue_add_kobject") fixed a similar problem.
Link: https://lore.kernel.org/r/20200528021322.1984-1-wu000273@umn.edu
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/slot.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index a32897f83ee51..fb7478b6c4f9d 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -303,13 +303,16 @@ placeholder:
slot_name = make_slot_name(name);
if (!slot_name) {
err = -ENOMEM;
+ kfree(slot);
goto err;
}
err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
"%s", slot_name);
- if (err)
+ if (err) {
+ kobject_put(&slot->kobj);
goto err;
+ }
INIT_LIST_HEAD(&slot->list);
list_add(&slot->list, &parent->slots);
@@ -328,7 +331,6 @@ out:
mutex_unlock(&pci_slot_mutex);
return slot;
err:
- kfree(slot);
slot = ERR_PTR(err);
goto out;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 032/125] ARM: dts: ls1021a: output PPS signal on FIPER2
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 031/125] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 033/125] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
` (96 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yangbo Lu, Richard Cochran,
Shawn Guo, Sasha Levin
From: Yangbo Lu <yangbo.lu@nxp.com>
[ Upstream commit 5656bb3857c4904d1dec6e1b8f876c1c0337274e ]
The timer fixed interval period pulse generator register
is used to generate periodic pulses. The down count
register loads the value programmed in the fixed period
interval (FIPER). At every tick of the timer accumulator
overflow, the counter decrements by the value of
TMR_CTRL[TCLK_PERIOD]. It generates a pulse when the down
counter value reaches zero. It reloads the down counter
in the cycle following a pulse.
To use the TMR_FIPER register to generate desired periodic
pulses. The value should programmed is,
desired_period - tclk_period
Current tmr-fiper2 value is to generate 100us periodic pulses.
(But the value should have been 99995, not 99990. The tclk_period is 5.)
This patch is to generate 1 second periodic pulses with value
999999995 programmed which is more desired by user.
Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ls1021a.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
index 074b4ec520c63..d18c043264440 100644
--- a/arch/arm/boot/dts/ls1021a.dtsi
+++ b/arch/arm/boot/dts/ls1021a.dtsi
@@ -609,7 +609,7 @@
fsl,tmr-prsc = <2>;
fsl,tmr-add = <0xaaaaaaab>;
fsl,tmr-fiper1 = <999999995>;
- fsl,tmr-fiper2 = <99990>;
+ fsl,tmr-fiper2 = <999999995>;
fsl,max-adj = <499999999>;
};
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 033/125] rtlwifi: rtl8192cu: Prevent leaking urb
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 032/125] ARM: dts: ls1021a: output PPS signal on FIPER2 Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 034/125] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
` (95 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Reto Schneider, Kalle Valo, Sasha Levin
From: Reto Schneider <code@reto-schneider.ch>
[ Upstream commit 03128643eb5453a798db5770952c73dc64fcaf00 ]
If usb_submit_urb fails the allocated urb should be unanchored and
released.
Signed-off-by: Reto Schneider <code@reto-schneider.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200622132113.14508-3-code@reto-schneider.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 1893640555c1e..3d6c0d8c71d7e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -739,8 +739,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
usb_anchor_urb(urb, &rtlusb->rx_submitted);
err = usb_submit_urb(urb, GFP_KERNEL);
- if (err)
+ if (err) {
+ usb_unanchor_urb(urb);
+ usb_free_urb(urb);
goto err_out;
+ }
usb_free_urb(urb);
}
return 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 034/125] mips/vdso: Fix resource leaks in genvdso.c
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 033/125] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 035/125] cec-api: prevent leaking memory through hole in structure Greg Kroah-Hartman
` (94 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peng Fan, Thomas Bogendoerfer, Sasha Levin
From: Peng Fan <fanpeng@loongson.cn>
[ Upstream commit a859647b4e6bfeb192284d27d24b6a0c914cae1d ]
Close "fd" before the return of map_vdso() and close "out_file"
in main().
Signed-off-by: Peng Fan <fanpeng@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/vdso/genvdso.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
index 530a36f465ced..afcc86726448e 100644
--- a/arch/mips/vdso/genvdso.c
+++ b/arch/mips/vdso/genvdso.c
@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (fstat(fd, &stat) != 0) {
fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
path, strerror(errno));
+ close(fd);
return NULL;
}
@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (addr == MAP_FAILED) {
fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
path, strerror(errno));
+ close(fd);
return NULL;
}
@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
path);
+ close(fd);
return NULL;
}
@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size)
default:
fprintf(stderr, "%s: '%s' has invalid ELF class\n",
program_name, path);
+ close(fd);
return NULL;
}
@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size)
default:
fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
program_name, path);
+ close(fd);
return NULL;
}
@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size)
fprintf(stderr,
"%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
program_name, path);
+ close(fd);
return NULL;
} else if (swap_uint16(ehdr->e_type) != ET_DYN) {
fprintf(stderr,
"%s: '%s' has invalid ELF type (expected ET_DYN)\n",
program_name, path);
+ close(fd);
return NULL;
}
*_size = stat.st_size;
+ close(fd);
return addr;
}
@@ -284,10 +292,12 @@ int main(int argc, char **argv)
/* Calculate and write symbol offsets to <output file> */
if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
unlink(out_path);
+ fclose(out_file);
return EXIT_FAILURE;
}
fprintf(out_file, "};\n");
+ fclose(out_file);
return EXIT_SUCCESS;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 035/125] cec-api: prevent leaking memory through hole in structure
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 034/125] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 036/125] HID: quirks: add NOGET quirk for Logitech GROUP Greg Kroah-Hartman
` (93 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab,
Sasha Levin
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 6c42227c3467549ddc65efe99c869021d2f4a570 ]
Fix this smatch warning:
drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after
'features')
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/cec-api.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 4961573850d54..b2b3f779592fd 100644
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
struct cec_log_addrs log_addrs;
mutex_lock(&adap->lock);
- log_addrs = adap->log_addrs;
+ /*
+ * We use memcpy here instead of assignment since there is a
+ * hole at the end of struct cec_log_addrs that an assignment
+ * might ignore. So when we do copy_to_user() we could leak
+ * one byte of memory.
+ */
+ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
if (!adap->is_configured)
memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
sizeof(log_addrs.log_addr));
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 036/125] HID: quirks: add NOGET quirk for Logitech GROUP
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 035/125] cec-api: prevent leaking memory through hole in structure Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 037/125] f2fs: fix use-after-free issue Greg Kroah-Hartman
` (92 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ikjoon Jang, Jiri Kosina, Sasha Levin
From: Ikjoon Jang <ikjn@chromium.org>
[ Upstream commit 68f775ddd2a6f513e225f9a565b054ab48fef142 ]
Add HID_QUIRK_NOGET for Logitech GROUP device.
Logitech GROUP is a compound with camera and audio.
When the HID interface in an audio device is requested to get
specific report id, all following control transfers are stalled
and never be restored back.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203419
Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 20530d8adfbb8..2c100b73d3fc1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -756,6 +756,7 @@
#define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b
#define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c
#define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a
+#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882
#define USB_DEVICE_ID_S510_RECEIVER 0xc50c
#define USB_DEVICE_ID_S510_RECEIVER_2 0xc517
#define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index bdde16395b2ce..62f87f8bd9720 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
{ 0 }
};
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 037/125] f2fs: fix use-after-free issue
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 036/125] HID: quirks: add NOGET quirk for Logitech GROUP Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 038/125] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
` (91 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Li Guifu, Chao Yu, Jaegeuk Kim, Sasha Levin
From: Li Guifu <bluce.liguifu@huawei.com>
[ Upstream commit 99c787cfd2bd04926f1f553b30bd7dcea2caaba1 ]
During umount, f2fs_put_super() unregisters procfs entries after
f2fs_destroy_segment_manager(), it may cause use-after-free
issue when umount races with procfs accessing, fix it by relocating
f2fs_unregister_sysfs().
[Chao Yu: change commit title/message a bit]
Signed-off-by: Li Guifu <bluce.liguifu@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 9782250c98156..161ce0eb8891a 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1004,6 +1004,9 @@ static void f2fs_put_super(struct super_block *sb)
int i;
bool dropped;
+ /* unregister procfs/sysfs entries in advance to avoid race case */
+ f2fs_unregister_sysfs(sbi);
+
f2fs_quota_off_umount(sb);
/* prevent remaining shrinker jobs */
@@ -1067,8 +1070,6 @@ static void f2fs_put_super(struct super_block *sb)
kfree(sbi->ckpt);
- f2fs_unregister_sysfs(sbi);
-
sb->s_fs_info = NULL;
if (sbi->s_chksum_driver)
crypto_free_shash(sbi->s_chksum_driver);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 038/125] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 037/125] f2fs: fix use-after-free issue Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 039/125] drm/nouveau: fix reference count leak in nv50_disp_atomic_commit Greg Kroah-Hartman
` (90 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Ben Skeggs, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]
nouveau_fbcon_open() calls calls pm_runtime_get_sync() that
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 406cb99af7f21..d4fe52ec4c966 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
struct nouveau_fbdev *fbcon = info->par;
struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev);
int ret = pm_runtime_get_sync(drm->dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put(drm->dev->dev);
return ret;
+ }
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 039/125] drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 038/125] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 040/125] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
` (89 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Ben Skeggs, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit a2cdf39536b0d21fb06113f5e16692513d7bcb9c ]
nv50_disp_atomic_commit() calls calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 10107e551fac3..e06ea8c8184cb 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1920,8 +1920,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,
int ret, i;
ret = pm_runtime_get_sync(dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
return ret;
+ }
ret = drm_atomic_helper_setup_commit(state, nonblock);
if (ret)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 040/125] drm/nouveau: Fix reference count leak in nouveau_connector_detect
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 039/125] drm/nouveau: fix reference count leak in nv50_disp_atomic_commit Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 041/125] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
` (88 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Ben Skeggs, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]
nouveau_connector_detect() calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index fb0094fc55834..b71afde8f115a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -551,8 +551,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
pm_runtime_get_noresume(dev->dev);
} else {
ret = pm_runtime_get_sync(dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
return conn_status;
+ }
}
nv_encoder = nouveau_connector_ddc_detect(connector);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 041/125] locking/lockdep: Fix overflow in presentation of average lock-time
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 040/125] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 042/125] btrfs: file: reserve qgroup space after the hole punch range is locked Greg Kroah-Hartman
` (87 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Ingo Molnar,
Peter Zijlstra, Sasha Levin
From: Chris Wilson <chris@chris-wilson.co.uk>
[ Upstream commit a7ef9b28aa8d72a1656fa6f0a01bbd1493886317 ]
Though the number of lock-acquisitions is tracked as unsigned long, this
is passed as the divisor to div_s64() which interprets it as a s32,
giving nonsense values with more than 2 billion acquisitons. E.g.
acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
-------------------------------------------------------------------------
2350439395 0.07 353.38 649647067.36 0.-32
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20200725185110.11588-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/lockdep_proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index 6fcc4650f0c48..53cc3bb7025a5 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -394,7 +394,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
seq_time(m, lt->min);
seq_time(m, lt->max);
seq_time(m, lt->total);
- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
+ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
}
static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 042/125] btrfs: file: reserve qgroup space after the hole punch range is locked
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 041/125] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 043/125] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
` (86 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Qu Wenruo, David Sterba,
Sasha Levin
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit a7f8b1c2ac21bf081b41264c9cfd6260dffa6246 ]
The incoming qgroup reserved space timing will move the data reservation
to ordered extent completely.
However in btrfs_punch_hole_lock_range() will call
btrfs_invalidate_page(), which will clear QGROUP_RESERVED bit for the
range.
In current stage it's OK, but if we're making ordered extents handle the
reserved space, then btrfs_punch_hole_lock_range() can clear the
QGROUP_RESERVED bit before we submit ordered extent, leading to qgroup
reserved space leakage.
So here change the timing to make reserve data space after
btrfs_punch_hole_lock_range().
The new timing is fine for either current code or the new code.
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/file.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index dc1841855a69a..646152f305843 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -3010,14 +3010,14 @@ reserve_space:
if (ret < 0)
goto out;
space_reserved = true;
- ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
- alloc_start, bytes_to_reserve);
- if (ret)
- goto out;
ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend,
&cached_state);
if (ret)
goto out;
+ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
+ alloc_start, bytes_to_reserve);
+ if (ret)
+ goto out;
ret = btrfs_prealloc_file_range(inode, mode, alloc_start,
alloc_end - alloc_start,
i_blocksize(inode),
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 043/125] scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 042/125] btrfs: file: reserve qgroup space after the hole punch range is locked Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.19 044/125] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
` (85 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Jing Xiangfeng,
Martin K. Petersen, Sasha Levin
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
[ Upstream commit 68e12e5f61354eb42cfffbc20a693153fc39738e ]
If scsi_host_lookup() fails we will jump to put_host which may cause a
panic. Jump to exit_set_fnode instead.
Link: https://lore.kernel.org/r/20200615081226.183068-1-jingxiangfeng@huawei.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_iscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 04d095488c764..6983473011980 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3172,7 +3172,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
pr_err("%s could not find host no %u\n",
__func__, ev->u.set_flashnode.host_no);
err = -ENODEV;
- goto put_host;
+ goto exit_set_fnode;
}
idx = ev->u.set_flashnode.flashnode_idx;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 044/125] ceph: fix potential mdsc use-after-free crash
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 043/125] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 045/125] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
` (84 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiubo Li, Jeff Layton, Ilya Dryomov,
Sasha Levin
From: Xiubo Li <xiubli@redhat.com>
[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]
Make sure the delayed work stopped before releasing the resources.
cancel_delayed_work_sync() will only guarantee that the work finishes
executing if the work is already in the ->worklist. That means after
the cancel_delayed_work_sync() returns, it will leave the work requeued
if it was rearmed at the end. That can lead to a use after free once the
work struct is freed.
Fix it by flushing the delayed work instead of trying to cancel it, and
ensure that the work doesn't rearm if the mdsc is stopping.
URL: https://tracker.ceph.com/issues/46293
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 0fa14d8b9c64c..5f3707a90e7f7 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3615,6 +3615,9 @@ static void delayed_work(struct work_struct *work)
dout("mdsc delayed_work\n");
ceph_check_delayed_caps(mdsc);
+ if (mdsc->stopping)
+ return;
+
mutex_lock(&mdsc->mutex);
renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
renew_caps = time_after_eq(jiffies, HZ*renew_interval +
@@ -3950,7 +3953,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
{
dout("stop\n");
- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
+ /*
+ * Make sure the delayed work stopped before releasing
+ * the resources.
+ *
+ * Because the cancel_delayed_work_sync() will only
+ * guarantee that the work finishes executing. But the
+ * delayed work will re-arm itself again after that.
+ */
+ flush_delayed_work(&mdsc->delayed_work);
+
if (mdsc->mdsmap)
ceph_mdsmap_destroy(mdsc->mdsmap);
kfree(mdsc->sessions);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 045/125] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.19 044/125] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 046/125] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
` (83 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Girish Basrur, Santosh Vernekar,
Saurav Kashyap, Shyam Sundar, Javed Hasan, Martin K. Petersen,
Sasha Levin
From: Javed Hasan <jhasan@marvell.com>
[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]
In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then
freed it if ctlr_dev was not NULL. This was causing a memory leak.
Free the fcf even if ctlr_dev is NULL.
Link: https://lore.kernel.org/r/20200729081824.30996-3-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 24cbd0a2cc69f..658c0726581f9 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
WARN_ON(!fcf_dev);
new->fcf_dev = NULL;
fcoe_fcf_device_delete(fcf_dev);
- kfree(new);
mutex_unlock(&cdev->lock);
}
+ kfree(new);
}
/**
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 046/125] EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 045/125] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
` (82 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Baron, Borislav Petkov,
Mauro Carvalho Chehab, linux-edac, Tony Luck, Sasha Levin
From: Jason Baron <jbaron@akamai.com>
[ Upstream commit 709ed1bcef12398ac1a35c149f3e582db04456c2 ]
The Intel uncore driver may claim some of the pci ids from ie31200 which
means that the ie31200 edac driver will not initialize them as part of
pci_register_driver().
Let's add a fallback for this case to 'pci_get_device()' to get a
reference on the device such that it can still be configured. This is
similar in approach to other edac drivers.
Signed-off-by: Jason Baron <jbaron@akamai.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-edac <linux-edac@vger.kernel.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/1594923911-10885-1-git-send-email-jbaron@akamai.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/ie31200_edac.c | 50 ++++++++++++++++++++++++++++++++++---
1 file changed, 47 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
index aac9b9b360b80..9e4781a807cfa 100644
--- a/drivers/edac/ie31200_edac.c
+++ b/drivers/edac/ie31200_edac.c
@@ -147,6 +147,8 @@
(n << (28 + (2 * skl) - PAGE_SHIFT))
static int nr_channels;
+static struct pci_dev *mci_pdev;
+static int ie31200_registered = 1;
struct ie31200_priv {
void __iomem *window;
@@ -518,12 +520,16 @@ fail_free:
static int ie31200_init_one(struct pci_dev *pdev,
const struct pci_device_id *ent)
{
- edac_dbg(0, "MC:\n");
+ int rc;
+ edac_dbg(0, "MC:\n");
if (pci_enable_device(pdev) < 0)
return -EIO;
+ rc = ie31200_probe1(pdev, ent->driver_data);
+ if (rc == 0 && !mci_pdev)
+ mci_pdev = pci_dev_get(pdev);
- return ie31200_probe1(pdev, ent->driver_data);
+ return rc;
}
static void ie31200_remove_one(struct pci_dev *pdev)
@@ -532,6 +538,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
struct ie31200_priv *priv;
edac_dbg(0, "\n");
+ pci_dev_put(mci_pdev);
+ mci_pdev = NULL;
mci = edac_mc_del_mc(&pdev->dev);
if (!mci)
return;
@@ -583,17 +591,53 @@ static struct pci_driver ie31200_driver = {
static int __init ie31200_init(void)
{
+ int pci_rc, i;
+
edac_dbg(3, "MC:\n");
/* Ensure that the OPSTATE is set correctly for POLL or NMI */
opstate_init();
- return pci_register_driver(&ie31200_driver);
+ pci_rc = pci_register_driver(&ie31200_driver);
+ if (pci_rc < 0)
+ goto fail0;
+
+ if (!mci_pdev) {
+ ie31200_registered = 0;
+ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
+ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
+ ie31200_pci_tbl[i].device,
+ NULL);
+ if (mci_pdev)
+ break;
+ }
+ if (!mci_pdev) {
+ edac_dbg(0, "ie31200 pci_get_device fail\n");
+ pci_rc = -ENODEV;
+ goto fail1;
+ }
+ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
+ if (pci_rc < 0) {
+ edac_dbg(0, "ie31200 init fail\n");
+ pci_rc = -ENODEV;
+ goto fail1;
+ }
+ }
+ return 0;
+
+fail1:
+ pci_unregister_driver(&ie31200_driver);
+fail0:
+ pci_dev_put(mci_pdev);
+
+ return pci_rc;
}
static void __exit ie31200_exit(void)
{
edac_dbg(3, "MC:\n");
pci_unregister_driver(&ie31200_driver);
+ if (!ie31200_registered)
+ ie31200_remove_one(mci_pdev);
}
module_init(ie31200_init);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 046/125] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 18:42 ` Pavel Machek
2020-09-01 15:10 ` [PATCH 4.19 048/125] KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe Greg Kroah-Hartman
` (81 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evgeny Novikov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
and unregisters the V4L2 device. But then this is done again by
vpif_probe() itself. The patch removes the cleaning from
vpif_probe_complete().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/davinci/vpif_capture.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index a96f53ce80886..cf1d11e6dd8c4 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1489,8 +1489,6 @@ probe_out:
/* Unregister video device */
video_unregister_device(&ch->video_dev);
}
- kfree(vpif_obj.sd);
- v4l2_device_unregister(&vpif_obj.v4l2_dev);
return err;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free
2020-09-01 15:10 ` [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
@ 2020-09-01 18:42 ` Pavel Machek
2020-09-02 7:39 ` Greg Kroah-Hartman
2020-09-02 8:42 ` Evgeny Novikov
0 siblings, 2 replies; 147+ messages in thread
From: Pavel Machek @ 2020-09-01 18:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Evgeny Novikov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1683 bytes --]
Hi!
> [ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
>
> In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
> and unregisters the V4L2 device. But then this is done again by
> vpif_probe() itself. The patch removes the cleaning from
> vpif_probe_complete().
> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/media/platform/davinci/vpif_capture.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
> index a96f53ce80886..cf1d11e6dd8c4 100644
> --- a/drivers/media/platform/davinci/vpif_capture.c
> +++ b/drivers/media/platform/davinci/vpif_capture.c
> @@ -1489,8 +1489,6 @@ probe_out:
> /* Unregister video device */
> video_unregister_device(&ch->video_dev);
> }
> - kfree(vpif_obj.sd);
> - v4l2_device_unregister(&vpif_obj.v4l2_dev);
>
> return err;
> }
This one is wrong. Unlike mainline, 4.19 does check return value of
vpif_probe_complete(), and thus it will lead to memory leak in 4.19.
Furthermore, I believe mainline still has a problems after this
patch. There is sync and async path where vpif_probe_complete(), and
while this fixes the sync path in mainline, I believe it will cause
memory leak on the async path.
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free
2020-09-01 18:42 ` Pavel Machek
@ 2020-09-02 7:39 ` Greg Kroah-Hartman
2020-09-02 8:42 ` Evgeny Novikov
1 sibling, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-02 7:39 UTC (permalink / raw)
To: Pavel Machek
Cc: linux-kernel, stable, Evgeny Novikov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
On Tue, Sep 01, 2020 at 08:42:58PM +0200, Pavel Machek wrote:
> Hi!
>
> > [ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
> >
> > In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
> > and unregisters the V4L2 device. But then this is done again by
> > vpif_probe() itself. The patch removes the cleaning from
> > vpif_probe_complete().
>
> > Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> > Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> > Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> > drivers/media/platform/davinci/vpif_capture.c | 2 --
> > 1 file changed, 2 deletions(-)
> >
> > diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
> > index a96f53ce80886..cf1d11e6dd8c4 100644
> > --- a/drivers/media/platform/davinci/vpif_capture.c
> > +++ b/drivers/media/platform/davinci/vpif_capture.c
> > @@ -1489,8 +1489,6 @@ probe_out:
> > /* Unregister video device */
> > video_unregister_device(&ch->video_dev);
> > }
> > - kfree(vpif_obj.sd);
> > - v4l2_device_unregister(&vpif_obj.v4l2_dev);
> >
> > return err;
> > }
>
> This one is wrong. Unlike mainline, 4.19 does check return value of
> vpif_probe_complete(), and thus it will lead to memory leak in 4.19.
Thanks, now dropped.
greg k-h
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free
2020-09-01 18:42 ` Pavel Machek
2020-09-02 7:39 ` Greg Kroah-Hartman
@ 2020-09-02 8:42 ` Evgeny Novikov
1 sibling, 0 replies; 147+ messages in thread
From: Evgeny Novikov @ 2020-09-02 8:42 UTC (permalink / raw)
To: Pavel Machek, Greg Kroah-Hartman
Cc: linux-kernel, stable, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
Hi Pavel,
Maybe I miss something, but it seems that in 4.19 vpif_probe() ignores
error codes from vpif_probe_complete() and returns 0 even if it fails.
That was fixed by commit 64f883cd98c6, but it was not backported to 4.19.
In addition, this commit contains a fix of one more bug.
Regarding your second note. I investigated other drivers that use the same
mechanism and did not find out any driver that performs clean up in the
complete handler. In particular, this is the case for very similar driver
vpif_display.c. I am not an expert in this subsystem, so, I can not reason
why this is so.
--
Best regards,
Evgeny Novikov
01.09.2020, 21:43, "Pavel Machek" <pavel@denx.de>:
> Hi!
>
>> [ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
>>
>> In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
>> and unregisters the V4L2 device. But then this is done again by
>> vpif_probe() itself. The patch removes the cleaning from
>> vpif_probe_complete().
>
>> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
>> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
>> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/media/platform/davinci/vpif_capture.c | 2 --
>> 1 file changed, 2 deletions(-)
>>
>> diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
>> index a96f53ce80886..cf1d11e6dd8c4 100644
>> --- a/drivers/media/platform/davinci/vpif_capture.c
>> +++ b/drivers/media/platform/davinci/vpif_capture.c
>> @@ -1489,8 +1489,6 @@ probe_out:
>> /* Unregister video device */
>> video_unregister_device(&ch->video_dev);
>> }
>> - kfree(vpif_obj.sd);
>> - v4l2_device_unregister(&vpif_obj.v4l2_dev);
>>
>> return err;
>> }
>
> This one is wrong. Unlike mainline, 4.19 does check return value of
> vpif_probe_complete(), and thus it will lead to memory leak in 4.19.
>
> Furthermore, I believe mainline still has a problems after this
> patch. There is sync and async path where vpif_probe_complete(), and
> while this fixes the sync path in mainline, I believe it will cause
> memory leak on the async path.
>
> Best regards,
> Pavel
>
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 048/125] KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 047/125] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 049/125] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
` (80 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Brazdil, Marc Zyngier, Sasha Levin
From: David Brazdil <dbrazdil@google.com>
[ Upstream commit b38b298aa4397e2dc74a89b4dd3eac9e59b64c96 ]
__hyp_call_panic_nvhe contains inline assembly which did not declare
its dependency on the __hyp_panic_string symbol.
The static-declared string has previously been kept alive because of a use in
__hyp_call_panic_vhe. Fix this in preparation for separating the source files
between VHE and nVHE when the two users land in two different compilation
units. The static variable otherwise gets dropped when compiling the nVHE
source file, causing an undefined symbol linker error later.
Signed-off-by: David Brazdil <dbrazdil@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20200625131420.71444-2-dbrazdil@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/switch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index f3978931aaf40..3cdefd84af545 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -626,7 +626,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par,
* making sure it is a kernel address and not a PC-relative
* reference.
*/
- asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va));
+ asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string));
__hyp_do_panic(str_va,
spsr, elr,
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 049/125] powerpc/spufs: add CONFIG_COREDUMP dependency
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 048/125] KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 050/125] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
` (79 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Arnd Bergmann,
Jeremy Kerr, Michael Ellerman, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit b648a5132ca3237a0f1ce5d871fff342b0efcf8a ]
The kernel test robot pointed out a slightly different error message
after recent commit 5456ffdee666 ("powerpc/spufs: simplify spufs core
dumping") to spufs for a configuration that never worked:
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_proxydma_info_dump':
>> file.c:(.text+0x4c68): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_dma_info_dump':
file.c:(.text+0x4d70): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_wbox_info_dump':
file.c:(.text+0x4df4): undefined reference to `.dump_emit'
Add a Kconfig dependency to prevent this from happening again.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200706132302.3885935-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/cell/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
index 9f5958f169234..741a8fa8a3e6b 100644
--- a/arch/powerpc/platforms/cell/Kconfig
+++ b/arch/powerpc/platforms/cell/Kconfig
@@ -46,6 +46,7 @@ config SPU_FS
tristate "SPU file system"
default m
depends on PPC_CELL
+ depends on COREDUMP
select SPU_BASE
help
The SPU file system is used to access Synergistic Processing
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 050/125] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 049/125] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 051/125] efi: provide empty efi_enter_virtual_mode implementation Greg Kroah-Hartman
` (78 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Changming Liu, Sasha Levin
From: Changming Liu <charley.ashbringer@gmail.com>
[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ]
The char buffer buf, receives data directly from user space,
so its content might be negative and its elements are left
shifted to form an unsigned integer.
Since left shifting a negative value is undefined behavior, thus
change the char to u8 to elimintate this UB.
Signed-off-by: Changming Liu <charley.ashbringer@gmail.com>
Link: https://lore.kernel.org/r/20200711043018.928-1-charley.ashbringer@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/misc/sisusbvga/sisusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 6376be1f5fd22..4877bf82ad395 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
u8 swap8, fromkern = kernbuffer ? 1 : 0;
u16 swap16;
u32 swap32, flag = (length >> 28) & 1;
- char buf[4];
+ u8 buf[4];
/* if neither kernbuffer not userbuffer are given, assume
* data in obuf
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 051/125] efi: provide empty efi_enter_virtual_mode implementation
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 050/125] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 052/125] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
` (77 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Andrey Konovalov,
Andrew Morton, Ard Biesheuvel, Alexander Potapenko,
Andrey Ryabinin, Catalin Marinas, Dmitry Vyukov, Elena Petrova,
Marco Elver, Vincenzo Frascino, Walter Wu, Linus Torvalds,
Sasha Levin
From: Andrey Konovalov <andreyknvl@google.com>
[ Upstream commit 2c547f9da0539ad1f7ef7f08c8c82036d61b011a ]
When CONFIG_EFI is not enabled, we might get an undefined reference to
efi_enter_virtual_mode() error, if this efi_enabled() call isn't inlined
into start_kernel(). This happens in particular, if start_kernel() is
annodated with __no_sanitize_address.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Elena Petrova <lenaptr@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Walter Wu <walter-zh.wu@mediatek.com>
Link: http://lkml.kernel.org/r/6514652d3a32d3ed33d6eb5c91d0af63bf0d1a0c.1596544734.git.andreyknvl@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/efi.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 6797811bf1e6c..9a5d4b4992716 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -996,7 +996,11 @@ extern void *efi_get_pal_addr (void);
extern void efi_map_pal_code (void);
extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg);
extern void efi_gettimeofday (struct timespec64 *ts);
+#ifdef CONFIG_EFI
extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */
+#else
+static inline void efi_enter_virtual_mode (void) {}
+#endif
#ifdef CONFIG_X86
extern void efi_free_boot_services(void);
extern efi_status_t efi_query_variable_store(u32 attributes,
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 052/125] Revert "ath10k: fix DMA related firmware crashes on multiple devices"
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 051/125] efi: provide empty efi_enter_virtual_mode implementation Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling Greg Kroah-Hartman
` (76 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhi Chen, Kalle Valo, Sasha Levin
From: Zhi Chen <zhichen@codeaurora.org>
[ Upstream commit a1769bb68a850508a492e3674ab1e5e479b11254 ]
This reverts commit 76d164f582150fd0259ec0fcbc485470bcd8033e.
PCIe hung issue was observed on multiple platforms. The issue was reproduced
when DUT was configured as AP and associated with 50+ STAs.
For QCA9984/QCA9888, the DMA_BURST_SIZE register controls the AXI burst size
of the RD/WR access to the HOST MEM.
0 - No split , RAW read/write transfer size from MAC is put out on bus
as burst length
1 - Split at 256 byte boundary
2,3 - Reserved
With PCIe protocol analyzer, we can see DMA Read crossing 4KB boundary when
issue happened. It broke PCIe spec and caused PCIe stuck. So revert
the default value from 0 to 1.
Tested: IPQ8064 + QCA9984 with firmware 10.4-3.10-00047
QCS404 + QCA9984 with firmware 10.4-3.9.0.2--00044
Synaptics AS370 + QCA9888 with firmware 10.4-3.9.0.2--00040
Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/hw.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index fac58c3c576a2..3ff65a0a834a2 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -753,7 +753,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
#define TARGET_10_4_TX_DBG_LOG_SIZE 1024
#define TARGET_10_4_NUM_WDS_ENTRIES 32
-#define TARGET_10_4_DMA_BURST_SIZE 0
+#define TARGET_10_4_DMA_BURST_SIZE 1
#define TARGET_10_4_MAC_AGGR_DELIM 0
#define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
#define TARGET_10_4_VOW_CONFIG 0
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 052/125] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-02 10:25 ` Pavel Machek
2020-09-01 15:10 ` [PATCH 4.19 054/125] drm/msm/adreno: fix updating ring fence Greg Kroah-Hartman
` (75 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Young, Mauro Carvalho Chehab,
Sasha Levin
From: Sean Young <sean@mess.org>
[ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
usleep_range() may take longer than the max argument due to scheduling,
especially under load. This is causing random errors in the transmitted
IR. Remove the usleep_range() in favour of busy-looping with udelay().
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/gpio-ir-tx.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
index cd476cab97820..4e70b67ccd181 100644
--- a/drivers/media/rc/gpio-ir-tx.c
+++ b/drivers/media/rc/gpio-ir-tx.c
@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
// space
edge = ktime_add_us(edge, txbuf[i]);
delta = ktime_us_delta(edge, ktime_get());
- if (delta > 10) {
- spin_unlock_irqrestore(&gpio_ir->lock, flags);
- usleep_range(delta, delta + 10);
- spin_lock_irqsave(&gpio_ir->lock, flags);
- } else if (delta > 0) {
+ if (delta > 0)
udelay(delta);
- }
} else {
// pulse
ktime_t last = ktime_add_us(edge, txbuf[i]);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
2020-09-01 15:10 ` [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling Greg Kroah-Hartman
@ 2020-09-02 10:25 ` Pavel Machek
2020-09-02 12:51 ` Sean Young
0 siblings, 1 reply; 147+ messages in thread
From: Pavel Machek @ 2020-09-02 10:25 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Sean Young, Mauro Carvalho Chehab, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1656 bytes --]
Hi!
>
> [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
>
> usleep_range() may take longer than the max argument due to scheduling,
> especially under load. This is causing random errors in the transmitted
> IR. Remove the usleep_range() in favour of busy-looping with udelay().
>
> Signed-off-by: Sean Young <sean@mess.org>
I don't believe this should be in stable.
Yes, it probably fixes someone's remote control.
It also introduces > half a second (!) with interrupts disabled
(according to the code comments), which will break other devices on
the system.
Less intrusive solutions should be explored, first. Like.. if that
part is time-critical, perhaps it should set itself at realtime
priority, so that scheduler has motivation to schedule it at the right
times?
Perhaps usleep_range should be delta, delta+1?
Perhaps udelay makes sense to use for more than 10usec?
Best regards,
Pavel
> @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
> // space
> edge = ktime_add_us(edge, txbuf[i]);
> delta = ktime_us_delta(edge, ktime_get());
> - if (delta > 10) {
> - spin_unlock_irqrestore(&gpio_ir->lock, flags);
> - usleep_range(delta, delta + 10);
> - spin_lock_irqsave(&gpio_ir->lock, flags);
> - } else if (delta > 0) {
> + if (delta > 0)
> udelay(delta);
> - }
> } else {
> // pulse
> ktime_t last = ktime_add_us(edge, txbuf[i]);
> --
> 2.25.1
>
>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
2020-09-02 10:25 ` Pavel Machek
@ 2020-09-02 12:51 ` Sean Young
2020-10-26 0:54 ` Norman Rasmussen
0 siblings, 1 reply; 147+ messages in thread
From: Sean Young @ 2020-09-02 12:51 UTC (permalink / raw)
To: Pavel Machek
Cc: Greg Kroah-Hartman, linux-kernel, stable, Mauro Carvalho Chehab,
Sasha Levin
Hi Pavel,
On Wed, Sep 02, 2020 at 12:25:21PM +0200, Pavel Machek wrote:
> Hi!
> >
> > [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
> >
> > usleep_range() may take longer than the max argument due to scheduling,
> > especially under load. This is causing random errors in the transmitted
> > IR. Remove the usleep_range() in favour of busy-looping with udelay().
> >
> > Signed-off-by: Sean Young <sean@mess.org>
>
> I don't believe this should be in stable.
>
> Yes, it probably fixes someone's remote control.
>
> It also introduces > half a second (!) with interrupts disabled
> (according to the code comments), which will break other devices on
> the system.
Yes, I've always been uncormfortable with this code, but nothing else I
tried worked.
BTW the delay has a maximum of half a second, but the point stands of
course.
> Less intrusive solutions should be explored, first. Like.. if that
> part is time-critical, perhaps it should set itself at realtime
> priority, so that scheduler has motivation to schedule it at the right
> times?
That is an interesting idea, I'll explore that.
> Perhaps usleep_range should be delta, delta+1?
I'm pretty sure I tried that and it didn't work. I'll give it another go.
> Perhaps udelay makes sense to use for more than 10usec?
I don't follow -- what are you suggesting here?
So any other ideas here would be very welcome. I'm happy to explore options,
so far under load the output is can be total garbage if you're unlucky.
Thanks,
Sean
>
> Best regards,
> Pavel
>
> > @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
> > // space
> > edge = ktime_add_us(edge, txbuf[i]);
> > delta = ktime_us_delta(edge, ktime_get());
> > - if (delta > 10) {
> > - spin_unlock_irqrestore(&gpio_ir->lock, flags);
> > - usleep_range(delta, delta + 10);
> > - spin_lock_irqsave(&gpio_ir->lock, flags);
> > - } else if (delta > 0) {
> > + if (delta > 0)
> > udelay(delta);
> > - }
> > } else {
> > // pulse
> > ktime_t last = ktime_add_us(edge, txbuf[i]);
> > --
> > 2.25.1
> >
> >
>
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
2020-09-02 12:51 ` Sean Young
@ 2020-10-26 0:54 ` Norman Rasmussen
0 siblings, 0 replies; 147+ messages in thread
From: Norman Rasmussen @ 2020-10-26 0:54 UTC (permalink / raw)
To: Sean Young
Cc: Pavel Machek, Greg Kroah-Hartman, linux-kernel, stable,
Mauro Carvalho Chehab, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 4305 bytes --]
Hi Sean,
On Wed, 2 Sep 2020, Sean Young wrote:
> Hi Pavel,
>
> On Wed, Sep 02, 2020 at 12:25:21PM +0200, Pavel Machek wrote:
>> Hi!
>>>
>>> [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
>>>
>>> usleep_range() may take longer than the max argument due to scheduling,
>>> especially under load. This is causing random errors in the transmitted
>>> IR. Remove the usleep_range() in favour of busy-looping with udelay().
>>>
>>> Signed-off-by: Sean Young <sean@mess.org>
>>
>> I don't believe this should be in stable.
>>
>> Yes, it probably fixes someone's remote control.
>>
>> It also introduces > half a second (!) with interrupts disabled
>> (according to the code comments), which will break other devices on
>> the system.
>
> Yes, I've always been uncomfortable with this code, but nothing else I
> tried worked.
>
> BTW the delay has a maximum of half a second, but the point stands of
> course.
>
>> Less intrusive solutions should be explored, first. Like.. if that
>> part is time-critical, perhaps it should set itself at realtime
>> priority, so that scheduler has motivation to schedule it at the right
>> times?
>
> That is an interesting idea, I'll explore that.
>
Did you try anything around this? It looks like it might be required for
devices like the raspbetty pi zero w (see more details below).
Is there a way to temporarily increase the priority of the existing
thread? or is the preferred way to do readtime priority with a dedicated
thread? Assuming the latter: What's the preferred way to transfer data &
control from the user's thread to the dedicated thread and back? I'd
guess some sort of queue or mailbox?
>> Perhaps usleep_range should be delta, delta+1?
>
> I'm pretty sure I tried that and it didn't work. I'll give it another go.
>
Shouldn't max actually be less than delta? Otherwise the code is
indicating that it's okay to sleep for longer than delta + rescheduling
overhead.
I tried your latest patch ("re-introduce sleeping for periods of > 50us")
on my Pi Zero W and the post-usleep "remaining" delta is anywhere between
-25,500us and -50us (i.e. usleep_range usually oversleeps!).
The upstream patch gives very stable results: post-udelay delta is
typically <10us (i.e. it's underdelaying just a tiny bit).
I tried adding a module_param to tune the sleep threshold buffer but
because typical delays are 500us and 1,500us and the worst usleep overruns
are way larger than that, effectively I had to set it so that usleep never
triggered
I even tried usleep_range(0, delta - buffer), but that produced the same
behaviour. (I even saw a post-usleep delta of -125,000us once!)
I added a call to switch to the FIFO scheduler at priority 50 (the same
as the recently proposed sched_set_fifo function would do), and (as long
as ir-ctl is run as root) it brings the post-usleep delta to ~500us (or
with usleep_range(0, ...) for large deltas the post-usleep delta was
between ~500us and ~5000us - still undersleeping and very acceptable).
Note that pwm-ir-tx has the same issue and so should probably get the same
fixes (when they're figured out what they'll be).
>> Perhaps udelay makes sense to use for more than 10usec?
>
> I don't follow -- what are you suggesting here?
>
> So any other ideas here would be very welcome. I'm happy to explore options,
> so far under load the output is can be total garbage if you're unlucky.
>
>
> Thanks,
>
> Sean
>
>
>>
>> Best regards,
>> Pavel
>>
>>> @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
>>> // space
>>> edge = ktime_add_us(edge, txbuf[i]);
>>> delta = ktime_us_delta(edge, ktime_get());
>>> - if (delta > 10) {
>>> - spin_unlock_irqrestore(&gpio_ir->lock, flags);
>>> - usleep_range(delta, delta + 10);
>>> - spin_lock_irqsave(&gpio_ir->lock, flags);
>>> - } else if (delta > 0) {
>>> + if (delta > 0)
>>> udelay(delta);
>>> - }
>>> } else {
>>> // pulse
>>> ktime_t last = ktime_add_us(edge, txbuf[i]);
>>> --
>>> 2.25.1
>>>
>>>
>>
>> --
>> (english) http://www.livejournal.com/~pavelmachek
>> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
>
>
>
--
- Norman Rasmussen
- Email: norman@rasmussen.co.za
- Home page: http://norman.rasmussen.co.za/
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 054/125] drm/msm/adreno: fix updating ring fence
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 053/125] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 055/125] nvme-fc: Fix wrong return value in __nvme_fc_init_request() Greg Kroah-Hartman
` (74 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rob Clark, Jordan Crouse, Sasha Levin
From: Rob Clark <robdclark@chromium.org>
[ Upstream commit f228af11dfa1d1616bc67f3a4119ab77c36181f1 ]
We need to set it to the most recent completed fence, not the most
recent submitted. Otherwise we have races where we think we can retire
submits that the GPU is not finished with, if the GPU doesn't manage to
overwrite the seqno before we look at it.
This can show up with hang recovery if one of the submits after the
crashing submit also hangs after it is replayed.
Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 93d70f4a2154e..c9f831604558f 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -221,7 +221,7 @@ int adreno_hw_init(struct msm_gpu *gpu)
ring->next = ring->start;
/* reset completed fence seqno: */
- ring->memptrs->fence = ring->seqno;
+ ring->memptrs->fence = ring->fctx->completed_fence;
ring->memptrs->rptr = 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 055/125] nvme-fc: Fix wrong return value in __nvme_fc_init_request()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 054/125] drm/msm/adreno: fix updating ring fence Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 056/125] null_blk: fix passing of REQ_FUA flag in null_handle_rq Greg Kroah-Hartman
` (73 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Smart, Tianjia Zhang,
Chaitanya Kulkarni, Christoph Hellwig, Sagi Grimberg, Jens Axboe,
Sasha Levin
From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ]
On an error exit path, a negative error code should be returned
instead of a positive return value.
Fixes: e399441de9115 ("nvme-fabrics: Add host support for FC transport")
Cc: James Smart <jsmart2021@gmail.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index ed43b06353a39..bb3b447c56468 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1716,7 +1716,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) {
dev_err(ctrl->dev,
"FCP Op failed - cmdiu dma mapping failed.\n");
- ret = EFAULT;
+ ret = -EFAULT;
goto out_on_error;
}
@@ -1726,7 +1726,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) {
dev_err(ctrl->dev,
"FCP Op failed - rspiu dma mapping failed.\n");
- ret = EFAULT;
+ ret = -EFAULT;
}
atomic_set(&op->state, FCPOP_STATE_IDLE);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 056/125] null_blk: fix passing of REQ_FUA flag in null_handle_rq
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 055/125] nvme-fc: Fix wrong return value in __nvme_fc_init_request() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 057/125] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
` (72 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hou Pu, Jens Axboe, Sasha Levin
From: Hou Pu <houpu@bytedance.com>
[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ]
REQ_FUA should be checked using rq->cmd_flags instead of req_op().
Fixes: deb78b419dfda ("nullb: emulate cache")
Signed-off-by: Hou Pu <houpu@bytedance.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/null_blk_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index d2d7dc9cd58d2..4fef1fb918ece 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1086,7 +1086,7 @@ static int null_handle_rq(struct nullb_cmd *cmd)
len = bvec.bv_len;
err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
op_is_write(req_op(rq)), sector,
- req_op(rq) & REQ_FUA);
+ rq->cmd_flags & REQ_FUA);
if (err) {
spin_unlock_irq(&nullb->lock);
return err;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 057/125] i2c: rcar: in slave mode, clear NACK earlier
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 056/125] null_blk: fix passing of REQ_FUA flag in null_handle_rq Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 058/125] usb: gadget: f_tcm: Fix some resource leaks in some error paths Greg Kroah-Hartman
` (71 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Wolfram Sang, Sasha Levin
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ]
Currently, a NACK in slave mode is set/cleared when SCL is held low by
the IP core right before the bit is about to be pushed out. This is too
late for clearing and then a NACK from the previous byte is still used
for the current one. Now, let's clear the NACK right after we detected
the STOP condition following the NACK.
Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-rcar.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index dcdce18fc7062..f9029800d3996 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -594,6 +594,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
/* master sent stop */
if (ssr_filtered & SSR) {
i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
rcar_i2c_write(priv, ICSIER, SAR);
rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 058/125] usb: gadget: f_tcm: Fix some resource leaks in some error paths
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 057/125] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 059/125] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
` (70 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Felipe Balbi,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ]
If a memory allocation fails within a 'usb_ep_alloc_request()' call, the
already allocated memory must be released.
Fix a mix-up in the code and free the correct requests.
Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_tcm.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 106988a6661ab..785826ab5348e 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
goto err_sts;
return 0;
+
err_sts:
- usb_ep_free_request(fu->ep_status, stream->req_status);
- stream->req_status = NULL;
-err_out:
usb_ep_free_request(fu->ep_out, stream->req_out);
stream->req_out = NULL;
+err_out:
+ usb_ep_free_request(fu->ep_in, stream->req_in);
+ stream->req_in = NULL;
out:
return -ENOMEM;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 059/125] jbd2: make sure jh have b_transaction set in refile/unfile_buffer
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 058/125] usb: gadget: f_tcm: Fix some resource leaks in some error paths Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 060/125] ext4: dont BUG on inconsistent journal feature Greg Kroah-Hartman
` (69 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Jan Kara,
Theodore Tso, Sasha Levin
From: Lukas Czerner <lczerner@redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 43693b6797105..5a0de78a5d71a 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1915,6 +1915,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2462,6 +2465,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 060/125] ext4: dont BUG on inconsistent journal feature
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 059/125] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 061/125] ext4: handle read only external journal device Greg Kroah-Hartman
` (68 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Jan Kara,
Theodore Tso, Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ]
A customer has reported a BUG_ON in ext4_clear_journal_err() hitting
during an LTP testing. Either this has been caused by a test setup
issue where the filesystem was being overwritten while LTP was mounting
it or the journal replay has overwritten the superblock with invalid
data. In either case it is preferable we don't take the machine down
with a BUG_ON. So handle the situation of unexpectedly missing
has_journal feature more gracefully. We issue warning and fail the mount
in the cases where the race window is narrow and the failed check is
most likely a programming error. In cases where fs corruption is more
likely, we do full ext4_error() handling before failing mount / remount.
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200710140759.18031-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++---------------
1 file changed, 47 insertions(+), 21 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1428dab2afff8..47e406338a322 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -65,10 +65,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *,
unsigned long journal_devnum);
static int ext4_show_options(struct seq_file *seq, struct dentry *root);
static int ext4_commit_super(struct super_block *sb, int sync);
-static void ext4_mark_recovery_complete(struct super_block *sb,
+static int ext4_mark_recovery_complete(struct super_block *sb,
struct ext4_super_block *es);
-static void ext4_clear_journal_err(struct super_block *sb,
- struct ext4_super_block *es);
+static int ext4_clear_journal_err(struct super_block *sb,
+ struct ext4_super_block *es);
static int ext4_sync_fs(struct super_block *sb, int wait);
static int ext4_remount(struct super_block *sb, int *flags, char *data);
static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
@@ -4545,7 +4545,9 @@ no_journal:
EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
if (needs_recovery) {
ext4_msg(sb, KERN_INFO, "recovery complete");
- ext4_mark_recovery_complete(sb, es);
+ err = ext4_mark_recovery_complete(sb, es);
+ if (err)
+ goto failed_mount8;
}
if (EXT4_SB(sb)->s_journal) {
if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
@@ -4588,10 +4590,8 @@ cantfind_ext4:
ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem");
goto failed_mount;
-#ifdef CONFIG_QUOTA
failed_mount8:
ext4_unregister_sysfs(sb);
-#endif
failed_mount7:
ext4_unregister_li_request(sb);
failed_mount6:
@@ -4727,7 +4727,8 @@ static journal_t *ext4_get_journal(struct super_block *sb,
struct inode *journal_inode;
journal_t *journal;
- BUG_ON(!ext4_has_feature_journal(sb));
+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
+ return NULL;
journal_inode = ext4_get_journal_inode(sb, journal_inum);
if (!journal_inode)
@@ -4757,7 +4758,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
struct ext4_super_block *es;
struct block_device *bdev;
- BUG_ON(!ext4_has_feature_journal(sb));
+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
+ return NULL;
bdev = ext4_blkdev_get(j_dev, sb);
if (bdev == NULL)
@@ -4849,7 +4851,8 @@ static int ext4_load_journal(struct super_block *sb,
int err = 0;
int really_read_only;
- BUG_ON(!ext4_has_feature_journal(sb));
+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
+ return -EFSCORRUPTED;
if (journal_devnum &&
journal_devnum != le32_to_cpu(es->s_journal_dev)) {
@@ -4919,7 +4922,12 @@ static int ext4_load_journal(struct super_block *sb,
}
EXT4_SB(sb)->s_journal = journal;
- ext4_clear_journal_err(sb, es);
+ err = ext4_clear_journal_err(sb, es);
+ if (err) {
+ EXT4_SB(sb)->s_journal = NULL;
+ jbd2_journal_destroy(journal);
+ return err;
+ }
if (!really_read_only && journal_devnum &&
journal_devnum != le32_to_cpu(es->s_journal_dev)) {
@@ -5015,26 +5023,32 @@ static int ext4_commit_super(struct super_block *sb, int sync)
* remounting) the filesystem readonly, then we will end up with a
* consistent fs on disk. Record that fact.
*/
-static void ext4_mark_recovery_complete(struct super_block *sb,
- struct ext4_super_block *es)
+static int ext4_mark_recovery_complete(struct super_block *sb,
+ struct ext4_super_block *es)
{
+ int err;
journal_t *journal = EXT4_SB(sb)->s_journal;
if (!ext4_has_feature_journal(sb)) {
- BUG_ON(journal != NULL);
- return;
+ if (journal != NULL) {
+ ext4_error(sb, "Journal got removed while the fs was "
+ "mounted!");
+ return -EFSCORRUPTED;
+ }
+ return 0;
}
jbd2_journal_lock_updates(journal);
- if (jbd2_journal_flush(journal) < 0)
+ err = jbd2_journal_flush(journal);
+ if (err < 0)
goto out;
if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) {
ext4_clear_feature_journal_needs_recovery(sb);
ext4_commit_super(sb, 1);
}
-
out:
jbd2_journal_unlock_updates(journal);
+ return err;
}
/*
@@ -5042,14 +5056,17 @@ out:
* has recorded an error from a previous lifetime, move that error to the
* main filesystem now.
*/
-static void ext4_clear_journal_err(struct super_block *sb,
+static int ext4_clear_journal_err(struct super_block *sb,
struct ext4_super_block *es)
{
journal_t *journal;
int j_errno;
const char *errstr;
- BUG_ON(!ext4_has_feature_journal(sb));
+ if (!ext4_has_feature_journal(sb)) {
+ ext4_error(sb, "Journal got removed while the fs was mounted!");
+ return -EFSCORRUPTED;
+ }
journal = EXT4_SB(sb)->s_journal;
@@ -5074,6 +5091,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
jbd2_journal_clear_err(journal);
jbd2_journal_update_sb_errno(journal);
}
+ return 0;
}
/*
@@ -5344,8 +5362,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
(sbi->s_mount_state & EXT4_VALID_FS))
es->s_state = cpu_to_le16(sbi->s_mount_state);
- if (sbi->s_journal)
+ if (sbi->s_journal) {
+ /*
+ * We let remount-ro finish even if marking fs
+ * as clean failed...
+ */
ext4_mark_recovery_complete(sb, es);
+ }
if (sbi->s_mmp_tsk)
kthread_stop(sbi->s_mmp_tsk);
} else {
@@ -5393,8 +5416,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
* been changed by e2fsck since we originally mounted
* the partition.)
*/
- if (sbi->s_journal)
- ext4_clear_journal_err(sb, es);
+ if (sbi->s_journal) {
+ err = ext4_clear_journal_err(sb, es);
+ if (err)
+ goto restore_opts;
+ }
sbi->s_mount_state = le16_to_cpu(es->s_state);
err = ext4_setup_super(sb, es, 0);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 061/125] ext4: handle read only external journal device
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 060/125] ext4: dont BUG on inconsistent journal feature Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 062/125] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
` (67 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Andreas Dilger,
Theodore Tso, Sasha Levin
From: Lukas Czerner <lczerner@redhat.com>
[ Upstream commit 273108fa5015eeffc4bacfa5ce272af3434b96e4 ]
Ext4 uses blkdev_get_by_dev() to get the block_device for journal device
which does check to see if the read-only block device was opened
read-only.
As a result ext4 will hapily proceed mounting the file system with
external journal on read-only device. This is bad as we would not be
able to use the journal leading to errors later on.
Instead of simply failing to mount file system in this case, treat it in
a similar way we treat internal journal on read-only device. Allow to
mount with -o noload in read-only mode.
This can be reproduced easily like this:
mke2fs -F -O journal_dev $JOURNAL_DEV 100M
mkfs.$FSTYPE -F -J device=$JOURNAL_DEV $FS_DEV
blockdev --setro $JOURNAL_DEV
mount $FS_DEV $MNT
touch $MNT/file
umount $MNT
leading to error like this
[ 1307.318713] ------------[ cut here ]------------
[ 1307.323362] generic_make_request: Trying to write to read-only block-device dm-2 (partno 0)
[ 1307.331741] WARNING: CPU: 36 PID: 3224 at block/blk-core.c:855 generic_make_request_checks+0x2c3/0x580
[ 1307.341041] Modules linked in: ext4 mbcache jbd2 rfkill intel_rapl_msr intel_rapl_common isst_if_commd
[ 1307.419445] CPU: 36 PID: 3224 Comm: jbd2/dm-2 Tainted: G W I 5.8.0-rc5 #2
[ 1307.427359] Hardware name: Dell Inc. PowerEdge R740/01KPX8, BIOS 2.3.10 08/15/2019
[ 1307.434932] RIP: 0010:generic_make_request_checks+0x2c3/0x580
[ 1307.440676] Code: 94 03 00 00 48 89 df 48 8d 74 24 08 c6 05 cf 2b 18 01 01 e8 7f a4 ff ff 48 c7 c7 50e
[ 1307.459420] RSP: 0018:ffffc0d70eb5fb48 EFLAGS: 00010286
[ 1307.464646] RAX: 0000000000000000 RBX: ffff9b33b2978300 RCX: 0000000000000000
[ 1307.471780] RDX: ffff9b33e12a81e0 RSI: ffff9b33e1298000 RDI: ffff9b33e1298000
[ 1307.478913] RBP: ffff9b7b9679e0c0 R08: 0000000000000837 R09: 0000000000000024
[ 1307.486044] R10: 0000000000000000 R11: ffffc0d70eb5f9f0 R12: 0000000000000400
[ 1307.493177] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 1307.500308] FS: 0000000000000000(0000) GS:ffff9b33e1280000(0000) knlGS:0000000000000000
[ 1307.508396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1307.514142] CR2: 000055eaf4109000 CR3: 0000003dee40a006 CR4: 00000000007606e0
[ 1307.521273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1307.528407] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1307.535538] PKRU: 55555554
[ 1307.538250] Call Trace:
[ 1307.540708] generic_make_request+0x30/0x340
[ 1307.544985] submit_bio+0x43/0x190
[ 1307.548393] ? bio_add_page+0x62/0x90
[ 1307.552068] submit_bh_wbc+0x16a/0x190
[ 1307.555833] jbd2_write_superblock+0xec/0x200 [jbd2]
[ 1307.560803] jbd2_journal_update_sb_log_tail+0x65/0xc0 [jbd2]
[ 1307.566557] jbd2_journal_commit_transaction+0x2ae/0x1860 [jbd2]
[ 1307.572566] ? check_preempt_curr+0x7a/0x90
[ 1307.576756] ? update_curr+0xe1/0x1d0
[ 1307.580421] ? account_entity_dequeue+0x7b/0xb0
[ 1307.584955] ? newidle_balance+0x231/0x3d0
[ 1307.589056] ? __switch_to_asm+0x42/0x70
[ 1307.592986] ? __switch_to_asm+0x36/0x70
[ 1307.596918] ? lock_timer_base+0x67/0x80
[ 1307.600851] kjournald2+0xbd/0x270 [jbd2]
[ 1307.604873] ? finish_wait+0x80/0x80
[ 1307.608460] ? commit_timeout+0x10/0x10 [jbd2]
[ 1307.612915] kthread+0x114/0x130
[ 1307.616152] ? kthread_park+0x80/0x80
[ 1307.619816] ret_from_fork+0x22/0x30
[ 1307.623400] ---[ end trace 27490236265b1630 ]---
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/20200717090605.2612-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++-----------------
1 file changed, 33 insertions(+), 18 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 47e406338a322..23ef8fbdb582f 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4850,6 +4850,7 @@ static int ext4_load_journal(struct super_block *sb,
dev_t journal_dev;
int err = 0;
int really_read_only;
+ int journal_dev_ro;
if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
return -EFSCORRUPTED;
@@ -4862,7 +4863,31 @@ static int ext4_load_journal(struct super_block *sb,
} else
journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev));
- really_read_only = bdev_read_only(sb->s_bdev);
+ if (journal_inum && journal_dev) {
+ ext4_msg(sb, KERN_ERR,
+ "filesystem has both journal inode and journal device!");
+ return -EINVAL;
+ }
+
+ if (journal_inum) {
+ journal = ext4_get_journal(sb, journal_inum);
+ if (!journal)
+ return -EINVAL;
+ } else {
+ journal = ext4_get_dev_journal(sb, journal_dev);
+ if (!journal)
+ return -EINVAL;
+ }
+
+ journal_dev_ro = bdev_read_only(journal->j_dev);
+ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro;
+
+ if (journal_dev_ro && !sb_rdonly(sb)) {
+ ext4_msg(sb, KERN_ERR,
+ "journal device read-only, try mounting with '-o ro'");
+ err = -EROFS;
+ goto err_out;
+ }
/*
* Are we loading a blank journal or performing recovery after a
@@ -4877,27 +4902,14 @@ static int ext4_load_journal(struct super_block *sb,
ext4_msg(sb, KERN_ERR, "write access "
"unavailable, cannot proceed "
"(try mounting with noload)");
- return -EROFS;
+ err = -EROFS;
+ goto err_out;
}
ext4_msg(sb, KERN_INFO, "write access will "
"be enabled during recovery");
}
}
- if (journal_inum && journal_dev) {
- ext4_msg(sb, KERN_ERR, "filesystem has both journal "
- "and inode journals!");
- return -EINVAL;
- }
-
- if (journal_inum) {
- if (!(journal = ext4_get_journal(sb, journal_inum)))
- return -EINVAL;
- } else {
- if (!(journal = ext4_get_dev_journal(sb, journal_dev)))
- return -EINVAL;
- }
-
if (!(journal->j_flags & JBD2_BARRIER))
ext4_msg(sb, KERN_INFO, "barriers disabled");
@@ -4917,8 +4929,7 @@ static int ext4_load_journal(struct super_block *sb,
if (err) {
ext4_msg(sb, KERN_ERR, "error loading journal");
- jbd2_journal_destroy(journal);
- return err;
+ goto err_out;
}
EXT4_SB(sb)->s_journal = journal;
@@ -4938,6 +4949,10 @@ static int ext4_load_journal(struct super_block *sb,
}
return 0;
+
+err_out:
+ jbd2_journal_destroy(journal);
+ return err;
}
static int ext4_commit_super(struct super_block *sb, int sync)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 062/125] jbd2: abort journal if free a async write error metadata buffer
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 061/125] ext4: handle read only external journal device Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 063/125] ext4: handle option set by mount flags correctly Greg Kroah-Hartman
` (66 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, zhangyi (F), Theodore Tso, Sasha Levin
From: zhangyi (F) <yi.zhang@huawei.com>
[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ]
If we free a metadata buffer which has been failed to async write out
in the background, the jbd2 checkpoint procedure will not detect this
failure in jbd2_log_do_checkpoint(), so it may lead to filesystem
inconsistency after cleanup journal tail. This patch abort the journal
if free a buffer has write_io_error flag to prevent potential further
inconsistency.
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/transaction.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 5a0de78a5d71a..8c305593fb51f 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2009,6 +2009,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
{
struct buffer_head *head;
struct buffer_head *bh;
+ bool has_write_io_error = false;
int ret = 0;
J_ASSERT(PageLocked(page));
@@ -2033,11 +2034,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
jbd_unlock_bh_state(bh);
if (buffer_jbd(bh))
goto busy;
+
+ /*
+ * If we free a metadata buffer which has been failed to
+ * write out, the jbd2 checkpoint procedure will not detect
+ * this failure and may lead to filesystem inconsistency
+ * after cleanup journal tail.
+ */
+ if (buffer_write_io_error(bh)) {
+ pr_err("JBD2: Error while async write back metadata bh %llu.",
+ (unsigned long long)bh->b_blocknr);
+ has_write_io_error = true;
+ }
} while ((bh = bh->b_this_page) != head);
ret = try_to_free_buffers(page);
busy:
+ if (has_write_io_error)
+ jbd2_journal_abort(journal, -EIO);
+
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 063/125] ext4: handle option set by mount flags correctly
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 062/125] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 064/125] ext4: handle error of ext4_setup_system_zone() on remount Greg Kroah-Hartman
` (65 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Ritesh Harjani,
Theodore Tso, Sasha Levin
From: Lukas Czerner <lczerner@redhat.com>
[ Upstream commit f25391ebb475d3ffb3aa61bb90e3594c841749ef ]
Currently there is a problem with mount options that can be both set by
vfs using mount flags or by a string parsing in ext4.
i_version/iversion options gets lost after remount, for example
$ mount -o i_version /dev/pmem0 /mnt
$ grep pmem0 /proc/self/mountinfo | grep i_version
310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,seclabel,i_version
$ mount -o remount,ro /mnt
$ grep pmem0 /proc/self/mountinfo | grep i_version
nolazytime gets ignored by ext4 on remount, for example
$ mount -o lazytime /dev/pmem0 /mnt
$ grep pmem0 /proc/self/mountinfo | grep lazytime
310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel
$ mount -o remount,nolazytime /mnt
$ grep pmem0 /proc/self/mountinfo | grep lazytime
310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel
Fix it by applying the SB_LAZYTIME and SB_I_VERSION flags from *flags to
s_flags before we parse the option and use the resulting state of the
same flags in *flags at the end of successful remount.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Ritesh Harjani <riteshh@linux.ibm.com>
Link: https://lore.kernel.org/r/20200723150526.19931-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 23ef8fbdb582f..03ebb0b385467 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5249,7 +5249,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
{
struct ext4_super_block *es;
struct ext4_sb_info *sbi = EXT4_SB(sb);
- unsigned long old_sb_flags;
+ unsigned long old_sb_flags, vfs_flags;
struct ext4_mount_options old_opts;
int enable_quota = 0;
ext4_group_t g;
@@ -5292,6 +5292,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
if (sbi->s_journal && sbi->s_journal->j_task->io_context)
journal_ioprio = sbi->s_journal->j_task->io_context->ioprio;
+ /*
+ * Some options can be enabled by ext4 and/or by VFS mount flag
+ * either way we need to make sure it matches in both *flags and
+ * s_flags. Copy those selected flags from *flags to s_flags
+ */
+ vfs_flags = SB_LAZYTIME | SB_I_VERSION;
+ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags);
+
if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) {
err = -EINVAL;
goto restore_opts;
@@ -5345,9 +5353,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
}
- if (*flags & SB_LAZYTIME)
- sb->s_flags |= SB_LAZYTIME;
-
if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) {
if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
err = -EROFS;
@@ -5487,7 +5492,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
}
#endif
- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
+ /*
+ * Some options can be enabled by ext4 and/or by VFS mount flag
+ * either way we need to make sure it matches in both *flags and
+ * s_flags. Copy those selected flags from s_flags to *flags
+ */
+ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags);
+
ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data);
kfree(orig_data);
return 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 064/125] ext4: handle error of ext4_setup_system_zone() on remount
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 063/125] ext4: handle option set by mount flags correctly Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 065/125] ext4: correctly restore system zone info when remount fails Greg Kroah-Hartman
` (64 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Jan Kara,
Theodore Tso, Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit d176b1f62f242ab259ff665a26fbac69db1aecba ]
ext4_setup_system_zone() can fail. Handle the failure in ext4_remount().
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200728130437.7804-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 03ebb0b385467..daabd7a2cee81 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5470,7 +5470,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
ext4_register_li_request(sb, first_not_zeroed);
}
- ext4_setup_system_zone(sb);
+ err = ext4_setup_system_zone(sb);
+ if (err)
+ goto restore_opts;
+
if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
err = ext4_commit_super(sb, 1);
if (err)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 065/125] ext4: correctly restore system zone info when remount fails
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 064/125] ext4: handle error of ext4_setup_system_zone() on remount Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 066/125] fs: prevent BUG_ON in submit_bh_wbc() Greg Kroah-Hartman
` (63 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Jan Kara,
Theodore Tso, Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit 0f5bde1db174f6c471f0bd27198575719dabe3e5 ]
When remounting filesystem fails late during remount handling and
block_validity mount option is also changed during the remount, we fail
to restore system zone information to a state matching the mount option.
This is mostly harmless, just the block validity checking will not match
the situation described by the mount option. Make sure these two are always
consistent.
Reported-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200728130437.7804-7-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/block_validity.c | 8 --------
fs/ext4/super.c | 29 +++++++++++++++++++++--------
2 files changed, 21 insertions(+), 16 deletions(-)
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index 552164034d340..f22a89cdb4072 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb)
int flex_size = ext4_flex_bg_size(sbi);
int ret;
- if (!test_opt(sb, BLOCK_VALIDITY)) {
- if (sbi->system_blks)
- ext4_release_system_zone(sb);
- return 0;
- }
- if (sbi->system_blks)
- return 0;
-
system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
if (!system_blks)
return -ENOMEM;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index daabd7a2cee81..9ac34b6ae0731 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4473,11 +4473,13 @@ no_journal:
ext4_set_resv_clusters(sb);
- err = ext4_setup_system_zone(sb);
- if (err) {
- ext4_msg(sb, KERN_ERR, "failed to initialize system "
- "zone (%d)", err);
- goto failed_mount4a;
+ if (test_opt(sb, BLOCK_VALIDITY)) {
+ err = ext4_setup_system_zone(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize system "
+ "zone (%d)", err);
+ goto failed_mount4a;
+ }
}
ext4_ext_init(sb);
@@ -5470,9 +5472,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
ext4_register_li_request(sb, first_not_zeroed);
}
- err = ext4_setup_system_zone(sb);
- if (err)
- goto restore_opts;
+ /*
+ * Handle creation of system zone data early because it can fail.
+ * Releasing of existing data is done when we are sure remount will
+ * succeed.
+ */
+ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) {
+ err = ext4_setup_system_zone(sb);
+ if (err)
+ goto restore_opts;
+ }
if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
err = ext4_commit_super(sb, 1);
@@ -5494,6 +5503,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
}
}
#endif
+ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
+ ext4_release_system_zone(sb);
/*
* Some options can be enabled by ext4 and/or by VFS mount flag
@@ -5515,6 +5526,8 @@ restore_opts:
sbi->s_commit_interval = old_opts.s_commit_interval;
sbi->s_min_batch_time = old_opts.s_min_batch_time;
sbi->s_max_batch_time = old_opts.s_max_batch_time;
+ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
+ ext4_release_system_zone(sb);
#ifdef CONFIG_QUOTA
sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
for (i = 0; i < EXT4_MAXQUOTAS; i++) {
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 066/125] fs: prevent BUG_ON in submit_bh_wbc()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 065/125] ext4: correctly restore system zone info when remount fails Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 067/125] spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate Greg Kroah-Hartman
` (62 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xianting Tian, Theodore Tso, Sasha Levin
From: Xianting Tian <xianting_tian@126.com>
[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ]
If a device is hot-removed --- for example, when a physical device is
unplugged from pcie slot or a nbd device's network is shutdown ---
this can result in a BUG_ON() crash in submit_bh_wbc(). This is
because the when the block device dies, the buffer heads will have
their Buffer_Mapped flag get cleared, leading to the crash in
submit_bh_wbc.
We had attempted to work around this problem in commit a17712c8
("ext4: check superblock mapped prior to committing"). Unfortunately,
it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the
device dies between when the work-around check in ext4_commit_super()
and when submit_bh_wbh() is finally called:
Code path:
ext4_commit_super
judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8
lock_buffer(sbh)
...
unlock_buffer(sbh)
__sync_dirty_buffer(sbh,...
lock_buffer(sbh)
judge if 'buffer_mapped(sbh))' is false, return <== added by this patch
submit_bh(...,sbh)
submit_bh_wbc(...,sbh,...)
[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc()
[100722.966503] invalid opcode: 0000 [#1] SMP
[100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000
[100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190
[100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246
[100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000
[100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001
[100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d
[100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800
[100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000
[100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000
[100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0
[100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[100722.966583] PKRU: 55555554
[100722.966583] Call Trace:
[100722.966588] __sync_dirty_buffer+0x6e/0xd0
[100722.966614] ext4_commit_super+0x1d8/0x290 [ext4]
[100722.966626] __ext4_std_error+0x78/0x100 [ext4]
[100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4]
[100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4]
[100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4]
[100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4]
[100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4]
[100722.966679] ext4_dirty_inode+0x48/0x70 [ext4]
[100722.966682] __mark_inode_dirty+0x17f/0x350
[100722.966686] generic_update_time+0x87/0xd0
[100722.966687] touch_atime+0xa9/0xd0
[100722.966690] generic_file_read_iter+0xa09/0xcd0
[100722.966694] ? page_cache_tree_insert+0xb0/0xb0
[100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4]
[100722.966707] ? __inode_security_revalidate+0x4f/0x60
[100722.966709] __vfs_read+0xec/0x160
[100722.966711] vfs_read+0x8c/0x130
[100722.966712] SyS_pread64+0x87/0xb0
[100722.966716] do_syscall_64+0x67/0x1b0
[100722.966719] entry_SYSCALL64_slow_path+0x25/0x25
To address this, add the check of 'buffer_mapped(bh)' to
__sync_dirty_buffer(). This also has the benefit of fixing this for
other file systems.
With this addition, we can drop the workaround in ext4_commit_supper().
[ Commit description rewritten by tytso. ]
Signed-off-by: Xianting Tian <xianting_tian@126.com>
Link: https://lore.kernel.org/r/1596211825-8750-1-git-send-email-xianting_tian@126.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/buffer.c | 9 +++++++++
fs/ext4/super.c | 7 -------
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/fs/buffer.c b/fs/buffer.c
index c49fdab5cb36e..362a868764599 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3193,6 +3193,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags)
WARN_ON(atomic_read(&bh->b_count) < 1);
lock_buffer(bh);
if (test_clear_buffer_dirty(bh)) {
+ /*
+ * The bh should be mapped, but it might not be if the
+ * device was hot-removed. Not much we can do but fail the I/O.
+ */
+ if (!buffer_mapped(bh)) {
+ unlock_buffer(bh);
+ return -EIO;
+ }
+
get_bh(bh);
bh->b_end_io = end_buffer_write_sync;
ret = submit_bh(REQ_OP_WRITE, op_flags, bh);
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 9ac34b6ae0731..0c15ff19acbd4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4966,13 +4966,6 @@ static int ext4_commit_super(struct super_block *sb, int sync)
if (!sbh || block_device_ejected(sb))
return error;
- /*
- * The superblock bh should be mapped, but it might not be if the
- * device was hot-removed. Not much we can do but fail the I/O.
- */
- if (!buffer_mapped(sbh))
- return error;
-
/*
* If the file system is mounted read-only, don't update the
* superblock write time. This avoids updating the superblock
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 067/125] spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 066/125] fs: prevent BUG_ON in submit_bh_wbc() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 068/125] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
` (61 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amelie Delaunay, Alain Volmat,
Mark Brown, Sasha Levin
From: Amelie Delaunay <amelie.delaunay@st.com>
[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ]
Fix spi->clk_rate when it is odd to the nearest lowest even value because
minimum SPI divider is 2.
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Alain Volmat <alain.volmat@st.com>
Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-stm32.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index ad1e55d3d5d59..391a20b3d2fda 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -254,7 +254,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz)
{
u32 div, mbrdiv;
- div = DIV_ROUND_UP(spi->clk_rate, speed_hz);
+ /* Ensure spi->clk_rate is even */
+ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz);
/*
* SPI framework set xfer->speed_hz to master->max_speed_hz if
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 068/125] s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 067/125] spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 069/125] ASoC: wm8994: Avoid attempts to read unreadable registers Greg Kroah-Hartman
` (60 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Oberparleiter, Vineeth Vijayan,
Heiko Carstens, Sasha Levin
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ]
The scanning through subchannels during the time of an event could
take significant amount of time in case of platforms with lots of
known subchannels. This might result in higher scheduling latencies
for other tasks especially on systems with a single CPU. Add
cond_resched() call, as the loop in slow_eval_known_fn() can be
executed for a longer duration.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/cio/css.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index df09ed53ab459..825a8f2703b4f 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -615,6 +615,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
rc = css_evaluate_known_subchannel(sch, 1);
if (rc == -EAGAIN)
css_schedule_eval(sch->schid);
+ /*
+ * The loop might take long time for platforms with lots of
+ * known devices. Allow scheduling here.
+ */
+ cond_resched();
}
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 069/125] ASoC: wm8994: Avoid attempts to read unreadable registers
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 068/125] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 070/125] scsi: fcoe: Fix I/O path allocation Greg Kroah-Hartman
` (59 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sylwester Nawrocki, Charles Keepax,
Mark Brown, Sasha Levin
From: Sylwester Nawrocki <s.nawrocki@samsung.com>
[ Upstream commit f082bb59b72039a2326ec1a44496899fb8aa6d0e ]
The driver supports WM1811, WM8994, WM8958 devices but according to
documentation and the regmap definitions the WM8958_DSP2_* registers
are only available on WM8958. In current code these registers are
being accessed as if they were available on all the three chips.
When starting playback on WM1811 CODEC multiple errors like:
"wm8994-codec wm8994-codec: ASoC: error at soc_component_read_no_lock on wm8994-codec: -5"
can be seen, which is caused by attempts to read an unavailable
WM8958_DSP2_PROGRAM register. The issue has been uncovered by recent
commit "e2329ee ASoC: soc-component: add soc_component_err()".
This patch adds a check in wm8958_aif_ev() callback so the DSP2 handling
is only done for WM8958.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20200731173834.23832-1-s.nawrocki@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8958-dsp2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index 108e8bf42a346..f0a409504a13b 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -419,8 +419,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w,
struct snd_kcontrol *kcontrol, int event)
{
struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+ struct wm8994 *control = dev_get_drvdata(component->dev->parent);
int i;
+ if (control->type != WM8958)
+ return 0;
+
switch (event) {
case SND_SOC_DAPM_POST_PMU:
case SND_SOC_DAPM_PRE_PMU:
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 070/125] scsi: fcoe: Fix I/O path allocation
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 069/125] ASoC: wm8994: Avoid attempts to read unreadable registers Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 071/125] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
` (58 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Lee Duncan,
Mike Christie, Martin K. Petersen, Sasha Levin
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit fa39ab5184d64563cd36f2fb5f0d3fbad83a432c ]
ixgbe_fcoe_ddp_setup() can be called from the main I/O path and is called
with a spin_lock held, so we have to use GFP_ATOMIC allocation instead of
GFP_KERNEL.
Link: https://lore.kernel.org/r/1596831813-9839-1-git-send-email-michael.christie@oracle.com
cc: Hannes Reinecke <hare@suse.de>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index ccd852ad62a4b..d50c5b55da180 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
}
/* alloc the udl from per cpu ddp pool */
- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
+ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
if (!ddp->udl) {
e_err(drv, "failed allocated ddp context\n");
goto out_noddp_unmap;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 071/125] scsi: ufs: Fix possible infinite loop in ufshcd_hold
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 070/125] scsi: fcoe: Fix I/O path allocation Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 072/125] scsi: ufs: Improve interrupt handling for shared interrupts Greg Kroah-Hartman
` (57 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Avri Altman, Andy Teng, Stanley Chu,
Martin K. Petersen, Sasha Levin
From: Stanley Chu <stanley.chu@mediatek.com>
[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ]
In ufshcd_suspend(), after clk-gating is suspended and link is set
as Hibern8 state, ufshcd_hold() is still possibly invoked before
ufshcd_suspend() returns. For example, MediaTek's suspend vops may
issue UIC commands which would call ufshcd_hold() during the command
issuing flow.
Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled,
then ufshcd_hold() may enter infinite loops because there is no
clk-ungating work scheduled or pending. In this case, ufshcd_hold()
shall just bypass, and keep the link as Hibern8 state.
Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Co-developed-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index ab628fd37e026..747a2321b5f7d 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1540,6 +1540,7 @@ unblock_reqs:
int ufshcd_hold(struct ufs_hba *hba, bool async)
{
int rc = 0;
+ bool flush_result;
unsigned long flags;
if (!ufshcd_is_clkgating_allowed(hba))
@@ -1571,7 +1572,9 @@ start:
break;
}
spin_unlock_irqrestore(hba->host->host_lock, flags);
- flush_work(&hba->clk_gating.ungate_work);
+ flush_result = flush_work(&hba->clk_gating.ungate_work);
+ if (hba->clk_gating.is_suspended && !flush_result)
+ goto out;
spin_lock_irqsave(hba->host->host_lock, flags);
goto start;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 072/125] scsi: ufs: Improve interrupt handling for shared interrupts
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 071/125] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 073/125] scsi: ufs: Clean up completed request without interrupt notification Greg Kroah-Hartman
` (56 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Avri Altman, Adrian Hunter,
Martin K. Petersen, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ]
For shared interrupts, the interrupt status might be zero, so check that
first.
Link: https://lore.kernel.org/r/20200811133936.19171-2-adrian.hunter@intel.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 747a2321b5f7d..d8c6fd2012757 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -5605,7 +5605,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
*/
static irqreturn_t ufshcd_intr(int irq, void *__hba)
{
- u32 intr_status, enabled_intr_status;
+ u32 intr_status, enabled_intr_status = 0;
irqreturn_t retval = IRQ_NONE;
struct ufs_hba *hba = __hba;
int retries = hba->nutrs;
@@ -5619,7 +5619,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
* read, make sure we handle them by checking the interrupt status
* again in a loop until we process all of the reqs before returning.
*/
- do {
+ while (intr_status && retries--) {
enabled_intr_status =
intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
if (intr_status)
@@ -5630,7 +5630,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
}
intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
- } while (intr_status && --retries);
+ }
spin_unlock(hba->host->host_lock);
return retval;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 073/125] scsi: ufs: Clean up completed request without interrupt notification
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 072/125] scsi: ufs: Improve interrupt handling for shared interrupts Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 074/125] scsi: qla2xxx: Check if FW supports MQ before enabling Greg Kroah-Hartman
` (55 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Can Guo, Avri Altman, Stanley Chu,
Bean Huo, Martin K. Petersen, Sasha Levin
From: Stanley Chu <stanley.chu@mediatek.com>
[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ]
If somehow no interrupt notification is raised for a completed request and
its doorbell bit is cleared by host, UFS driver needs to cleanup its
outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally
in the following scenario:
After ufshcd_abort() returns, this request will be requeued by SCSI layer
with its outstanding bit set. Any future completed request will trigger
ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At
this time the "abnormal outstanding bit" will be detected and the "requeued
request" will be chosen to execute request post-processing flow. This is
wrong because this request is still "alive".
Link: https://lore.kernel.org/r/20200811141859.27399-2-huobean@gmail.com
Reviewed-by: Can Guo <cang@codeaurora.org>
Acked-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index d8c6fd2012757..eb10a5cacd90c 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -5930,7 +5930,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
/* command completed already */
dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n",
__func__, tag);
- goto out;
+ goto cleanup;
} else {
dev_err(hba->dev,
"%s: no response from device. tag = %d, err %d\n",
@@ -5964,6 +5964,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
goto out;
}
+cleanup:
scsi_dma_unmap(cmd);
spin_lock_irqsave(host->host_lock, flags);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 074/125] scsi: qla2xxx: Check if FW supports MQ before enabling
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 073/125] scsi: ufs: Clean up completed request without interrupt notification Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 075/125] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem Greg Kroah-Hartman
` (54 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Saurav Kashyap,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Saurav Kashyap <skashyap@marvell.com>
[ Upstream commit dffa11453313a115157b19021cc2e27ea98e624c ]
OS boot during Boot from SAN was stuck at dracut emergency shell after
enabling NVMe driver parameter. For non-MQ support the driver was enabling
MQ. Add a check to confirm if FW supports MQ.
Link: https://lore.kernel.org/r/20200806111014.28434-9-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_os.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index b56cf790587e5..e17ca7df8d0e4 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1997,6 +1997,11 @@ skip_pio:
/* Determine queue resources */
ha->max_req_queues = ha->max_rsp_queues = 1;
ha->msix_count = QLA_BASE_VECTORS;
+
+ /* Check if FW supports MQ or not */
+ if (!(ha->fw_attributes & BIT_6))
+ goto mqiobase_exit;
+
if (!ql2xmqsupport || !ql2xnvmeenable ||
(!IS_QLA25XX(ha) && !IS_QLA81XX(ha)))
goto mqiobase_exit;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 075/125] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 074/125] scsi: qla2xxx: Check if FW supports MQ before enabling Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 076/125] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" Greg Kroah-Hartman
` (53 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 83949613fac61e8e37eadf8275bf072342302f4e ]
NVMEAsync command is being submitted to QLA while the same NVMe controller
is in the middle of reset. The reset path has deleted the association and
freed aen_op->fcp_req.private. Add a check for this private pointer before
issuing the command.
...
6 [ffffb656ca11fce0] page_fault at ffffffff8c00114e
[exception RIP: qla_nvme_post_cmd+394]
RIP: ffffffffc0d012ba RSP: ffffb656ca11fd98 RFLAGS: 00010206
RAX: ffff8fb039eda228 RBX: ffff8fb039eda200 RCX: 00000000000da161
RDX: ffffffffc0d4d0f0 RSI: ffffffffc0d26c9b RDI: ffff8fb039eda220
RBP: 0000000000000013 R8: ffff8fb47ff6aa80 R9: 0000000000000002
R10: 0000000000000000 R11: ffffb656ca11fdc8 R12: ffff8fb27d04a3b0
R13: ffff8fc46dd98a58 R14: 0000000000000000 R15: ffff8fc4540f0000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
7 [ffffb656ca11fe08] nvme_fc_start_fcp_op at ffffffffc0241568 [nvme_fc]
8 [ffffb656ca11fe50] nvme_fc_submit_async_event at ffffffffc0241901 [nvme_fc]
9 [ffffb656ca11fe68] nvme_async_event_work at ffffffffc014543d [nvme_core]
10 [ffffb656ca11fe98] process_one_work at ffffffff8b6cd437
11 [ffffb656ca11fed8] worker_thread at ffffffff8b6cdcef
12 [ffffb656ca11ff10] kthread at ffffffff8b6d3402
13 [ffffb656ca11ff50] ret_from_fork at ffffffff8c000255
--
PID: 37824 TASK: ffff8fb033063d80 CPU: 20 COMMAND: "kworker/u97:451"
0 [ffffb656ce1abc28] __schedule at ffffffff8be629e3
1 [ffffb656ce1abcc8] schedule at ffffffff8be62fe8
2 [ffffb656ce1abcd0] schedule_timeout at ffffffff8be671ed
3 [ffffb656ce1abd70] wait_for_completion at ffffffff8be639cf
4 [ffffb656ce1abdd0] flush_work at ffffffff8b6ce2d5
5 [ffffb656ce1abe70] nvme_stop_ctrl at ffffffffc0144900 [nvme_core]
6 [ffffb656ce1abe80] nvme_fc_reset_ctrl_work at ffffffffc0243445 [nvme_fc]
7 [ffffb656ce1abe98] process_one_work at ffffffff8b6cd437
8 [ffffb656ce1abed8] worker_thread at ffffffff8b6cdb50
9 [ffffb656ce1abf10] kthread at ffffffff8b6d3402
10 [ffffb656ce1abf50] ret_from_fork at ffffffff8c000255
Link: https://lore.kernel.org/r/20200806111014.28434-10-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 5590d6e8b5762..3e2f8ce1d9a97 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -477,6 +477,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
struct nvme_private *priv = fd->private;
struct qla_nvme_rport *qla_rport = rport->private;
+ if (!priv) {
+ /* nvme association has been torn down */
+ return rval;
+ }
+
fcport = qla_rport->fcport;
vha = fcport->vha;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 076/125] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 075/125] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 077/125] macvlan: validate setting of multiple remote source MAC addresses Greg Kroah-Hartman
` (52 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Saurav Kashyap,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Saurav Kashyap <skashyap@marvell.com>
[ Upstream commit de7e6194301ad31c4ce95395eb678e51a1b907e5 ]
FCoE adapter initialization failed for ISP8021 with the following patch
applied. In addition, reproduction of the issue the patch originally tried
to address has been unsuccessful.
This reverts commit 3cb182b3fa8b7a61f05c671525494697cba39c6a.
Link: https://lore.kernel.org/r/20200806111014.28434-11-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index ac5d2d34aeeae..07c5d7397d425 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -329,14 +329,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
if (time_after(jiffies, wait_time))
break;
- /*
- * Check if it's UNLOADING, cause we cannot poll in
- * this case, or else a NULL pointer dereference
- * is triggered.
- */
- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags)))
- return QLA_FUNCTION_TIMEOUT;
-
/* Check for pending interrupts. */
qla2x00_poll(ha->rsp_q_map[0]);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 077/125] macvlan: validate setting of multiple remote source MAC addresses
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 076/125] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 078/125] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
` (51 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alvin Šipraga, David S. Miller,
Sasha Levin
From: Alvin Šipraga <alsi@bang-olufsen.dk>
[ Upstream commit 8b61fba503904acae24aeb2bd5569b4d6544d48f ]
Remote source MAC addresses can be set on a 'source mode' macvlan
interface via the IFLA_MACVLAN_MACADDR_DATA attribute. This commit
tightens the validation of these MAC addresses to match the validation
already performed when setting or adding a single MAC address via the
IFLA_MACVLAN_MACADDR attribute.
iproute2 uses IFLA_MACVLAN_MACADDR_DATA for its 'macvlan macaddr set'
command, and IFLA_MACVLAN_MACADDR for its 'macvlan macaddr add' command,
which demonstrates the inconsistent behaviour that this commit
addresses:
# ip link add link eth0 name macvlan0 type macvlan mode source
# ip link set link dev macvlan0 type macvlan macaddr add 01:00:00:00:00:00
RTNETLINK answers: Cannot assign requested address
# ip link set link dev macvlan0 type macvlan macaddr set 01:00:00:00:00:00
# ip -d link show macvlan0
5: macvlan0@eth0: <BROADCAST,MULTICAST,DYNAMIC,UP,LOWER_UP> mtu 1500 ...
link/ether 2e:ac:fd:2d:69:f8 brd ff:ff:ff:ff:ff:ff promiscuity 0
macvlan mode source remotes (1) 01:00:00:00:00:00 numtxqueues 1 ...
With this change, the 'set' command will (rightly) fail in the same way
as the 'add' command.
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/macvlan.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 349123592af0f..e226a96da3a39 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1230,6 +1230,9 @@ static void macvlan_port_destroy(struct net_device *dev)
static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
struct netlink_ext_ack *extack)
{
+ struct nlattr *nla, *head;
+ int rem, len;
+
if (tb[IFLA_ADDRESS]) {
if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
return -EINVAL;
@@ -1277,6 +1280,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
return -EADDRNOTAVAIL;
}
+ if (data[IFLA_MACVLAN_MACADDR_DATA]) {
+ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
+ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
+
+ nla_for_each_attr(nla, head, len, rem) {
+ if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
+ nla_len(nla) != ETH_ALEN)
+ return -EINVAL;
+
+ if (!is_valid_ether_addr(nla_data(nla)))
+ return -EADDRNOTAVAIL;
+ }
+ }
+
if (data[IFLA_MACVLAN_MACADDR_COUNT])
return -EINVAL;
@@ -1333,10 +1350,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode,
len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
nla_for_each_attr(nla, head, len, rem) {
- if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
- nla_len(nla) != ETH_ALEN)
- continue;
-
addr = nla_data(nla);
ret = macvlan_hash_add_source(vlan, addr);
if (ret)
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 078/125] net: gianfar: Add of_node_put() before goto statement
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 077/125] macvlan: validate setting of multiple remote source MAC addresses Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 079/125] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
` (50 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sumera Priyadarsini, David S. Miller,
Sasha Levin
From: Sumera Priyadarsini <sylphrenadin@gmail.com>
[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ]
Every iteration of for_each_available_child_of_node() decrements
reference count of the previous node, however when control
is transferred from the middle of the loop, as in the case of
a return or break or goto, there is no decrement thus ultimately
resulting in a memory leak.
Fix a potential memory leak in gianfar.c by inserting of_node_put()
before the goto statement.
Issue found with Coccinelle.
Signed-off-by: Sumera Priyadarsini <sylphrenadin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/gianfar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index cf2d1e846a692..8243501c37574 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
continue;
err = gfar_parse_group(child, priv, model);
- if (err)
+ if (err) {
+ of_node_put(child);
goto err_grp_init;
+ }
}
} else { /* SQ_SG_MODE */
err = gfar_parse_group(np, priv, model);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 079/125] powerpc/perf: Fix soft lockups due to missed interrupt accounting
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 078/125] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 080/125] block: loop: set discard granularity and alignment for block device backed loop Greg Kroah-Hartman
` (49 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Athira Rajeev,
Michael Ellerman, Sasha Levin
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ]
Performance monitor interrupt handler checks if any counter has
overflown and calls record_and_restart() in core-book3s which invokes
perf_event_overflow() to record the sample information. Apart from
creating sample, perf_event_overflow() also does the interrupt and
period checks via perf_event_account_interrupt().
Currently we record information only if the SIAR (Sampled Instruction
Address Register) valid bit is set (using siar_valid() check) and
hence the interrupt check.
But it is possible that we do sampling for some events that are not
generating valid SIAR, and hence there is no chance to disable the
event if interrupts are more than max_samples_per_tick. This leads to
soft lockup.
Fix this by adding perf_event_account_interrupt() in the invalid SIAR
code path for a sampling event. ie if SIAR is invalid, just do
interrupt check and don't record the sample information.
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/core-book3s.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 4004dbdab9c7b..d407b73298171 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2087,6 +2087,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
if (perf_event_overflow(event, &data, regs))
power_pmu_stop(event, 0);
+ } else if (period) {
+ /* Account for interrupt in case of invalid SIAR */
+ if (perf_event_account_interrupt(event))
+ power_pmu_stop(event, 0);
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 080/125] block: loop: set discard granularity and alignment for block device backed loop
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 079/125] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 081/125] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands Greg Kroah-Hartman
` (48 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ming Lei, Christoph Hellwig, Coly Li,
Hannes Reinecke, Xiao Ni, Martin K. Petersen, Evan Green,
Gwendal Grignou, Chaitanya Kulkarni, Andrzej Pietrasiewicz,
Jens Axboe
From: Ming Lei <ming.lei@redhat.com>
commit bcb21c8cc9947286211327d663ace69f07d37a76 upstream.
In case of block device backend, if the backend supports write zeros, the
loop device will set queue flag of QUEUE_FLAG_DISCARD. However,
limits.discard_granularity isn't setup, and this way is wrong,
see the following description in Documentation/ABI/testing/sysfs-block:
A discard_granularity of 0 means that the device does not support
discard functionality.
Especially 9b15d109a6b2 ("block: improve discard bio alignment in
__blkdev_issue_discard()") starts to take q->limits.discard_granularity
for computing max discard sectors. And zero discard granularity may cause
kernel oops, or fail discard request even though the loop queue claims
discard support via QUEUE_FLAG_DISCARD.
Fix the issue by setup discard granularity and alignment.
Fixes: c52abf563049 ("loop: Better discard support for block devices")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Coly Li <colyli@suse.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Xiao Ni <xni@redhat.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Evan Green <evgreen@chromium.org>
Cc: Gwendal Grignou <gwendal@chromium.org>
Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Cc: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 33 ++++++++++++++++++---------------
1 file changed, 18 insertions(+), 15 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -864,6 +864,7 @@ static void loop_config_discard(struct l
struct file *file = lo->lo_backing_file;
struct inode *inode = file->f_mapping->host;
struct request_queue *q = lo->lo_queue;
+ u32 granularity, max_discard_sectors;
/*
* If the backing device is a block device, mirror its zeroing
@@ -876,11 +877,10 @@ static void loop_config_discard(struct l
struct request_queue *backingq;
backingq = bdev_get_queue(inode->i_bdev);
- blk_queue_max_discard_sectors(q,
- backingq->limits.max_write_zeroes_sectors);
- blk_queue_max_write_zeroes_sectors(q,
- backingq->limits.max_write_zeroes_sectors);
+ max_discard_sectors = backingq->limits.max_write_zeroes_sectors;
+ granularity = backingq->limits.discard_granularity ?:
+ queue_physical_block_size(backingq);
/*
* We use punch hole to reclaim the free space used by the
@@ -889,23 +889,26 @@ static void loop_config_discard(struct l
* useful information.
*/
} else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) {
- q->limits.discard_granularity = 0;
- q->limits.discard_alignment = 0;
- blk_queue_max_discard_sectors(q, 0);
- blk_queue_max_write_zeroes_sectors(q, 0);
+ max_discard_sectors = 0;
+ granularity = 0;
} else {
- q->limits.discard_granularity = inode->i_sb->s_blocksize;
- q->limits.discard_alignment = 0;
-
- blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
- blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
+ max_discard_sectors = UINT_MAX >> 9;
+ granularity = inode->i_sb->s_blocksize;
}
- if (q->limits.max_write_zeroes_sectors)
+ if (max_discard_sectors) {
+ q->limits.discard_granularity = granularity;
+ blk_queue_max_discard_sectors(q, max_discard_sectors);
+ blk_queue_max_write_zeroes_sectors(q, max_discard_sectors);
blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
- else
+ } else {
+ q->limits.discard_granularity = 0;
+ blk_queue_max_discard_sectors(q, 0);
+ blk_queue_max_write_zeroes_sectors(q, 0);
blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q);
+ }
+ q->limits.discard_alignment = 0;
}
static void loop_unprepare_queue(struct loop_device *lo)
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 081/125] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 080/125] block: loop: set discard granularity and alignment for block device backed loop Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 082/125] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART Greg Kroah-Hartman
` (47 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Hans de Goede,
Jiri Kosina, Andrea Borgia
From: Hans de Goede <hdegoede@redhat.com>
commit eef4016243e94c438f177ca8226876eb873b9c75 upstream.
Before this commit i2c_hid_parse() consists of the following steps:
1. Send power on cmd
2. usleep_range(1000, 5000)
3. Send reset cmd
4. Wait for reset to complete (device interrupt, or msleep(100))
5. Send power on cmd
6. Try to read HID descriptor
Notice how there is an usleep_range(1000, 5000) after the first power-on
command, but not after the second power-on command.
Testing has shown that at least on the BMAX Y13 laptop's i2c-hid touchpad,
not having a delay after the second power-on command causes the HID
descriptor to read as all zeros.
In case we hit this on other devices too, the descriptor being all zeros
can be recognized by the following message being logged many, many times:
hid-generic 0018:0911:5288.0002: unknown main item tag 0x0
At the same time as the BMAX Y13's touchpad issue was debugged,
Kai-Heng was working on debugging some issues with Goodix i2c-hid
touchpads. It turns out that these need a delay after a PWR_ON command
too, otherwise they stop working after a suspend/resume cycle.
According to Goodix a delay of minimal 60ms is needed.
Having multiple cases where we need a delay after sending the power-on
command, seems to indicate that we should always sleep after the power-on
command.
This commit fixes the mentioned issues by moving the existing 1ms sleep to
the i2c_hid_set_power() function and changing it to a 60ms sleep.
Cc: stable@vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208247
Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reported-and-tested-by: Andrea Borgia <andrea@borgia.bo.it>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -444,6 +444,19 @@ static int i2c_hid_set_power(struct i2c_
dev_err(&client->dev, "failed to change power setting.\n");
set_pwr_exit:
+
+ /*
+ * The HID over I2C specification states that if a DEVICE needs time
+ * after the PWR_ON request, it should utilise CLOCK stretching.
+ * However, it has been observered that the Windows driver provides a
+ * 1ms sleep between the PWR_ON and RESET requests.
+ * According to Goodix Windows even waits 60 ms after (other?)
+ * PWR_ON requests. Testing has confirmed that several devices
+ * will not work properly without a delay after a PWR_ON request.
+ */
+ if (!ret && power_state == I2C_HID_PWR_ON)
+ msleep(60);
+
return ret;
}
@@ -465,15 +478,6 @@ static int i2c_hid_hwreset(struct i2c_cl
if (ret)
goto out_unlock;
- /*
- * The HID over I2C specification states that if a DEVICE needs time
- * after the PWR_ON request, it should utilise CLOCK stretching.
- * However, it has been observered that the Windows driver provides a
- * 1ms sleep between the PWR_ON and RESET requests and that some devices
- * rely on this.
- */
- usleep_range(1000, 5000);
-
i2c_hid_dbg(ihid, "resetting...\n");
ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 082/125] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 081/125] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 083/125] btrfs: reset compression level for lzo on remount Greg Kroah-Hartman
` (46 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Ming Lei,
Christoph Hellwig, Bart Van Assche, David Jeffery, Jens Axboe
From: Ming Lei <ming.lei@redhat.com>
commit d7d8535f377e9ba87edbf7fbbd634ac942f3f54f upstream.
SCHED_RESTART code path is relied to re-run queue for dispatch requests
in hctx->dispatch. Meantime the SCHED_RSTART flag is checked when adding
requests to hctx->dispatch.
memory barriers have to be used for ordering the following two pair of OPs:
1) adding requests to hctx->dispatch and checking SCHED_RESTART in
blk_mq_dispatch_rq_list()
2) clearing SCHED_RESTART and checking if there is request in hctx->dispatch
in blk_mq_sched_restart().
Without the added memory barrier, either:
1) blk_mq_sched_restart() may miss requests added to hctx->dispatch meantime
blk_mq_dispatch_rq_list() observes SCHED_RESTART, and not run queue in
dispatch side
or
2) blk_mq_dispatch_rq_list still sees SCHED_RESTART, and not run queue
in dispatch side, meantime checking if there is request in
hctx->dispatch from blk_mq_sched_restart() is missed.
IO hang in ltp/fs_fill test is reported by kernel test robot:
https://lkml.org/lkml/2020/7/26/77
Turns out it is caused by the above out-of-order OPs. And the IO hang
can't be observed any more after applying this patch.
Fixes: bd166ef183c2 ("blk-mq-sched: add framework for MQ capable IO schedulers")
Reported-by: kernel test robot <rong.a.chen@intel.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Jeffery <djeffery@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-mq-sched.c | 9 +++++++++
block/blk-mq.c | 9 +++++++++
2 files changed, 18 insertions(+)
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -69,6 +69,15 @@ void blk_mq_sched_restart(struct blk_mq_
return;
clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+ /*
+ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch)
+ * in blk_mq_run_hw_queue(). Its pair is the barrier in
+ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART,
+ * meantime new request added to hctx->dispatch is missed to check in
+ * blk_mq_run_hw_queue().
+ */
+ smp_mb();
+
blk_mq_run_hw_queue(hctx, true);
}
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1222,6 +1222,15 @@ bool blk_mq_dispatch_rq_list(struct requ
spin_unlock(&hctx->lock);
/*
+ * Order adding requests to hctx->dispatch and checking
+ * SCHED_RESTART flag. The pair of this smp_mb() is the one
+ * in blk_mq_sched_restart(). Avoid restart code path to
+ * miss the new added requests to hctx->dispatch, meantime
+ * SCHED_RESTART is observed here.
+ */
+ smp_mb();
+
+ /*
* If SCHED_RESTART was set by the caller of this function and
* it is no longer set that means that it was cleared by another
* thread and hence that a queue rerun is needed.
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 083/125] btrfs: reset compression level for lzo on remount
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 082/125] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 084/125] btrfs: fix space cache memory leak after transaction abort Greg Kroah-Hartman
` (45 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcos Paulo de Souza, David Sterba
From: Marcos Paulo de Souza <mpdesouza@suse.com>
commit 282dd7d7718444679b046b769d872b188818ca35 upstream.
Currently a user can set mount "-o compress" which will set the
compression algorithm to zlib, and use the default compress level for
zlib (3):
relatime,compress=zlib:3,space_cache
If the user remounts the fs using "-o compress=lzo", then the old
compress_level is used:
relatime,compress=lzo:3,space_cache
But lzo does not expose any tunable compression level. The same happens
if we set any compress argument with different level, also with zstd.
Fix this by resetting the compress_level when compress=lzo is
specified. With the fix applied, lzo is shown without compress level:
relatime,compress=lzo,space_cache
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/super.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -539,6 +539,7 @@ int btrfs_parse_options(struct btrfs_fs_
} else if (strncmp(args[0].from, "lzo", 3) == 0) {
compress_type = "lzo";
info->compress_type = BTRFS_COMPRESS_LZO;
+ info->compress_level = 0;
btrfs_set_opt(info->mount_opt, COMPRESS);
btrfs_clear_opt(info->mount_opt, NODATACOW);
btrfs_clear_opt(info->mount_opt, NODATASUM);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 084/125] btrfs: fix space cache memory leak after transaction abort
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 083/125] btrfs: reset compression level for lzo on remount Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 085/125] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
` (44 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit bbc37d6e475eee8ffa2156ec813efc6bbb43c06d upstream.
If a transaction aborts it can cause a memory leak of the pages array of
a block group's io_ctl structure. The following steps explain how that can
happen:
1) Transaction N is committing, currently in state TRANS_STATE_UNBLOCKED
and it's about to start writing out dirty extent buffers;
2) Transaction N + 1 already started and another task, task A, just called
btrfs_commit_transaction() on it;
3) Block group B was dirtied (extents allocated from it) by transaction
N + 1, so when task A calls btrfs_start_dirty_block_groups(), at the
very beginning of the transaction commit, it starts writeback for the
block group's space cache by calling btrfs_write_out_cache(), which
allocates the pages array for the block group's io_ctl with a call to
io_ctl_init(). Block group A is added to the io_list of transaction
N + 1 by btrfs_start_dirty_block_groups();
4) While transaction N's commit is writing out the extent buffers, it gets
an IO error and aborts transaction N, also setting the file system to
RO mode;
5) Task A has already returned from btrfs_start_dirty_block_groups(), is at
btrfs_commit_transaction() and has set transaction N + 1 state to
TRANS_STATE_COMMIT_START. Immediately after that it checks that the
filesystem was turned to RO mode, due to transaction N's abort, and
jumps to the "cleanup_transaction" label. After that we end up at
btrfs_cleanup_one_transaction() which calls btrfs_cleanup_dirty_bgs().
That helper finds block group B in the transaction's io_list but it
never releases the pages array of the block group's io_ctl, resulting in
a memory leak.
In fact at the point when we are at btrfs_cleanup_dirty_bgs(), the pages
array points to pages that were already released by us at
__btrfs_write_out_cache() through the call to io_ctl_drop_pages(). We end
up freeing the pages array only after waiting for the ordered extent to
complete through btrfs_wait_cache_io(), which calls io_ctl_free() to do
that. But in the transaction abort case we don't wait for the space cache's
ordered extent to complete through a call to btrfs_wait_cache_io(), so
that's why we end up with a memory leak - we wait for the ordered extent
to complete indirectly by shutting down the work queues and waiting for
any jobs in them to complete before returning from close_ctree().
We can solve the leak simply by freeing the pages array right after
releasing the pages (with the call to io_ctl_drop_pages()) at
__btrfs_write_out_cache(), since we will never use it anymore after that
and the pages array points to already released pages at that point, which
is currently not a problem since no one will use it after that, but not a
good practice anyway since it can easily lead to use-after-free issues.
So fix this by freeing the pages array right after releasing the pages at
__btrfs_write_out_cache().
This issue can often be reproduced with test case generic/475 from fstests
and kmemleak can detect it and reports it with the following trace:
unreferenced object 0xffff9bbf009fa600 (size 512):
comm "fsstress", pid 38807, jiffies 4298504428 (age 22.028s)
hex dump (first 32 bytes):
00 a0 7c 4d 3d ed ff ff 40 a0 7c 4d 3d ed ff ff ..|M=...@.|M=...
80 a0 7c 4d 3d ed ff ff c0 a0 7c 4d 3d ed ff ff ..|M=.....|M=...
backtrace:
[<00000000f4b5cfe2>] __kmalloc+0x1a8/0x3e0
[<0000000028665e7f>] io_ctl_init+0xa7/0x120 [btrfs]
[<00000000a1f95b2d>] __btrfs_write_out_cache+0x86/0x4a0 [btrfs]
[<00000000207ea1b0>] btrfs_write_out_cache+0x7f/0xf0 [btrfs]
[<00000000af21f534>] btrfs_start_dirty_block_groups+0x27b/0x580 [btrfs]
[<00000000c3c23d44>] btrfs_commit_transaction+0xa6f/0xe70 [btrfs]
[<000000009588930c>] create_subvol+0x581/0x9a0 [btrfs]
[<000000009ef2fd7f>] btrfs_mksubvol+0x3fb/0x4a0 [btrfs]
[<00000000474e5187>] __btrfs_ioctl_snap_create+0x119/0x1a0 [btrfs]
[<00000000708ee349>] btrfs_ioctl_snap_create_v2+0xb0/0xf0 [btrfs]
[<00000000ea60106f>] btrfs_ioctl+0x12c/0x3130 [btrfs]
[<000000005c923d6d>] __x64_sys_ioctl+0x83/0xb0
[<0000000043ace2c9>] do_syscall_64+0x33/0x80
[<00000000904efbce>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
CC: stable@vger.kernel.org # 4.9+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/disk-io.c | 1 +
fs/btrfs/free-space-cache.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -4444,6 +4444,7 @@ static void btrfs_cleanup_bg_io(struct b
cache->io_ctl.inode = NULL;
iput(inode);
}
+ ASSERT(cache->io_ctl.pages == NULL);
btrfs_put_block_group(cache);
}
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1167,7 +1167,6 @@ static int __btrfs_wait_cache_io(struct
ret = update_cache_item(trans, root, inode, path, offset,
io_ctl->entries, io_ctl->bitmaps);
out:
- io_ctl_free(io_ctl);
if (ret) {
invalidate_inode_pages2(inode->i_mapping);
BTRFS_I(inode)->generation = 0;
@@ -1332,6 +1331,7 @@ static int __btrfs_write_out_cache(struc
* them out later
*/
io_ctl_drop_pages(io_ctl);
+ io_ctl_free(io_ctl);
unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
i_size_read(inode) - 1, &cached_state);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 085/125] fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 084/125] btrfs: fix space cache memory leak after transaction abort Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 21:22 ` Pavel Machek
2020-09-01 15:10 ` [PATCH 4.19 086/125] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
` (43 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George Kennedy, syzbot+38a3699c7eaf165b97a6
From: George Kennedy <george.kennedy@oracle.com>
commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.
Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2152,6 +2152,9 @@ static void updatescrollmode(struct disp
}
}
+#define PITCH(w) (((w) + 7) >> 3)
+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
+
static int fbcon_resize(struct vc_data *vc, unsigned int width,
unsigned int height, unsigned int user)
{
@@ -2161,6 +2164,24 @@ static int fbcon_resize(struct vc_data *
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
+ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+ int size;
+ int pitch = PITCH(vc->vc_font.width);
+
+ /*
+ * If user font, ensure that a possible change to user font
+ * height or width will not allow a font data out-of-bounds access.
+ * NOTE: must use original charcount in calculation as font
+ * charcount can change and cannot be used to determine the
+ * font data allocated size.
+ */
+ if (pitch <= 0)
+ return -EINVAL;
+ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
+ if (size > FNTSIZE(vc->vc_font.data))
+ return -EINVAL;
+ }
+
virt_w = FBCON_SWAP(ops->rotate, width, height);
virt_h = FBCON_SWAP(ops->rotate, height, width);
virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2623,7 +2644,7 @@ static int fbcon_set_font(struct vc_data
int size;
int i, csum;
u8 *new_data, *data = font->data;
- int pitch = (font->width+7) >> 3;
+ int pitch = PITCH(font->width);
/* Is there a reason why fbconsole couldn't handle any charcount >256?
* If not this check should be changed to charcount < 256 */
@@ -2639,7 +2660,7 @@ static int fbcon_set_font(struct vc_data
if (fbcon_invalid_charcount(info, charcount))
return -EINVAL;
- size = h * pitch * charcount;
+ size = CALC_FONTSZ(h, pitch, charcount);
new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 085/125] fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-01 15:10 ` [PATCH 4.19 085/125] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
@ 2020-09-01 21:22 ` Pavel Machek
0 siblings, 0 replies; 147+ messages in thread
From: Pavel Machek @ 2020-09-01 21:22 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, George Kennedy, syzbot+38a3699c7eaf165b97a6
[-- Attachment #1: Type: text/plain, Size: 1346 bytes --]
On Tue 2020-09-01 17:10:40, Greg Kroah-Hartman wrote:
> From: George Kennedy <george.kennedy@oracle.com>
>
> commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.
>
> Add a check to fbcon_resize() to ensure that a possible change to user font
> height or user font width will not allow a font data out-of-bounds access.
> NOTE: must use original charcount in calculation as font charcount can
> change and cannot be used to determine the font data allocated size.
> +#define PITCH(w) (((w) + 7) >> 3)
> +#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
Ok, so we validate data from user. Can this overflow? Should it be
inline function for readability?
> static int fbcon_resize(struct vc_data *vc, unsigned int width,
> unsigned int height, unsigned int user)
> {
> @@ -2161,6 +2164,24 @@ static int fbcon_resize(struct vc_data *
> struct fb_var_screeninfo var = info->var;
> int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
>
> + if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
> + int size;
> + int pitch = PITCH(vc->vc_font.width);
Should size be unsigned?
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 086/125] USB: lvtest: return proper error code in probe
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 085/125] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 087/125] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
` (42 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Evgeny Novikov
From: Evgeny Novikov <novikov@ispras.ru>
commit 531412492ce93ea29b9ca3b4eb5e3ed771f851dd upstream.
lvs_rh_probe() can return some nonnegative value from usb_control_msg()
when it is less than "USB_DT_HUB_NONVAR_SIZE + 2" that is considered as
a failure. Make lvs_rh_probe() return -EINVAL in this case.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200805090643.3432-1-novikov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/lvstest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -429,7 +429,7 @@ static int lvs_rh_probe(struct usb_inter
USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT);
if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) {
dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret);
- return ret;
+ return ret < 0 ? ret : -EINVAL;
}
/* submit urb to poll interrupt endpoint */
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 087/125] vt: defer kfree() of vc_screenbuf in vc_do_resize()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 086/125] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 088/125] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
` (41 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit f8d1653daec02315e06d30246cff4af72e76e54e upstream.
syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for
vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin().
Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access
vc->vc_pos when scroll is involved in order to manipulate cursor, but
vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets
updated based on the result of vc->vc_sw->con_set_origin().
Preserving old buffer and tolerating outdated vc members until set_origin()
completes would be easier than preventing vc->vc_sw->con_set_origin() from
accessing outdated vc members.
[1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3
Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1596034621-4714-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/vt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1199,7 +1199,7 @@ static int vc_do_resize(struct tty_struc
unsigned int old_rows, old_row_size, first_copied_row;
unsigned int new_cols, new_rows, new_row_size, new_screen_size;
unsigned int user;
- unsigned short *newscreen;
+ unsigned short *oldscreen, *newscreen;
struct uni_screen *new_uniscr = NULL;
WARN_CONSOLE_UNLOCKED();
@@ -1297,10 +1297,11 @@ static int vc_do_resize(struct tty_struc
if (new_scr_end > new_origin)
scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
new_scr_end - new_origin);
- kfree(vc->vc_screenbuf);
+ oldscreen = vc->vc_screenbuf;
vc->vc_screenbuf = newscreen;
vc->vc_screenbuf_size = new_screen_size;
set_origin(vc);
+ kfree(oldscreen);
/* do part of a reset_terminal() */
vc->vc_top = 0;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 088/125] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 087/125] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 089/125] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
` (40 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George Kennedy, syzbot+38a3699c7eaf165b97a6
From: George Kennedy <george.kennedy@oracle.com>
commit bc5269ca765057a1b762e79a1cfd267cd7bf1c46 upstream.
vc_resize() can return with an error after failure. Change VT_RESIZEX ioctl
to save struct vc_data values that are modified and restore the original
values in case of error.
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-2-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/vt_ioctl.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -893,12 +893,22 @@ int vt_ioctl(struct tty_struct *tty,
console_lock();
vcp = vc_cons[i].d;
if (vcp) {
+ int ret;
+ int save_scan_lines = vcp->vc_scan_lines;
+ int save_font_height = vcp->vc_font.height;
+
if (v.v_vlin)
vcp->vc_scan_lines = v.v_vlin;
if (v.v_clin)
vcp->vc_font.height = v.v_clin;
vcp->vc_resize_user = 1;
- vc_resize(vcp, v.v_cols, v.v_rows);
+ ret = vc_resize(vcp, v.v_cols, v.v_rows);
+ if (ret) {
+ vcp->vc_scan_lines = save_scan_lines;
+ vcp->vc_font.height = save_font_height;
+ console_unlock();
+ return ret;
+ }
}
console_unlock();
}
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 089/125] serial: samsung: Removes the IRQ not found warning
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 088/125] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 090/125] serial: pl011: Fix oops on -EPROBE_DEFER Greg Kroah-Hartman
` (39 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alim Akhtar, Marek Szyprowski,
Krzysztof Kozlowski, Tamseel Shams
From: Tamseel Shams <m.shams@samsung.com>
commit 8c6c378b0cbe0c9f1390986b5f8ffb5f6ff7593b upstream.
In few older Samsung SoCs like s3c2410, s3c2412
and s3c2440, UART IP is having 2 interrupt lines.
However, in other SoCs like s3c6400, s5pv210,
exynos5433, and exynos4210 UART is having only 1
interrupt line. Due to this, "platform_get_irq(platdev, 1)"
call in the driver gives the following false-positive error:
"IRQ index 1 not found" on newer SoC's.
This patch adds the condition to check for Tx interrupt
only for the those SoC's which have 2 interrupt lines.
Tested-by: Alim Akhtar <alim.akhtar@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Tamseel Shams <m.shams@samsung.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810030021.45348-1-m.shams@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/samsung.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1755,9 +1755,11 @@ static int s3c24xx_serial_init_port(stru
ourport->tx_irq = ret + 1;
}
- ret = platform_get_irq(platdev, 1);
- if (ret > 0)
- ourport->tx_irq = ret;
+ if (!s3c24xx_serial_has_interrupt_mask(port)) {
+ ret = platform_get_irq(platdev, 1);
+ if (ret > 0)
+ ourport->tx_irq = ret;
+ }
/*
* DMA is currently supported only on DT platforms, if DMA properties
* are specified.
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 090/125] serial: pl011: Fix oops on -EPROBE_DEFER
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 089/125] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 091/125] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
` (38 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Aleksey Makarov,
Peter Hurley, Russell King, Christopher Covington
From: Lukas Wunner <lukas@wunner.de>
commit 27afac93e3bd7fa89749cf11da5d86ac9cde4dba upstream.
If probing of a pl011 gets deferred until after free_initmem(), an oops
ensues because pl011_console_match() is called which has been freed.
Fix by removing the __init attribute from the function and those it
calls.
Commit 10879ae5f12e ("serial: pl011: add console matching function")
introduced pl011_console_match() not just for early consoles but
regular preferred consoles, such as those added by acpi_parse_spcr().
Regular consoles may be registered after free_initmem() for various
reasons, one being deferred probing, another being dynamic enablement
of serial ports using a DeviceTree overlay.
Thus, pl011_console_match() must not be declared __init and the
functions it calls mustn't either.
Stack trace for posterity:
Unable to handle kernel paging request at virtual address 80c38b58
Internal error: Oops: 8000000d [#1] PREEMPT SMP ARM
PC is at pl011_console_match+0x0/0xfc
LR is at register_console+0x150/0x468
[<80187004>] (register_console)
[<805a8184>] (uart_add_one_port)
[<805b2b68>] (pl011_register_port)
[<805b3ce4>] (pl011_probe)
[<80569214>] (amba_probe)
[<805ca088>] (really_probe)
[<805ca2ec>] (driver_probe_device)
[<805ca5b0>] (__device_attach_driver)
[<805c8060>] (bus_for_each_drv)
[<805c9dfc>] (__device_attach)
[<805ca630>] (device_initial_probe)
[<805c90a8>] (bus_probe_device)
[<805c95a8>] (deferred_probe_work_func)
Fixes: 10879ae5f12e ("serial: pl011: add console matching function")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v4.10+
Cc: Aleksey Makarov <amakarov@marvell.com>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Christopher Covington <cov@codeaurora.org>
Link: https://lore.kernel.org/r/f827ff09da55b8c57d316a1b008a137677b58921.1597315557.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2252,9 +2252,8 @@ pl011_console_write(struct console *co,
clk_disable(uap->clk);
}
-static void __init
-pl011_console_get_options(struct uart_amba_port *uap, int *baud,
- int *parity, int *bits)
+static void pl011_console_get_options(struct uart_amba_port *uap, int *baud,
+ int *parity, int *bits)
{
if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) {
unsigned int lcr_h, ibrd, fbrd;
@@ -2287,7 +2286,7 @@ pl011_console_get_options(struct uart_am
}
}
-static int __init pl011_console_setup(struct console *co, char *options)
+static int pl011_console_setup(struct console *co, char *options)
{
struct uart_amba_port *uap;
int baud = 38400;
@@ -2355,8 +2354,8 @@ static int __init pl011_console_setup(st
*
* Returns 0 if console matches; otherwise non-zero to use default matching
*/
-static int __init pl011_console_match(struct console *co, char *name, int idx,
- char *options)
+static int pl011_console_match(struct console *co, char *name, int idx,
+ char *options)
{
unsigned char iotype;
resource_size_t addr;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 091/125] serial: pl011: Dont leak amba_ports entry on driver register error
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 090/125] serial: pl011: Fix oops on -EPROBE_DEFER Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 092/125] serial: 8250_exar: Fix number of ports for Commtech PCIe cards Greg Kroah-Hartman
` (37 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tushar Behera
From: Lukas Wunner <lukas@wunner.de>
commit 89efbe70b27dd325d8a8c177743a26b885f7faec upstream.
pl011_probe() calls pl011_setup_port() to reserve an amba_ports[] entry,
then calls pl011_register_port() to register the uart driver with the
tty layer.
If registration of the uart driver fails, the amba_ports[] entry is not
released. If this happens 14 times (value of UART_NR macro), then all
amba_ports[] entries will have been leaked and driver probing is no
longer possible. (To be fair, that can only happen if the DeviceTree
doesn't contain alias IDs since they cause the same entry to be used for
a given port.) Fix it.
Fixes: ef2889f7ffee ("serial: pl011: Move uart_register_driver call to device")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.15+
Cc: Tushar Behera <tushar.behera@linaro.org>
Link: https://lore.kernel.org/r/138f8c15afb2f184d8102583f8301575566064a6.1597316167.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2593,7 +2593,7 @@ static int pl011_setup_port(struct devic
static int pl011_register_port(struct uart_amba_port *uap)
{
- int ret;
+ int ret, i;
/* Ensure interrupts from this UART are masked and cleared */
pl011_write(0, uap, REG_IMSC);
@@ -2604,6 +2604,9 @@ static int pl011_register_port(struct ua
if (ret < 0) {
dev_err(uap->port.dev,
"Failed to register AMBA-PL011 driver\n");
+ for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
+ if (amba_ports[i] == uap)
+ amba_ports[i] = NULL;
return ret;
}
}
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 092/125] serial: 8250_exar: Fix number of ports for Commtech PCIe cards
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 091/125] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 093/125] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
` (36 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Valmer Huhn
From: Valmer Huhn <valmer.huhn@concurrent-rt.com>
commit c6b9e95dde7b54e6a53c47241201ab5a4035c320 upstream.
The following in 8250_exar.c line 589 is used to determine the number
of ports for each Exar board:
nr_ports = board->num_ports ? board->num_ports : pcidev->device & 0x0f;
If the number of ports a card has is not explicitly specified, it defaults
to the rightmost 4 bits of the PCI device ID. This is prone to error since
not all PCI device IDs contain a number which corresponds to the number of
ports that card provides.
This particular case involves COMMTECH_4222PCIE, COMMTECH_4224PCIE and
COMMTECH_4228PCIE cards with device IDs 0x0022, 0x0020 and 0x0021.
Currently the multiport cards receive 2, 0 and 1 port instead of 2, 4 and
8 ports respectively.
To fix this, each Commtech Fastcom PCIe card is given a struct where the
number of ports is explicitly specified. This ensures 'board->num_ports'
is used instead of the default 'pcidev->device & 0x0f'.
Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci")
Signed-off-by: Valmer Huhn <valmer.huhn@concurrent-rt.com>
Tested-by: Valmer Huhn <valmer.huhn@concurrent-rt.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200813165255.GC345440@icarus.concurrent-rt.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_exar.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -638,6 +638,24 @@ static const struct exar8250_board pbn_e
.exit = pci_xr17v35x_exit,
};
+static const struct exar8250_board pbn_fastcom35x_2 = {
+ .num_ports = 2,
+ .setup = pci_xr17v35x_setup,
+ .exit = pci_xr17v35x_exit,
+};
+
+static const struct exar8250_board pbn_fastcom35x_4 = {
+ .num_ports = 4,
+ .setup = pci_xr17v35x_setup,
+ .exit = pci_xr17v35x_exit,
+};
+
+static const struct exar8250_board pbn_fastcom35x_8 = {
+ .num_ports = 8,
+ .setup = pci_xr17v35x_setup,
+ .exit = pci_xr17v35x_exit,
+};
+
static const struct exar8250_board pbn_exar_XR17V4358 = {
.num_ports = 12,
.setup = pci_xr17v35x_setup,
@@ -708,9 +726,9 @@ static const struct pci_device_id exar_p
EXAR_DEVICE(EXAR, EXAR_XR17V358, pbn_exar_XR17V35x),
EXAR_DEVICE(EXAR, EXAR_XR17V4358, pbn_exar_XR17V4358),
EXAR_DEVICE(EXAR, EXAR_XR17V8358, pbn_exar_XR17V8358),
- EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_exar_XR17V35x),
- EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_exar_XR17V35x),
- EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_exar_XR17V35x),
+ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_fastcom35x_2),
+ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_fastcom35x_4),
+ EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_fastcom35x_8),
EXAR_DEVICE(COMMTECH, COMMTECH_4222PCI335, pbn_fastcom335_2),
EXAR_DEVICE(COMMTECH, COMMTECH_4224PCI335, pbn_fastcom335_4),
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 093/125] serial: 8250: change lock order in serial8250_do_startup()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 092/125] serial: 8250_exar: Fix number of ports for Commtech PCIe cards Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 094/125] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
` (35 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Senozhatsky, Guenter Roeck,
Raul Rangel, Andy Shevchenko
From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
commit 205d300aea75623e1ae4aa43e0d265ab9cf195fd upstream.
We have a number of "uart.port->desc.lock vs desc.lock->uart.port"
lockdep reports coming from 8250 driver; this causes a bit of trouble
to people, so let's fix it.
The problem is reverse lock order in two different call paths:
chain #1:
serial8250_do_startup()
spin_lock_irqsave(&port->lock);
disable_irq_nosync(port->irq);
raw_spin_lock_irqsave(&desc->lock)
chain #2:
__report_bad_irq()
raw_spin_lock_irqsave(&desc->lock)
for_each_action_of_desc()
printk()
spin_lock_irqsave(&port->lock);
Fix this by changing the order of locks in serial8250_do_startup():
do disable_irq_nosync() first, which grabs desc->lock, and grab
uart->port after that, so that chain #1 and chain #2 have same lock
order.
Full lockdep splat:
======================================================
WARNING: possible circular locking dependency detected
5.4.39 #55 Not tainted
======================================================
swapper/0/0 is trying to acquire lock:
ffffffffab65b6c0 (console_owner){-...}, at: console_lock_spinning_enable+0x31/0x57
but task is already holding lock:
ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&irq_desc_lock_class){-.-.}:
_raw_spin_lock_irqsave+0x61/0x8d
__irq_get_desc_lock+0x65/0x89
__disable_irq_nosync+0x3b/0x93
serial8250_do_startup+0x451/0x75c
uart_startup+0x1b4/0x2ff
uart_port_activate+0x73/0xa0
tty_port_open+0xae/0x10a
uart_open+0x1b/0x26
tty_open+0x24d/0x3a0
chrdev_open+0xd5/0x1cc
do_dentry_open+0x299/0x3c8
path_openat+0x434/0x1100
do_filp_open+0x9b/0x10a
do_sys_open+0x15f/0x3d7
kernel_init_freeable+0x157/0x1dd
kernel_init+0xe/0x105
ret_from_fork+0x27/0x50
-> #1 (&port_lock_key){-.-.}:
_raw_spin_lock_irqsave+0x61/0x8d
serial8250_console_write+0xa7/0x2a0
console_unlock+0x3b7/0x528
vprintk_emit+0x111/0x17f
printk+0x59/0x73
register_console+0x336/0x3a4
uart_add_one_port+0x51b/0x5be
serial8250_register_8250_port+0x454/0x55e
dw8250_probe+0x4dc/0x5b9
platform_drv_probe+0x67/0x8b
really_probe+0x14a/0x422
driver_probe_device+0x66/0x130
device_driver_attach+0x42/0x5b
__driver_attach+0xca/0x139
bus_for_each_dev+0x97/0xc9
bus_add_driver+0x12b/0x228
driver_register+0x64/0xed
do_one_initcall+0x20c/0x4a6
do_initcall_level+0xb5/0xc5
do_basic_setup+0x4c/0x58
kernel_init_freeable+0x13f/0x1dd
kernel_init+0xe/0x105
ret_from_fork+0x27/0x50
-> #0 (console_owner){-...}:
__lock_acquire+0x118d/0x2714
lock_acquire+0x203/0x258
console_lock_spinning_enable+0x51/0x57
console_unlock+0x25d/0x528
vprintk_emit+0x111/0x17f
printk+0x59/0x73
__report_bad_irq+0xa3/0xba
note_interrupt+0x19a/0x1d6
handle_irq_event_percpu+0x57/0x79
handle_irq_event+0x36/0x55
handle_fasteoi_irq+0xc2/0x18a
do_IRQ+0xb3/0x157
ret_from_intr+0x0/0x1d
cpuidle_enter_state+0x12f/0x1fd
cpuidle_enter+0x2e/0x3d
do_idle+0x1ce/0x2ce
cpu_startup_entry+0x1d/0x1f
start_kernel+0x406/0x46a
secondary_startup_64+0xa4/0xb0
other info that might help us debug this:
Chain exists of:
console_owner --> &port_lock_key --> &irq_desc_lock_class
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&irq_desc_lock_class);
lock(&port_lock_key);
lock(&irq_desc_lock_class);
lock(console_owner);
*** DEADLOCK ***
2 locks held by swapper/0/0:
#0: ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba
#1: ffffffffab65b5c0 (console_lock){+.+.}, at: console_trylock_spinning+0x20/0x181
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.39 #55
Hardware name: XXXXXX
Call Trace:
<IRQ>
dump_stack+0xbf/0x133
? print_circular_bug+0xd6/0xe9
check_noncircular+0x1b9/0x1c3
__lock_acquire+0x118d/0x2714
lock_acquire+0x203/0x258
? console_lock_spinning_enable+0x31/0x57
console_lock_spinning_enable+0x51/0x57
? console_lock_spinning_enable+0x31/0x57
console_unlock+0x25d/0x528
? console_trylock+0x18/0x4e
vprintk_emit+0x111/0x17f
? lock_acquire+0x203/0x258
printk+0x59/0x73
__report_bad_irq+0xa3/0xba
note_interrupt+0x19a/0x1d6
handle_irq_event_percpu+0x57/0x79
handle_irq_event+0x36/0x55
handle_fasteoi_irq+0xc2/0x18a
do_IRQ+0xb3/0x157
common_interrupt+0xf/0xf
</IRQ>
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Fixes: 768aec0b5bcc ("serial: 8250: fix shared interrupts issues with SMP and RT kernels")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Raul Rangel <rrangel@google.com>
BugLink: https://bugs.chromium.org/p/chromium/issues/detail?id=1114800
Link: https://lore.kernel.org/lkml/CAHQZ30BnfX+gxjPm1DUd5psOTqbyDh4EJE=2=VAMW_VDafctkA@mail.gmail.com/T/#u
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200817022646.1484638-1-sergey.senozhatsky@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_port.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2259,6 +2259,10 @@ int serial8250_do_startup(struct uart_po
if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) {
unsigned char iir1;
+
+ if (port->irqflags & IRQF_SHARED)
+ disable_irq_nosync(port->irq);
+
/*
* Test for UARTs that do not reassert THRE when the
* transmitter is idle and the interrupt has already
@@ -2268,8 +2272,6 @@ int serial8250_do_startup(struct uart_po
* allow register changes to become visible.
*/
spin_lock_irqsave(&port->lock, flags);
- if (up->port.irqflags & IRQF_SHARED)
- disable_irq_nosync(port->irq);
wait_for_xmitr(up, UART_LSR_THRE);
serial_port_out_sync(port, UART_IER, UART_IER_THRI);
@@ -2281,9 +2283,10 @@ int serial8250_do_startup(struct uart_po
iir = serial_port_in(port, UART_IIR);
serial_port_out(port, UART_IER, 0);
+ spin_unlock_irqrestore(&port->lock, flags);
+
if (port->irqflags & IRQF_SHARED)
enable_irq(port->irq);
- spin_unlock_irqrestore(&port->lock, flags);
/*
* If the interrupt is not reasserted, or we otherwise
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 094/125] writeback: Protect inode->i_io_list with inode->i_lock
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 093/125] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 095/125] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
` (34 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martijn Coenen, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit b35250c0816c7cf7d0a8de92f5fafb6a7508a708 upstream.
Currently, operations on inode->i_io_list are protected by
wb->list_lock. In the following patches we'll need to maintain
consistency between inode->i_state and inode->i_io_list so change the
code so that inode->i_lock protects also all inode's i_io_list handling.
Reviewed-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
CC: stable@vger.kernel.org # Prerequisite for "writeback: Avoid skipping inode writeback"
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -160,6 +160,7 @@ static void inode_io_list_del_locked(str
struct bdi_writeback *wb)
{
assert_spin_locked(&wb->list_lock);
+ assert_spin_locked(&inode->i_lock);
list_del_init(&inode->i_io_list);
wb_io_lists_depopulated(wb);
@@ -1042,7 +1043,9 @@ void inode_io_list_del(struct inode *ino
struct bdi_writeback *wb;
wb = inode_to_wb_and_lock_list(inode);
+ spin_lock(&inode->i_lock);
inode_io_list_del_locked(inode, wb);
+ spin_unlock(&inode->i_lock);
spin_unlock(&wb->list_lock);
}
@@ -1091,8 +1094,10 @@ void sb_clear_inode_writeback(struct ino
* the case then the inode must have been redirtied while it was being written
* out and we don't reset its dirtied_when.
*/
-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
{
+ assert_spin_locked(&inode->i_lock);
+
if (!list_empty(&wb->b_dirty)) {
struct inode *tail;
@@ -1103,6 +1108,13 @@ static void redirty_tail(struct inode *i
inode_io_list_move_locked(inode, wb, &wb->b_dirty);
}
+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+{
+ spin_lock(&inode->i_lock);
+ redirty_tail_locked(inode, wb);
+ spin_unlock(&inode->i_lock);
+}
+
/*
* requeue inode for re-scanning after bdi->b_io list is exhausted.
*/
@@ -1313,7 +1325,7 @@ static void requeue_inode(struct inode *
* writeback is not making progress due to locked
* buffers. Skip this inode for now.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
return;
}
@@ -1333,7 +1345,7 @@ static void requeue_inode(struct inode *
* retrying writeback of the dirty page/inode
* that cannot be performed immediately.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
}
} else if (inode->i_state & I_DIRTY) {
/*
@@ -1341,7 +1353,7 @@ static void requeue_inode(struct inode *
* such as delayed allocation during submission or metadata
* updates after data IO completion.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
} else if (inode->i_state & I_DIRTY_TIME) {
inode->dirtied_when = jiffies;
inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
@@ -1588,8 +1600,8 @@ static long writeback_sb_inodes(struct s
*/
spin_lock(&inode->i_lock);
if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
+ redirty_tail_locked(inode, wb);
spin_unlock(&inode->i_lock);
- redirty_tail(inode, wb);
continue;
}
if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) {
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 095/125] writeback: Avoid skipping inode writeback
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 094/125] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 096/125] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
` (33 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martijn Coenen, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 5afced3bf28100d81fb2fe7e98918632a08feaf5 upstream.
Inode's i_io_list list head is used to attach inode to several different
lists - wb->{b_dirty, b_dirty_time, b_io, b_more_io}. When flush worker
prepares a list of inodes to writeback e.g. for sync(2), it moves inodes
to b_io list. Thus it is critical for sync(2) data integrity guarantees
that inode is not requeued to any other writeback list when inode is
queued for processing by flush worker. That's the reason why
writeback_single_inode() does not touch i_io_list (unless the inode is
completely clean) and why __mark_inode_dirty() does not touch i_io_list
if I_SYNC flag is set.
However there are two flaws in the current logic:
1) When inode has only I_DIRTY_TIME set but it is already queued in b_io
list due to sync(2), concurrent __mark_inode_dirty(inode, I_DIRTY_SYNC)
can still move inode back to b_dirty list resulting in skipping
writeback of inode time stamps during sync(2).
2) When inode is on b_dirty_time list and writeback_single_inode() races
with __mark_inode_dirty() like:
writeback_single_inode() __mark_inode_dirty(inode, I_DIRTY_PAGES)
inode->i_state |= I_SYNC
__writeback_single_inode()
inode->i_state |= I_DIRTY_PAGES;
if (inode->i_state & I_SYNC)
bail
if (!(inode->i_state & I_DIRTY_ALL))
- not true so nothing done
We end up with I_DIRTY_PAGES inode on b_dirty_time list and thus
standard background writeback will not writeback this inode leading to
possible dirty throttling stalls etc. (thanks to Martijn Coenen for this
analysis).
Fix these problems by tracking whether inode is queued in b_io or
b_more_io lists in a new I_SYNC_QUEUED flag. When this flag is set, we
know flush worker has queued inode and we should not touch i_io_list.
On the other hand we also know that once flush worker is done with the
inode it will requeue the inode to appropriate dirty list. When
I_SYNC_QUEUED is not set, __mark_inode_dirty() can (and must) move inode
to appropriate dirty list.
Reported-by: Martijn Coenen <maco@android.com>
Reviewed-by: Martijn Coenen <maco@android.com>
Tested-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 17 ++++++++++++-----
include/linux/fs.h | 8 ++++++--
2 files changed, 18 insertions(+), 7 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -162,6 +162,7 @@ static void inode_io_list_del_locked(str
assert_spin_locked(&wb->list_lock);
assert_spin_locked(&inode->i_lock);
+ inode->i_state &= ~I_SYNC_QUEUED;
list_del_init(&inode->i_io_list);
wb_io_lists_depopulated(wb);
}
@@ -1106,6 +1107,7 @@ static void redirty_tail_locked(struct i
inode->dirtied_when = jiffies;
}
inode_io_list_move_locked(inode, wb, &wb->b_dirty);
+ inode->i_state &= ~I_SYNC_QUEUED;
}
static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
@@ -1181,8 +1183,11 @@ static int move_expired_inodes(struct li
break;
list_move(&inode->i_io_list, &tmp);
moved++;
+ spin_lock(&inode->i_lock);
if (flags & EXPIRE_DIRTY_ATIME)
- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state);
+ inode->i_state |= I_DIRTY_TIME_EXPIRED;
+ inode->i_state |= I_SYNC_QUEUED;
+ spin_unlock(&inode->i_lock);
if (sb_is_blkdev_sb(inode->i_sb))
continue;
if (sb && sb != inode->i_sb)
@@ -1357,6 +1362,7 @@ static void requeue_inode(struct inode *
} else if (inode->i_state & I_DIRTY_TIME) {
inode->dirtied_when = jiffies;
inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
+ inode->i_state &= ~I_SYNC_QUEUED;
} else {
/* The inode is clean. Remove from writeback lists. */
inode_io_list_del_locked(inode, wb);
@@ -2220,11 +2226,12 @@ void __mark_inode_dirty(struct inode *in
inode->i_state |= flags;
/*
- * If the inode is being synced, just update its dirty state.
- * The unlocker will place the inode on the appropriate
- * superblock list, based upon its state.
+ * If the inode is queued for writeback by flush worker, just
+ * update its dirty state. Once the flush worker is done with
+ * the inode it will place it on the appropriate superblock
+ * list, based upon its state.
*/
- if (inode->i_state & I_SYNC)
+ if (inode->i_state & I_SYNC_QUEUED)
goto out_unlock_inode;
/*
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2050,6 +2050,10 @@ static inline void init_sync_kiocb(struc
*
* I_CREATING New object's inode in the middle of setting up.
*
+ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists.
+ * Used to detect that mark_inode_dirty() should not move
+ * inode between dirty lists.
+ *
* Q: What is the difference between I_WILL_FREE and I_FREEING?
*/
#define I_DIRTY_SYNC (1 << 0)
@@ -2067,11 +2071,11 @@ static inline void init_sync_kiocb(struc
#define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP)
#define I_LINKABLE (1 << 10)
#define I_DIRTY_TIME (1 << 11)
-#define __I_DIRTY_TIME_EXPIRED 12
-#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED)
+#define I_DIRTY_TIME_EXPIRED (1 << 12)
#define I_WB_SWITCH (1 << 13)
#define I_OVL_INUSE (1 << 14)
#define I_CREATING (1 << 15)
+#define I_SYNC_QUEUED (1 << 17)
#define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
#define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES)
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 096/125] writeback: Fix sync livelock due to b_dirty_time processing
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 095/125] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 097/125] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
` (32 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit f9cae926f35e8230330f28c7b743ad088611a8de upstream.
When we are processing writeback for sync(2), move_expired_inodes()
didn't set any inode expiry value (older_than_this). This can result in
writeback never completing if there's steady stream of inodes added to
b_dirty_time list as writeback rechecks dirty lists after each writeback
round whether there's more work to be done. Fix the problem by using
sync(2) start time is inode expiry value when processing b_dirty_time
list similarly as for ordinarily dirtied inodes. This requires some
refactoring of older_than_this handling which simplifies the code
noticeably as a bonus.
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 44 +++++++++++++++------------------------
include/trace/events/writeback.h | 13 +++++------
2 files changed, 23 insertions(+), 34 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -45,7 +45,6 @@ struct wb_completion {
struct wb_writeback_work {
long nr_pages;
struct super_block *sb;
- unsigned long *older_than_this;
enum writeback_sync_modes sync_mode;
unsigned int tagged_writepages:1;
unsigned int for_kupdate:1;
@@ -1153,16 +1152,13 @@ static bool inode_dirtied_after(struct i
#define EXPIRE_DIRTY_ATIME 0x0001
/*
- * Move expired (dirtied before work->older_than_this) dirty inodes from
+ * Move expired (dirtied before dirtied_before) dirty inodes from
* @delaying_queue to @dispatch_queue.
*/
static int move_expired_inodes(struct list_head *delaying_queue,
struct list_head *dispatch_queue,
- int flags,
- struct wb_writeback_work *work)
+ int flags, unsigned long dirtied_before)
{
- unsigned long *older_than_this = NULL;
- unsigned long expire_time;
LIST_HEAD(tmp);
struct list_head *pos, *node;
struct super_block *sb = NULL;
@@ -1170,16 +1166,9 @@ static int move_expired_inodes(struct li
int do_sb_sort = 0;
int moved = 0;
- if ((flags & EXPIRE_DIRTY_ATIME) == 0)
- older_than_this = work->older_than_this;
- else if (!work->for_sync) {
- expire_time = jiffies - (dirtytime_expire_interval * HZ);
- older_than_this = &expire_time;
- }
while (!list_empty(delaying_queue)) {
inode = wb_inode(delaying_queue->prev);
- if (older_than_this &&
- inode_dirtied_after(inode, *older_than_this))
+ if (inode_dirtied_after(inode, dirtied_before))
break;
list_move(&inode->i_io_list, &tmp);
moved++;
@@ -1225,18 +1214,22 @@ out:
* |
* +--> dequeue for IO
*/
-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
+ unsigned long dirtied_before)
{
int moved;
+ unsigned long time_expire_jif = dirtied_before;
assert_spin_locked(&wb->list_lock);
list_splice_init(&wb->b_more_io, &wb->b_io);
- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work);
+ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
+ if (!work->for_sync)
+ time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
- EXPIRE_DIRTY_ATIME, work);
+ EXPIRE_DIRTY_ATIME, time_expire_jif);
if (moved)
wb_io_lists_populated(wb);
- trace_writeback_queue_io(wb, work, moved);
+ trace_writeback_queue_io(wb, work, dirtied_before, moved);
}
static int write_inode(struct inode *inode, struct writeback_control *wbc)
@@ -1748,7 +1741,7 @@ static long writeback_inodes_wb(struct b
blk_start_plug(&plug);
spin_lock(&wb->list_lock);
if (list_empty(&wb->b_io))
- queue_io(wb, &work);
+ queue_io(wb, &work, jiffies);
__writeback_inodes_wb(wb, &work);
spin_unlock(&wb->list_lock);
blk_finish_plug(&plug);
@@ -1768,7 +1761,7 @@ static long writeback_inodes_wb(struct b
* takes longer than a dirty_writeback_interval interval, then leave a
* one-second gap.
*
- * older_than_this takes precedence over nr_to_write. So we'll only write back
+ * dirtied_before takes precedence over nr_to_write. So we'll only write back
* all dirty pages if they are all attached to "old" mappings.
*/
static long wb_writeback(struct bdi_writeback *wb,
@@ -1776,14 +1769,11 @@ static long wb_writeback(struct bdi_writ
{
unsigned long wb_start = jiffies;
long nr_pages = work->nr_pages;
- unsigned long oldest_jif;
+ unsigned long dirtied_before = jiffies;
struct inode *inode;
long progress;
struct blk_plug plug;
- oldest_jif = jiffies;
- work->older_than_this = &oldest_jif;
-
blk_start_plug(&plug);
spin_lock(&wb->list_lock);
for (;;) {
@@ -1817,14 +1807,14 @@ static long wb_writeback(struct bdi_writ
* safe.
*/
if (work->for_kupdate) {
- oldest_jif = jiffies -
+ dirtied_before = jiffies -
msecs_to_jiffies(dirty_expire_interval * 10);
} else if (work->for_background)
- oldest_jif = jiffies;
+ dirtied_before = jiffies;
trace_writeback_start(wb, work);
if (list_empty(&wb->b_io))
- queue_io(wb, work);
+ queue_io(wb, work, dirtied_before);
if (work->sb)
progress = writeback_sb_inodes(work->sb, wb, work);
else
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -360,8 +360,9 @@ DEFINE_WBC_EVENT(wbc_writepage);
TRACE_EVENT(writeback_queue_io,
TP_PROTO(struct bdi_writeback *wb,
struct wb_writeback_work *work,
+ unsigned long dirtied_before,
int moved),
- TP_ARGS(wb, work, moved),
+ TP_ARGS(wb, work, dirtied_before, moved),
TP_STRUCT__entry(
__array(char, name, 32)
__field(unsigned long, older)
@@ -371,19 +372,17 @@ TRACE_EVENT(writeback_queue_io,
__field(unsigned int, cgroup_ino)
),
TP_fast_assign(
- unsigned long *older_than_this = work->older_than_this;
strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
- __entry->older = older_than_this ? *older_than_this : 0;
- __entry->age = older_than_this ?
- (jiffies - *older_than_this) * 1000 / HZ : -1;
+ __entry->older = dirtied_before;
+ __entry->age = (jiffies - dirtied_before) * 1000 / HZ;
__entry->moved = moved;
__entry->reason = work->reason;
__entry->cgroup_ino = __trace_wb_assign_cgroup(wb);
),
TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u",
__entry->name,
- __entry->older, /* older_than_this in jiffies */
- __entry->age, /* older_than_this in relative milliseconds */
+ __entry->older, /* dirtied_before in jiffies */
+ __entry->age, /* dirtied_before in relative milliseconds */
__entry->moved,
__print_symbolic(__entry->reason, WB_WORK_REASON),
__entry->cgroup_ino
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 097/125] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 096/125] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 098/125] usb: host: xhci: fix ep context print mismatch in debugfs Greg Kroah-Hartman
` (31 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roman Shaposhnik, Thomas Gleixner,
Juergen Gross
From: Thomas Gleixner <tglx@linutronix.de>
commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
handler data is meant for interrupt handlers and not for storing irq chip
specific information as some devices require handler data to store internal
per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
This obviously creates a conflict of interests and crashes the machine
because the XEN pointer is overwritten by the driver pointer.
As the XEN data is not handler specific it should be stored in
irqdesc::irq_data::chip_data instead.
A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that.
Cc: stable@vger.kernel.org
Reported-by: Roman Shaposhnik <roman@zededa.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Roman Shaposhnik <roman@zededa.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/events/events_base.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -154,7 +154,7 @@ int get_evtchn_to_irq(unsigned evtchn)
/* Get info for IRQ */
struct irq_info *info_for_irq(unsigned irq)
{
- return irq_get_handler_data(irq);
+ return irq_get_chip_data(irq);
}
/* Constructors for packed IRQ information. */
@@ -375,7 +375,7 @@ static void xen_irq_init(unsigned irq)
info->type = IRQT_UNBOUND;
info->refcnt = -1;
- irq_set_handler_data(irq, info);
+ irq_set_chip_data(irq, info);
list_add_tail(&info->list, &xen_irq_list_head);
}
@@ -424,14 +424,14 @@ static int __must_check xen_allocate_irq
static void xen_free_irq(unsigned irq)
{
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (WARN_ON(!info))
return;
list_del(&info->list);
- irq_set_handler_data(irq, NULL);
+ irq_set_chip_data(irq, NULL);
WARN_ON(info->refcnt > 0);
@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
static void __unbind_from_irq(unsigned int irq)
{
int evtchn = evtchn_from_irq(irq);
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (info->refcnt > 0) {
info->refcnt--;
@@ -1105,7 +1105,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
void unbind_from_irqhandler(unsigned int irq, void *dev_id)
{
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (WARN_ON(!info))
return;
@@ -1139,7 +1139,7 @@ int evtchn_make_refcounted(unsigned int
if (irq == -1)
return -ENOENT;
- info = irq_get_handler_data(irq);
+ info = irq_get_chip_data(irq);
if (!info)
return -ENOENT;
@@ -1167,7 +1167,7 @@ int evtchn_get(unsigned int evtchn)
if (irq == -1)
goto done;
- info = irq_get_handler_data(irq);
+ info = irq_get_chip_data(irq);
if (!info)
goto done;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 098/125] usb: host: xhci: fix ep context print mismatch in debugfs
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 097/125] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 099/125] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
` (30 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Jun, Mathias Nyman
From: Li Jun <jun.li@nxp.com>
commit 0077b1b2c8d9ad5f7a08b62fb8524cdb9938388f upstream.
dci is 0 based and xhci_get_ep_ctx() will do ep index increment to get
the ep context.
[rename dci to ep_index -Mathias]
Cc: stable <stable@vger.kernel.org> # v4.15+
Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver")
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200821091549.20556-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-debugfs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -273,7 +273,7 @@ static int xhci_slot_context_show(struct
static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
{
- int dci;
+ int ep_index;
dma_addr_t dma;
struct xhci_hcd *xhci;
struct xhci_ep_ctx *ep_ctx;
@@ -282,9 +282,9 @@ static int xhci_endpoint_context_show(st
xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
- for (dci = 1; dci < 32; dci++) {
- ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci);
- dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params);
+ for (ep_index = 0; ep_index < 31; ep_index++) {
+ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params);
seq_printf(s, "%pad: %s\n", &dma,
xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
le32_to_cpu(ep_ctx->ep_info2),
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 099/125] xhci: Do warm-reset when both CAS and XDEV_RESUME are set
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 098/125] usb: host: xhci: fix ep context print mismatch in debugfs Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 100/125] xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed Greg Kroah-Hartman
` (29 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Mathias Nyman
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 904df64a5f4d5ebd670801d869ca0a6d6a6e8df6 upstream.
Sometimes re-plugging a USB device during system sleep renders the device
useless:
[ 173.418345] xhci_hcd 0000:00:14.0: Get port status 2-4 read: 0x14203e2, return 0x10262
...
[ 176.496485] usb 2-4: Waited 2000ms for CONNECT
[ 176.496781] usb usb2-port4: status 0000.0262 after resume, -19
[ 176.497103] usb 2-4: can't resume, status -19
[ 176.497438] usb usb2-port4: logical disconnect
Because PLS equals to XDEV_RESUME, xHCI driver reports U3 to usbcore,
despite of CAS bit is flagged.
So proritize CAS over XDEV_RESUME to let usbcore handle warm-reset for
the port.
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200821091549.20556-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -736,15 +736,6 @@ static void xhci_hub_report_usb3_link_st
{
u32 pls = status_reg & PORT_PLS_MASK;
- /* resume state is a xHCI internal state.
- * Do not report it to usb core, instead, pretend to be U3,
- * thus usb core knows it's not ready for transfer
- */
- if (pls == XDEV_RESUME) {
- *status |= USB_SS_PORT_LS_U3;
- return;
- }
-
/* When the CAS bit is set then warm reset
* should be performed on port
*/
@@ -767,6 +758,16 @@ static void xhci_hub_report_usb3_link_st
pls |= USB_PORT_STAT_CONNECTION;
} else {
/*
+ * Resume state is an xHCI internal state. Do not report it to
+ * usb core, instead, pretend to be U3, thus usb core knows
+ * it's not ready for transfer.
+ */
+ if (pls == XDEV_RESUME) {
+ *status |= USB_SS_PORT_LS_U3;
+ return;
+ }
+
+ /*
* If CAS bit isn't set but the Port is already at
* Compliance Mode, fake a connection so the USB core
* notices the Compliance state and resets the port.
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 100/125] xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 099/125] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 101/125] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
` (28 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ding Hui, Mathias Nyman
From: Ding Hui <dinghui@sangfor.com.cn>
commit f1ec7ae6c9f8c016db320e204cb519a1da1581b8 upstream.
Some device drivers call libusb_clear_halt when target ep queue
is not empty. (eg. spice client connected to qemu for usb redir)
Before commit f5249461b504 ("xhci: Clear the host side toggle
manually when endpoint is soft reset"), that works well.
But now, we got the error log:
EP not empty, refuse reset
xhci_endpoint_reset failed and left ep_state's EP_SOFT_CLEAR_TOGGLE
bit still set
So all the subsequent urb sumbits to the ep will fail with the
warn log:
Can't enqueue URB while manually clearing toggle
We need to clear ep_state EP_SOFT_CLEAR_TOGGLE bit after
xhci_endpoint_reset, even if it failed.
Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset")
Cc: stable <stable@vger.kernel.org> # v4.17+
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200821091549.20556-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3154,10 +3154,11 @@ static void xhci_endpoint_reset(struct u
wait_for_completion(cfg_cmd->completion);
- ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
xhci_free_command(xhci, cfg_cmd);
cleanup:
xhci_free_command(xhci, stop_cmd);
+ if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
+ ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
}
static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 101/125] PM: sleep: core: Fix the handling of pending runtime resume requests
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 100/125] xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 102/125] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
` (27 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Alan Stern,
Utkarsh H Patel, Pengfei Xu
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit e3eb6e8fba65094328b8dca635d00de74ba75b45 upstream.
It has been reported that system-wide suspend may be aborted in the
absence of any wakeup events due to unforseen interactions of it with
the runtume PM framework.
One failing scenario is when there are multiple devices sharing an
ACPI power resource and runtime-resume needs to be carried out for
one of them during system-wide suspend (for example, because it needs
to be reconfigured before the whole system goes to sleep). In that
case, the runtime-resume of that device involves turning the ACPI
power resource "on" which in turn causes runtime-resume requests
to be queued up for all of the other devices sharing it. Those
requests go to the runtime PM workqueue which is frozen during
system-wide suspend, so they are not actually taken care of until
the resume of the whole system, but the pm_runtime_barrier()
call in __device_suspend() sees them and triggers system wakeup
events for them which then cause the system-wide suspend to be
aborted if wakeup source objects are in active use.
Of course, the logic that leads to triggering those wakeup events is
questionable in the first place, because clearly there are cases in
which a pending runtime resume request for a device is not connected
to any real wakeup events in any way (like the one above). Moreover,
it is racy, because the device may be resuming already by the time
the pm_runtime_barrier() runs and so if the driver doesn't take care
of signaling the wakeup event as appropriate, it will be lost.
However, if the driver does take care of that, the extra
pm_wakeup_event() call in the core is redundant.
Accordingly, drop the conditional pm_wakeup_event() call fron
__device_suspend() and make the latter call pm_runtime_barrier()
alone. Also modify the comment next to that call to reflect the new
code and extend it to mention the need to avoid unwanted interactions
between runtime PM and system-wide device suspend callbacks.
Fixes: 1e2ef05bb8cf8 ("PM: Limit race conditions between runtime PM and system sleep (v2)")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/main.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1751,13 +1751,17 @@ static int __device_suspend(struct devic
}
/*
- * If a device configured to wake up the system from sleep states
- * has been suspended at run time and there's a resume request pending
- * for it, this is equivalent to the device signaling wakeup, so the
- * system suspend operation should be aborted.
+ * Wait for possible runtime PM transitions of the device in progress
+ * to complete and if there's a runtime resume request pending for it,
+ * resume it before proceeding with invoking the system-wide suspend
+ * callbacks for it.
+ *
+ * If the system-wide suspend callbacks below change the configuration
+ * of the device, they must disable runtime PM for it or otherwise
+ * ensure that its runtime-resume callbacks will not be confused by that
+ * change in case they are invoked going forward.
*/
- if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
- pm_wakeup_event(dev, 0);
+ pm_runtime_barrier(dev);
if (pm_wakeup_pending()) {
dev->power.direct_complete = false;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 102/125] device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 101/125] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 103/125] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP Greg Kroah-Hartman
` (26 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heikki Krogerus, Rafael J. Wysocki
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
commit c15e1bdda4365a5f17cdadf22bf1c1df13884a9e upstream.
When the primary firmware node pointer is removed from a
device (set to NULL) the secondary firmware node pointer,
when it exists, is made the primary node for the device.
However, the secondary firmware node pointer of the original
primary firmware node is never cleared (set to NULL).
To avoid situation where the secondary firmware node pointer
is pointing to a non-existing object, clearing it properly
when the primary node is removed from a device in
set_primary_fwnode().
Fixes: 97badf873ab6 ("device property: Make it possible to use secondary firmware nodes")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/core.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -3333,9 +3333,9 @@ static inline bool fwnode_is_primary(str
*/
void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
{
- if (fwnode) {
- struct fwnode_handle *fn = dev->fwnode;
+ struct fwnode_handle *fn = dev->fwnode;
+ if (fwnode) {
if (fwnode_is_primary(fn))
fn = fn->secondary;
@@ -3345,8 +3345,12 @@ void set_primary_fwnode(struct device *d
}
dev->fwnode = fwnode;
} else {
- dev->fwnode = fwnode_is_primary(dev->fwnode) ?
- dev->fwnode->secondary : NULL;
+ if (fwnode_is_primary(fn)) {
+ dev->fwnode = fn->secondary;
+ fn->secondary = NULL;
+ } else {
+ dev->fwnode = NULL;
+ }
}
}
EXPORT_SYMBOL_GPL(set_primary_fwnode);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 103/125] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 102/125] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.19 104/125] irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake Greg Kroah-Hartman
` (25 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Thomas Gleixner
From: Thomas Gleixner <tglx@linutronix.de>
commit 784a0830377d0761834e385975bc46861fea9fa0 upstream.
Most of the CPU mask operations behave the same way, but for_each_cpu() and
it's variants ignore the cpumask argument and claim that CPU0 is always in
the mask. This is historical, inconsistent and annoying behaviour.
The matrix allocator uses for_each_cpu() and can be called on UP with an
empty cpumask. The calling code does not expect that this succeeds but
until commit e027fffff799 ("x86/irq: Unbreak interrupt affinity setting")
this went unnoticed. That commit added a WARN_ON() to catch cases which
move an interrupt from one vector to another on the same CPU. The warning
triggers on UP.
Add a check for the cpumask being empty to prevent this.
Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator")
Reported-by: kernel test robot <rong.a.chen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/matrix.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix *
unsigned int cpu, bit;
struct cpumap *cm;
+ /*
+ * Not required in theory, but matrix_find_best_cpu() uses
+ * for_each_cpu() which ignores the cpumask on UP .
+ */
+ if (cpumask_empty(msk))
+ return -EINVAL;
+
cpu = matrix_find_best_cpu(m, msk);
if (cpu == UINT_MAX)
return -ENOSPC;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 104/125] irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 103/125] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 105/125] drm/amdgpu: Fix buffer overflow in INFO ioctl Greg Kroah-Hartman
` (24 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, qiuguorui1, Marc Zyngier
From: qiuguorui1 <qiuguorui1@huawei.com>
commit e579076ac0a3bebb440fab101aef3c42c9f4c709 upstream.
In the current code, when the eoi callback of the exti clears the pending
bit of the current interrupt, it will first read the values of fpr and
rpr, then logically OR the corresponding bit of the interrupt number,
and finally write back to fpr and rpr.
We found through experiments that if two exti interrupts,
we call them int1/int2, arrive almost at the same time. in our scenario,
the time difference is 30 microseconds, assuming int1 is triggered first.
there will be an extreme scenario: both int's pending bit are set to 1,
the irq handle of int1 is executed first, and eoi handle is then executed,
at this moment, all pending bits are cleared, but the int 2 has not
finally been reported to the cpu yet, which eventually lost int2.
According to stm32's TRM description about rpr and fpr: Writing a 1 to this
bit will trigger a rising edge event on event x, Writing 0 has no
effect.
Therefore, when clearing the pending bit, we only need to clear the
pending bit of the irq.
Fixes: 927abfc4461e7 ("irqchip/stm32: Add stm32mp1 support with hierarchy domain")
Signed-off-by: qiuguorui1 <qiuguorui1@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org # v4.18+
Link: https://lore.kernel.org/r/20200820031629.15582-1-qiuguorui1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-stm32-exti.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -382,6 +382,16 @@ static void stm32_irq_ack(struct irq_dat
irq_gc_unlock(gc);
}
+/* directly set the target bit without reading first. */
+static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg)
+{
+ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
+ void __iomem *base = chip_data->host_data->base;
+ u32 val = BIT(d->hwirq % IRQS_PER_BANK);
+
+ writel_relaxed(val, base + reg);
+}
+
static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg)
{
struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
@@ -415,9 +425,9 @@ static void stm32_exti_h_eoi(struct irq_
raw_spin_lock(&chip_data->rlock);
- stm32_exti_set_bit(d, stm32_bank->rpr_ofst);
+ stm32_exti_write_bit(d, stm32_bank->rpr_ofst);
if (stm32_bank->fpr_ofst != UNDEF_REG)
- stm32_exti_set_bit(d, stm32_bank->fpr_ofst);
+ stm32_exti_write_bit(d, stm32_bank->fpr_ofst);
raw_spin_unlock(&chip_data->rlock);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 105/125] drm/amdgpu: Fix buffer overflow in INFO ioctl
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.19 104/125] irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 106/125] drm/amd/pm: correct Vega10 swctf limit setting Greg Kroah-Hartman
` (23 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alex Deucher
From: Alex Deucher <alexander.deucher@amd.com>
commit b5b97cab55eb71daba3283c8b1d2cce456d511a1 upstream.
The values for "se_num" and "sh_num" come from the user in the ioctl.
They can be in the 0-255 range but if they're more than
AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in
an out of bounds read.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -524,8 +524,12 @@ static int amdgpu_info_ioctl(struct drm_
* in the bitfields */
if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
se_num = 0xffffffff;
+ else if (se_num >= AMDGPU_GFX_MAX_SE)
+ return -EINVAL;
if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
sh_num = 0xffffffff;
+ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
+ return -EINVAL;
if (info->read_mmr_reg.count > 128)
return -EINVAL;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 106/125] drm/amd/pm: correct Vega10 swctf limit setting
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 105/125] drm/amdgpu: Fix buffer overflow in INFO ioctl Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 107/125] drm/amd/pm: correct Vega12 " Greg Kroah-Hartman
` (22 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Evan Quan, Alex Deucher
From: Evan Quan <evan.quan@amd.com>
commit b05d71b51078fc428c6b72582126d9d75d3c1f4c upstream.
Correct the Vega10 thermal swctf limit.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1267
Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
@@ -362,6 +362,9 @@ int vega10_thermal_get_temperature(struc
static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
struct PP_TemperatureRange *range)
{
+ struct phm_ppt_v2_information *pp_table_info =
+ (struct phm_ppt_v2_information *)(hwmgr->pptable);
+ struct phm_tdp_table *tdp_table = pp_table_info->tdp_table;
struct amdgpu_device *adev = hwmgr->adev;
int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP *
PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
@@ -371,8 +374,8 @@ static int vega10_thermal_set_temperatur
if (low < range->min)
low = range->min;
- if (high > range->max)
- high = range->max;
+ if (high > tdp_table->usSoftwareShutdownTemp)
+ high = tdp_table->usSoftwareShutdownTemp;
if (low > high)
return -EINVAL;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 107/125] drm/amd/pm: correct Vega12 swctf limit setting
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 106/125] drm/amd/pm: correct Vega10 swctf limit setting Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
` (21 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Evan Quan, Alex Deucher
From: Evan Quan <evan.quan@amd.com>
commit e0ffd340249699ad27a6c91abdfa3e89f7823941 upstream.
Correct the Vega12 thermal swctf limit.
Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
@@ -170,6 +170,8 @@ int vega12_thermal_get_temperature(struc
static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
struct PP_TemperatureRange *range)
{
+ struct phm_ppt_v3_information *pptable_information =
+ (struct phm_ppt_v3_information *)hwmgr->pptable;
struct amdgpu_device *adev = hwmgr->adev;
int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP *
PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
@@ -179,8 +181,8 @@ static int vega12_thermal_set_temperatur
if (low < range->min)
low = range->min;
- if (high > range->max)
- high = range->max;
+ if (high > pptable_information->us_software_shutdown_temp)
+ high = pptable_information->us_software_shutdown_temp;
if (low > high)
return -EINVAL;
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 107/125] drm/amd/pm: correct Vega12 " Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-02 12:58 ` Pavel Machek
2020-09-01 15:11 ` [PATCH 4.19 109/125] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
` (20 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, syzbot+c2c3302f9c601a4b1be2
From: Alan Stern <stern@rowland.harvard.edu>
commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream.
The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xf6/0x16e lib/dump_stack.c:118
panic+0x2aa/0x6e1 kernel/panic.c:231
__warn.cold+0x20/0x50 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
slab_alloc_node mm/slub.c:2816 [inline]
slab_alloc mm/slub.c:2900 [inline]
kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
kmalloc include/linux/slab.h:554 [inline]
dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495
This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -492,7 +492,7 @@ static ssize_t yurex_write(struct file *
prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
dev->cntl_buffer[0]);
- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
+ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
if (retval >= 0)
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument
2020-09-01 15:11 ` [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
@ 2020-09-02 12:58 ` Pavel Machek
2020-09-02 14:33 ` Greg Kroah-Hartman
2020-09-02 15:12 ` Alan Stern
0 siblings, 2 replies; 147+ messages in thread
From: Pavel Machek @ 2020-09-02 12:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Alan Stern, syzbot+c2c3302f9c601a4b1be2
[-- Attachment #1: Type: text/plain, Size: 1455 bytes --]
Hi!
> The syzbot fuzzer identified a bug in the yurex driver: It passes
> GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
> when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
Yeah, and instead of fixing the bug, patch papers over it, reducing
reliability of the driver in the process.
> This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
Fixing it properly should be as simple as moving prepare_to_wait down,
no?
Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 785080f79073..5fbbb57e6e95 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -489,10 +489,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
}
/* send the data as the control msg */
- prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
dev->cntl_buffer[0]);
- retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
+ retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
+ prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
if (retval >= 0)
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply related [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument
2020-09-02 12:58 ` Pavel Machek
@ 2020-09-02 14:33 ` Greg Kroah-Hartman
2020-09-02 15:12 ` Alan Stern
1 sibling, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-02 14:33 UTC (permalink / raw)
To: Pavel Machek
Cc: linux-kernel, stable, Alan Stern, syzbot+c2c3302f9c601a4b1be2
On Wed, Sep 02, 2020 at 02:58:27PM +0200, Pavel Machek wrote:
> Hi!
>
> > The syzbot fuzzer identified a bug in the yurex driver: It passes
> > GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
> > when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
>
> Yeah, and instead of fixing the bug, patch papers over it, reducing
> reliability of the driver in the process.
>
> > This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
>
> Fixing it properly should be as simple as moving prepare_to_wait down,
> no?
>
> Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
>
> diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
> index 785080f79073..5fbbb57e6e95 100644
> --- a/drivers/usb/misc/yurex.c
> +++ b/drivers/usb/misc/yurex.c
> @@ -489,10 +489,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
> }
>
> /* send the data as the control msg */
> - prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
> dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
> dev->cntl_buffer[0]);
> - retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
> + retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
> + prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
> if (retval >= 0)
> timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
> finish_wait(&dev->waitq, &wait);
>
>
> Best regards,
> Pavel
>
I can't take patches like this, you know that...
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument
2020-09-02 12:58 ` Pavel Machek
2020-09-02 14:33 ` Greg Kroah-Hartman
@ 2020-09-02 15:12 ` Alan Stern
1 sibling, 0 replies; 147+ messages in thread
From: Alan Stern @ 2020-09-02 15:12 UTC (permalink / raw)
To: Pavel Machek
Cc: Greg Kroah-Hartman, linux-kernel, stable, syzbot+c2c3302f9c601a4b1be2
On Wed, Sep 02, 2020 at 02:58:27PM +0200, Pavel Machek wrote:
> Hi!
>
> > The syzbot fuzzer identified a bug in the yurex driver: It passes
> > GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
> > when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
>
> Yeah, and instead of fixing the bug, patch papers over it, reducing
> reliability of the driver in the process.
>
> > This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
>
> Fixing it properly should be as simple as moving prepare_to_wait down,
> no?
Sigh. That never occurred to me, but of course it is right.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Alan Stern
> Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
>
> diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
> index 785080f79073..5fbbb57e6e95 100644
> --- a/drivers/usb/misc/yurex.c
> +++ b/drivers/usb/misc/yurex.c
> @@ -489,10 +489,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
> }
>
> /* send the data as the control msg */
> - prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
> dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
> dev->cntl_buffer[0]);
> - retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
> + retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
> + prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
> if (retval >= 0)
> timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
> finish_wait(&dev->waitq, &wait);
>
>
> Best regards,
> Pavel
>
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 109/125] usb: uas: Add quirk for PNY Pro Elite
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 108/125] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 110/125] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
` (19 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thinh Nguyen
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 9a469bc9f32dd33c7aac5744669d21a023a719cd upstream.
PNY Pro Elite USB 3.1 Gen 2 device (SSD) doesn't respond to ATA_12
pass-through command (i.e. it just hangs). If it doesn't support this
command, it should respond properly to the host. Let's just add a quirk
to be able to move forward with other operations.
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Link: https://lore.kernel.org/r/2b0585228b003eedcc82db84697b31477df152e0.1597803605.git.thinhn@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_uas.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -80,6 +80,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x99
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_BROKEN_FUA),
+/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
+ "PNY",
+ "Pro Elite SSD",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
"VIA",
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 110/125] USB: quirks: Add no-lpm quirk for another Raydium touchscreen
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 109/125] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 111/125] USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D Greg Kroah-Hartman
` (18 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 5967116e8358899ebaa22702d09b0af57fef23e1 upstream.
There's another Raydium touchscreen needs the no-lpm quirk:
[ 1.339149] usb 1-9: New USB device found, idVendor=2386, idProduct=350e, bcdDevice= 0.00
[ 1.339150] usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1.339151] usb 1-9: Product: Raydium Touch System
[ 1.339152] usb 1-9: Manufacturer: Raydium Corporation
...
[ 6.450497] usb 1-9: can't set config #1, error -110
BugLink: https://bugs.launchpad.net/bugs/1889446
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200731051622.28643-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -465,6 +465,8 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
+
/* DJI CineSSD */
{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 111/125] USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 110/125] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 112/125] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
` (17 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, Jean-Christophe Barnoud
From: Alan Stern <stern@rowland.harvard.edu>
commit 068834a2773b6a12805105cfadbb3d4229fc6e0a upstream.
The Sound Devices MixPre-D audio card suffers from the same defect
as the Sound Devices USBPre2: an endpoint shared between a normal
audio interface and a vendor-specific interface, in violation of the
USB spec. Since the USB core now treats duplicated endpoints as bugs
and ignores them, the audio endpoint isn't available and the card
can't be used for audio capture.
Along the same lines as commit bdd1b147b802 ("USB: quirks: blacklist
duplicate ep on Sound Devices USBPre2"), this patch adds a quirks
entry saying to ignore ep5in for interface 1, leaving it available for
use with standard audio interface 2.
Reported-and-tested-by: Jean-Christophe Barnoud <jcbarnoud@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Fixes: 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints")
Link: https://lore.kernel.org/r/20200826194624.GA412633@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -370,6 +370,10 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x0926, 0x0202), .driver_info =
USB_QUIRK_ENDPOINT_BLACKLIST },
+ /* Sound Devices MixPre-D */
+ { USB_DEVICE(0x0926, 0x0208), .driver_info =
+ USB_QUIRK_ENDPOINT_BLACKLIST },
+
/* Keytouch QWERTY Panel keyboard */
{ USB_DEVICE(0x0926, 0x3333), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -511,6 +515,7 @@ static const struct usb_device_id usb_am
*/
static const struct usb_device_id usb_endpoint_blacklist[] = {
{ USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
{ }
};
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 112/125] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 111/125] USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 113/125] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
` (16 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brice Goglin, Alan Stern, Cyril Roelandt
From: Cyril Roelandt <tipecaml@gmail.com>
commit 9aa37788e7ebb3f489fb4b71ce07adadd444264a upstream.
This device does not support UAS properly and a similar entry already
exists in drivers/usb/storage/unusual_uas.h. Without this patch,
storage_probe() defers the handling of this device to UAS, which cannot
handle it either.
Tested-by: Brice Goglin <brice.goglin@gmail.com>
Fixes: bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
Link: https://lore.kernel.org/r/20200825212231.46309-1-tipecaml@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x
"JMicron",
"USB to ATA/ATAPI Bridge",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_BROKEN_FUA ),
+ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
/* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 113/125] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 112/125] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 114/125] USB: gadget: u_f: add overflow checks to VLA macros Greg Kroah-Hartman
` (15 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Shengju, Tang Bin, Krzysztof Kozlowski
From: Tang Bin <tangbin@cmss.chinamobile.com>
commit 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 upstream.
If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
exynos_ohci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.
Fixes: 62194244cf87 ("USB: Add Samsung Exynos OHCI diver")
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200826144931.1828-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ohci-exynos.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -156,9 +156,8 @@ static int exynos_ohci_probe(struct plat
hcd->rsrc_len = resource_size(res);
irq = platform_get_irq(pdev, 0);
- if (!irq) {
- dev_err(&pdev->dev, "Failed to get IRQ\n");
- err = -ENODEV;
+ if (irq < 0) {
+ err = irq;
goto fail_io;
}
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 114/125] USB: gadget: u_f: add overflow checks to VLA macros
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 113/125] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 115/125] USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() Greg Kroah-Hartman
` (14 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilja Van Sprundel, Kees Cook,
Brooke Basile, Felipe Balbi, stable
From: Brooke Basile <brookebasile@gmail.com>
commit b1cd1b65afba95971fa457dfdb2c941c60d38c5b upstream.
size can potentially hold an overflowed value if its assigned expression
is left unchecked, leading to a smaller than needed allocation when
vla_group_size() is used by callers to allocate memory.
To fix this, add a test for saturation before declaring variables and an
overflow check to (n) * sizeof(type).
If the expression results in overflow, vla_group_size() will return SIZE_MAX.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Brooke Basile <brookebasile@gmail.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/u_f.h | 38 +++++++++++++++++++++++++++-----------
1 file changed, 27 insertions(+), 11 deletions(-)
--- a/drivers/usb/gadget/u_f.h
+++ b/drivers/usb/gadget/u_f.h
@@ -14,6 +14,7 @@
#define __U_F_H__
#include <linux/usb/gadget.h>
+#include <linux/overflow.h>
/* Variable Length Array Macros **********************************************/
#define vla_group(groupname) size_t groupname##__next = 0
@@ -21,21 +22,36 @@
#define vla_item(groupname, type, name, n) \
size_t groupname##_##name##__offset = ({ \
- size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
- size_t size = (n) * sizeof(type); \
- groupname##__next = offset + size; \
+ size_t offset = 0; \
+ if (groupname##__next != SIZE_MAX) { \
+ size_t align_mask = __alignof__(type) - 1; \
+ size_t offset = (groupname##__next + align_mask) \
+ & ~align_mask; \
+ size_t size = array_size(n, sizeof(type)); \
+ if (check_add_overflow(offset, size, \
+ &groupname##__next)) { \
+ groupname##__next = SIZE_MAX; \
+ offset = 0; \
+ } \
+ } \
offset; \
})
#define vla_item_with_sz(groupname, type, name, n) \
- size_t groupname##_##name##__sz = (n) * sizeof(type); \
- size_t groupname##_##name##__offset = ({ \
- size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
- size_t size = groupname##_##name##__sz; \
- groupname##__next = offset + size; \
- offset; \
+ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \
+ size_t groupname##_##name##__offset = ({ \
+ size_t offset = 0; \
+ if (groupname##__next != SIZE_MAX) { \
+ size_t align_mask = __alignof__(type) - 1; \
+ size_t offset = (groupname##__next + align_mask) \
+ & ~align_mask; \
+ if (check_add_overflow(offset, groupname##_##name##__sz,\
+ &groupname##__next)) { \
+ groupname##__next = SIZE_MAX; \
+ offset = 0; \
+ } \
+ } \
+ offset; \
})
#define vla_ptr(ptr, groupname, name) \
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 115/125] USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 114/125] USB: gadget: u_f: add overflow checks to VLA macros Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 116/125] USB: gadget: u_f: Unbreak offset calculation in VLAs Greg Kroah-Hartman
` (13 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilja Van Sprundel, Brooke Basile,
Felipe Balbi, stable
From: Brooke Basile <brookebasile@gmail.com>
commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 upstream.
Some values extracted by ncm_unwrap_ntb() could possibly lead to several
different out of bounds reads of memory. Specifically the values passed
to netdev_alloc_skb_ip_align() need to be checked so that memory is not
overflowed.
Resolve this by applying bounds checking to a number of different
indexes and lengths of the structure parsing logic.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Brooke Basile <brookebasile@gmail.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_ncm.c | 81 ++++++++++++++++++++++++++++++------
1 file changed, 69 insertions(+), 12 deletions(-)
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1184,12 +1184,15 @@ static int ncm_unwrap_ntb(struct gether
int ndp_index;
unsigned dg_len, dg_len2;
unsigned ndp_len;
+ unsigned block_len;
struct sk_buff *skb2;
int ret = -EINVAL;
- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
+ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
+ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize);
const struct ndp_parser_opts *opts = ncm->parser_opts;
unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
int dgram_counter;
+ bool ndp_after_header;
/* dwSignature */
if (get_unaligned_le32(tmp) != opts->nth_sign) {
@@ -1208,25 +1211,37 @@ static int ncm_unwrap_ntb(struct gether
}
tmp++; /* skip wSequence */
+ block_len = get_ncm(&tmp, opts->block_length);
/* (d)wBlockLength */
- if (get_ncm(&tmp, opts->block_length) > max_size) {
+ if (block_len > ntb_max) {
INFO(port->func.config->cdev, "OUT size exceeded\n");
goto err;
}
ndp_index = get_ncm(&tmp, opts->ndp_index);
+ ndp_after_header = false;
/* Run through all the NDP's in the NTB */
do {
- /* NCM 3.2 */
- if (((ndp_index % 4) != 0) &&
- (ndp_index < opts->nth_size)) {
+ /*
+ * NCM 3.2
+ * dwNdpIndex
+ */
+ if (((ndp_index % 4) != 0) ||
+ (ndp_index < opts->nth_size) ||
+ (ndp_index > (block_len -
+ opts->ndp_size))) {
INFO(port->func.config->cdev, "Bad index: %#X\n",
ndp_index);
goto err;
}
+ if (ndp_index == opts->nth_size)
+ ndp_after_header = true;
- /* walk through NDP */
+ /*
+ * walk through NDP
+ * dwSignature
+ */
tmp = (void *)(skb->data + ndp_index);
if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
@@ -1237,14 +1252,15 @@ static int ncm_unwrap_ntb(struct gether
ndp_len = get_unaligned_le16(tmp++);
/*
* NCM 3.3.1
+ * wLength
* entry is 2 items
* item size is 16/32 bits, opts->dgram_item_len * 2 bytes
* minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
* Each entry is a dgram index and a dgram length.
*/
if ((ndp_len < opts->ndp_size
- + 2 * 2 * (opts->dgram_item_len * 2))
- || (ndp_len % opts->ndplen_align != 0)) {
+ + 2 * 2 * (opts->dgram_item_len * 2)) ||
+ (ndp_len % opts->ndplen_align != 0)) {
INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
ndp_len);
goto err;
@@ -1261,8 +1277,21 @@ static int ncm_unwrap_ntb(struct gether
do {
index = index2;
+ /* wDatagramIndex[0] */
+ if ((index < opts->nth_size) ||
+ (index > block_len - opts->dpe_size)) {
+ INFO(port->func.config->cdev,
+ "Bad index: %#X\n", index);
+ goto err;
+ }
+
dg_len = dg_len2;
- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */
+ /*
+ * wDatagramLength[0]
+ * ethernet hdr + crc or larger than max frame size
+ */
+ if ((dg_len < 14 + crc_len) ||
+ (dg_len > frame_max)) {
INFO(port->func.config->cdev,
"Bad dgram length: %#X\n", dg_len);
goto err;
@@ -1286,6 +1315,37 @@ static int ncm_unwrap_ntb(struct gether
index2 = get_ncm(&tmp, opts->dgram_item_len);
dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+ if (index2 == 0 || dg_len2 == 0)
+ break;
+
+ /* wDatagramIndex[1] */
+ if (ndp_after_header) {
+ if (index2 < opts->nth_size + opts->ndp_size) {
+ INFO(port->func.config->cdev,
+ "Bad index: %#X\n", index2);
+ goto err;
+ }
+ } else {
+ if (index2 < opts->nth_size + opts->dpe_size) {
+ INFO(port->func.config->cdev,
+ "Bad index: %#X\n", index2);
+ goto err;
+ }
+ }
+ if (index2 > block_len - opts->dpe_size) {
+ INFO(port->func.config->cdev,
+ "Bad index: %#X\n", index2);
+ goto err;
+ }
+
+ /* wDatagramLength[1] */
+ if ((dg_len2 < 14 + crc_len) ||
+ (dg_len2 > frame_max)) {
+ INFO(port->func.config->cdev,
+ "Bad dgram length: %#X\n", dg_len);
+ goto err;
+ }
+
/*
* Copy the data into a new skb.
* This ensures the truesize is correct
@@ -1302,9 +1362,6 @@ static int ncm_unwrap_ntb(struct gether
ndp_len -= 2 * (opts->dgram_item_len * 2);
dgram_counter++;
-
- if (index2 == 0 || dg_len2 == 0)
- break;
} while (ndp_len > 2 * (opts->dgram_item_len * 2));
} while (ndp_index);
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 116/125] USB: gadget: u_f: Unbreak offset calculation in VLAs
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 115/125] USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 117/125] USB: cdc-acm: rework notification_buffer resizing Greg Kroah-Hartman
` (12 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Andy Shevchenko,
Brooke Basile, stable
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit bfd08d06d978d0304eb6f7855b548aa2cd1c5486 upstream.
Inadvertently the commit b1cd1b65afba ("USB: gadget: u_f: add overflow checks
to VLA macros") makes VLA macros to always return 0 due to different scope of
two variables of the same name. Obviously we need to have only one.
Fixes: b1cd1b65afba ("USB: gadget: u_f: add overflow checks to VLA macros")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Brooke Basile <brookebasile@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20200826192119.56450-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/u_f.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/u_f.h
+++ b/drivers/usb/gadget/u_f.h
@@ -25,9 +25,9 @@
size_t offset = 0; \
if (groupname##__next != SIZE_MAX) { \
size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) \
- & ~align_mask; \
size_t size = array_size(n, sizeof(type)); \
+ offset = (groupname##__next + align_mask) & \
+ ~align_mask; \
if (check_add_overflow(offset, size, \
&groupname##__next)) { \
groupname##__next = SIZE_MAX; \
@@ -43,8 +43,8 @@
size_t offset = 0; \
if (groupname##__next != SIZE_MAX) { \
size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) \
- & ~align_mask; \
+ offset = (groupname##__next + align_mask) & \
+ ~align_mask; \
if (check_add_overflow(offset, groupname##_##name##__sz,\
&groupname##__next)) { \
groupname##__next = SIZE_MAX; \
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 117/125] USB: cdc-acm: rework notification_buffer resizing
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 116/125] USB: gadget: u_f: Unbreak offset calculation in VLAs Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 118/125] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
` (11 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Rix, Oliver Neukum
From: Tom Rix <trix@redhat.com>
commit f4b9d8a582f738c24ebeabce5cc15f4b8159d74e upstream.
Clang static analysis reports this error
cdc-acm.c:409:3: warning: Use of memory after it is freed
acm_process_notification(acm, (unsigned char *)dr);
There are three problems, the first one is that dr is not reset
The variable dr is set with
if (acm->nb_index)
dr = (struct usb_cdc_notification *)acm->notification_buffer;
But if the notification_buffer is too small it is resized with
if (acm->nb_size) {
kfree(acm->notification_buffer);
acm->nb_size = 0;
}
alloc_size = roundup_pow_of_two(expected_size);
/*
* kmalloc ensures a valid notification_buffer after a
* use of kfree in case the previous allocation was too
* small. Final freeing is done on disconnect.
*/
acm->notification_buffer =
kmalloc(alloc_size, GFP_ATOMIC);
dr should point to the new acm->notification_buffer.
The second problem is any data in the notification_buffer is lost
when the pointer is freed. In the normal case, the current data
is accumulated in the notification_buffer here.
memcpy(&acm->notification_buffer[acm->nb_index],
urb->transfer_buffer, copy_size);
When a resize happens, anything before
notification_buffer[acm->nb_index] is garbage.
The third problem is the acm->nb_index is not reset on a
resizing buffer error.
So switch resizing to using krealloc and reassign dr and
reset nb_index.
Fixes: ea2583529cd1 ("cdc-acm: reassemble fragmented notifications")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20200801152154.20683-1-trix@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -378,21 +378,19 @@ static void acm_ctrl_irq(struct urb *urb
if (current_size < expected_size) {
/* notification is transmitted fragmented, reassemble */
if (acm->nb_size < expected_size) {
- if (acm->nb_size) {
- kfree(acm->notification_buffer);
- acm->nb_size = 0;
- }
+ u8 *new_buffer;
alloc_size = roundup_pow_of_two(expected_size);
- /*
- * kmalloc ensures a valid notification_buffer after a
- * use of kfree in case the previous allocation was too
- * small. Final freeing is done on disconnect.
- */
- acm->notification_buffer =
- kmalloc(alloc_size, GFP_ATOMIC);
- if (!acm->notification_buffer)
+ /* Final freeing is done on disconnect. */
+ new_buffer = krealloc(acm->notification_buffer,
+ alloc_size, GFP_ATOMIC);
+ if (!new_buffer) {
+ acm->nb_index = 0;
goto exit;
+ }
+
+ acm->notification_buffer = new_buffer;
acm->nb_size = alloc_size;
+ dr = (struct usb_cdc_notification *)acm->notification_buffer;
}
copy_size = min(current_size,
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 118/125] usb: storage: Add unusual_uas entry for Sony PSZ drives
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 117/125] USB: cdc-acm: rework notification_buffer resizing Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 119/125] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
` (10 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Till Dörges
From: Alan Stern <stern@rowland.harvard.edu>
commit 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 upstream.
The PSZ-HA* family of USB disk drives from Sony can't handle the
REPORT OPCODES command when using the UAS protocol. This patch adds
an appropriate quirks entry.
Reported-and-tested-by: Till Dörges <doerges@pre-sense.de>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200826143229.GB400430@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_uas.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -28,6 +28,13 @@
* and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
*/
+/* Reported-by: Till Dörges <doerges@pre-sense.de> */
+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
+ "Sony",
+ "PSZ-HA*",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES),
+
/* Reported-by: Julian Groß <julian.g@posteo.de> */
UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
"LaCie",
^ permalink raw reply [flat|nested] 147+ messages in thread* [PATCH 4.19 119/125] btrfs: check the right error variable in btrfs_del_dir_entries_in_log
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 118/125] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 120/125] usb: dwc3: gadget: Dont setup more than requested Greg Kroah-Hartman
` (9 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Filipe Manana, Josef Bacik,
David Sterba, Sasha Levin
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit fb2fecbad50964b9f27a3b182e74e437b40753ef ]
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 090315f4ac78f..3e903e6a33870 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3422,11 +3422,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&dir->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(root->fs_info, trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, err);
+ }
btrfs_end_log_trans(root);
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 120/125] usb: dwc3: gadget: Dont setup more than requested
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 119/125] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 121/125] usb: dwc3: gadget: Fix handling ZLP Greg Kroah-Hartman
` (8 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thinh Nguyen, Felipe Balbi, Sasha Levin
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
[ Upstream commit 5d187c0454ef4c5e046a81af36882d4d515922ec ]
The SG list may be set up with entry size more than the requested
length. Check the usb_request->length and make sure that we don't setup
the TRBs to send/receive more than requested. This case may occur when
the SG entry is allocated up to a certain minimum size, but the request
length is less than that. It can also occur when the request is reused
for a different request length.
Cc: <stable@vger.kernel.org> # v4.18+
Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/gadget.c | 51 +++++++++++++++++++++++++++------------
1 file changed, 35 insertions(+), 16 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2f5f4ca5c0d04..5d8a28efddad9 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1017,26 +1017,24 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
* dwc3_prepare_one_trb - setup one TRB from one request
* @dep: endpoint for which this request is prepared
* @req: dwc3_request pointer
+ * @trb_length: buffer size of the TRB
* @chain: should this TRB be chained to the next?
* @node: only for isochronous endpoints. First TRB needs different type.
*/
static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
- struct dwc3_request *req, unsigned chain, unsigned node)
+ struct dwc3_request *req, unsigned int trb_length,
+ unsigned chain, unsigned node)
{
struct dwc3_trb *trb;
- unsigned int length;
dma_addr_t dma;
unsigned stream_id = req->request.stream_id;
unsigned short_not_ok = req->request.short_not_ok;
unsigned no_interrupt = req->request.no_interrupt;
- if (req->request.num_sgs > 0) {
- length = sg_dma_len(req->start_sg);
+ if (req->request.num_sgs > 0)
dma = sg_dma_address(req->start_sg);
- } else {
- length = req->request.length;
+ else
dma = req->request.dma;
- }
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1048,7 +1046,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
req->num_trbs++;
- __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node,
+ __dwc3_prepare_one_trb(dep, trb, dma, trb_length, chain, node,
stream_id, short_not_ok, no_interrupt);
}
@@ -1058,16 +1056,27 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
struct scatterlist *sg = req->start_sg;
struct scatterlist *s;
int i;
-
+ unsigned int length = req->request.length;
unsigned int remaining = req->request.num_mapped_sgs
- req->num_queued_sgs;
+ /*
+ * If we resume preparing the request, then get the remaining length of
+ * the request and resume where we left off.
+ */
+ for_each_sg(req->request.sg, s, req->num_queued_sgs, i)
+ length -= sg_dma_len(s);
+
for_each_sg(sg, s, remaining, i) {
- unsigned int length = req->request.length;
unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
unsigned int rem = length % maxp;
+ unsigned int trb_length;
unsigned chain = true;
+ trb_length = min_t(unsigned int, length, sg_dma_len(s));
+
+ length -= trb_length;
+
/*
* IOMMU driver is coalescing the list of sgs which shares a
* page boundary into one and giving it to USB driver. With
@@ -1075,7 +1084,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
* sgs passed. So mark the chain bit to false if it isthe last
* mapped sg.
*/
- if (i == remaining - 1)
+ if ((i == remaining - 1) || !length)
chain = false;
if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) {
@@ -1085,7 +1094,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, i);
+ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
/* Now prepare one extra TRB to align transfer size */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1096,7 +1105,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->request.short_not_ok,
req->request.no_interrupt);
} else {
- dwc3_prepare_one_trb(dep, req, chain, i);
+ dwc3_prepare_one_trb(dep, req, trb_length, chain, i);
}
/*
@@ -1111,6 +1120,16 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->num_queued_sgs++;
+ /*
+ * The number of pending SG entries may not correspond to the
+ * number of mapped SG entries. If all the data are queued, then
+ * don't include unused SG entries.
+ */
+ if (length == 0) {
+ req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;
+ break;
+ }
+
if (!dwc3_calc_trbs_left(dep))
break;
}
@@ -1130,7 +1149,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, 0);
+ dwc3_prepare_one_trb(dep, req, length, true, 0);
/* Now prepare one extra TRB to align transfer size */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1147,7 +1166,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->needs_extra_trb = true;
/* prepare normal TRB */
- dwc3_prepare_one_trb(dep, req, true, 0);
+ dwc3_prepare_one_trb(dep, req, length, true, 0);
/* Now prepare one extra TRB to handle ZLP */
trb = &dep->trb_pool[dep->trb_enqueue];
@@ -1157,7 +1176,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->request.short_not_ok,
req->request.no_interrupt);
} else {
- dwc3_prepare_one_trb(dep, req, false, 0);
+ dwc3_prepare_one_trb(dep, req, length, false, 0);
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 121/125] usb: dwc3: gadget: Fix handling ZLP
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 120/125] usb: dwc3: gadget: Dont setup more than requested Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 122/125] usb: dwc3: gadget: Handle ZLP for sg requests Greg Kroah-Hartman
` (7 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thinh Nguyen, Felipe Balbi, Sasha Levin
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
[ Upstream commit d2ee3ff79e6a3d4105e684021017d100524dc560 ]
The usb_request->zero doesn't apply for isoc. Also, if we prepare a
0-length (ZLP) TRB for the OUT direction, we need to prepare an extra
TRB to pad up to the MPS alignment. Use the same bounce buffer for the
ZLP TRB and the extra pad TRB.
Cc: <stable@vger.kernel.org> # v4.5+
Fixes: d6e5a549cc4d ("usb: dwc3: simplify ZLP handling")
Fixes: 04c03d10e507 ("usb: dwc3: gadget: handle request->zero")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/gadget.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 5d8a28efddad9..9f6b430773000 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1159,6 +1159,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
req->request.short_not_ok,
req->request.no_interrupt);
} else if (req->request.zero && req->request.length &&
+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
(IS_ALIGNED(req->request.length, maxp))) {
struct dwc3 *dwc = dep->dwc;
struct dwc3_trb *trb;
@@ -1168,13 +1169,23 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
/* prepare normal TRB */
dwc3_prepare_one_trb(dep, req, length, true, 0);
- /* Now prepare one extra TRB to handle ZLP */
+ /* Prepare one extra TRB to handle ZLP */
trb = &dep->trb_pool[dep->trb_enqueue];
req->num_trbs++;
__dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
- false, 1, req->request.stream_id,
+ !req->direction, 1, req->request.stream_id,
req->request.short_not_ok,
req->request.no_interrupt);
+
+ /* Prepare one more TRB to handle MPS alignment for OUT */
+ if (!req->direction) {
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
+ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ }
} else {
dwc3_prepare_one_trb(dep, req, length, false, 0);
}
@@ -2347,8 +2358,17 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
status);
if (req->needs_extra_trb) {
+ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
+
ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
status);
+
+ /* Reclaim MPS padding TRB for ZLP */
+ if (!req->direction && req->request.zero && req->request.length &&
+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+ (IS_ALIGNED(req->request.length, maxp)))
+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event, status);
+
req->needs_extra_trb = false;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 122/125] usb: dwc3: gadget: Handle ZLP for sg requests
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 121/125] usb: dwc3: gadget: Fix handling ZLP Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 123/125] tpm: Unify the mismatching TPM space buffer sizes Greg Kroah-Hartman
` (6 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thinh Nguyen, Felipe Balbi, Sasha Levin
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
[ Upstream commit bc9a2e226ea95e1699f7590845554de095308b75 ]
Currently dwc3 doesn't handle usb_request->zero for SG requests. This
change checks and prepares extra TRBs for the ZLP for SG requests.
Cc: <stable@vger.kernel.org> # v4.5+
Fixes: 04c03d10e507 ("usb: dwc3: gadget: handle request->zero")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/gadget.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9f6b430773000..7bf2573dd459e 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1104,6 +1104,35 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
req->request.stream_id,
req->request.short_not_ok,
req->request.no_interrupt);
+ } else if (req->request.zero && req->request.length &&
+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+ !rem && !chain) {
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+
+ req->needs_extra_trb = true;
+
+ /* Prepare normal TRB */
+ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
+
+ /* Prepare one extra TRB to handle ZLP */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
+ !req->direction, 1,
+ req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+
+ /* Prepare one more TRB to handle MPS alignment */
+ if (!req->direction) {
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
+ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ }
} else {
dwc3_prepare_one_trb(dep, req, trb_length, chain, i);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 123/125] tpm: Unify the mismatching TPM space buffer sizes
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 122/125] usb: dwc3: gadget: Handle ZLP for sg requests Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
` (5 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Berger, Jerry Snitselaar,
Jarkko Sakkinen, Sasha Levin
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
[ Upstream commit 6c4e79d99e6f42b79040f1a33cd4018f5425030b ]
The size of the buffers for storing context's and sessions can vary from
arch to arch as PAGE_SIZE can be anything between 4 kB and 256 kB (the
maximum for PPC64). Define a fixed buffer size set to 16 kB. This should be
enough for most use with three handles (that is how many we allow at the
moment). Parametrize the buffer size while doing this, so that it is easier
to revisit this later on if required.
Cc: stable@vger.kernel.org
Reported-by: Stefan Berger <stefanb@linux.ibm.com>
Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces")
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm-chip.c | 9 ++-------
drivers/char/tpm/tpm.h | 6 +++++-
drivers/char/tpm/tpm2-space.c | 26 ++++++++++++++++----------
drivers/char/tpm/tpmrm-dev.c | 2 +-
4 files changed, 24 insertions(+), 19 deletions(-)
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 4946c5b37d04d..f79f877942733 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -276,13 +276,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
chip->cdev.owner = THIS_MODULE;
chip->cdevs.owner = THIS_MODULE;
- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
- if (!chip->work_space.context_buf) {
- rc = -ENOMEM;
- goto out;
- }
- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
- if (!chip->work_space.session_buf) {
+ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE);
+ if (rc) {
rc = -ENOMEM;
goto out;
}
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 289221d653cb2..b9a30f0b88257 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -188,6 +188,7 @@ struct tpm_space {
u8 *context_buf;
u32 session_tbl[3];
u8 *session_buf;
+ u32 buf_size;
};
enum tpm_chip_flags {
@@ -278,6 +279,9 @@ struct tpm_output_header {
#define TPM_TAG_RQU_COMMAND 193
+/* TPM2 specific constants. */
+#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */
+
struct stclear_flags_t {
__be16 tag;
u8 deactivated;
@@ -595,7 +599,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
int tpm2_probe(struct tpm_chip *chip);
int tpm2_find_cc(struct tpm_chip *chip, u32 cc);
-int tpm2_init_space(struct tpm_space *space);
+int tpm2_init_space(struct tpm_space *space, unsigned int buf_size);
void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space);
int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
u8 *cmd);
diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index d2e101b32482f..9f4e22dcde270 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -43,18 +43,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
}
}
-int tpm2_init_space(struct tpm_space *space)
+int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
{
- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ space->context_buf = kzalloc(buf_size, GFP_KERNEL);
if (!space->context_buf)
return -ENOMEM;
- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ space->session_buf = kzalloc(buf_size, GFP_KERNEL);
if (space->session_buf == NULL) {
kfree(space->context_buf);
+ /* Prevent caller getting a dangling pointer. */
+ space->context_buf = NULL;
return -ENOMEM;
}
+ space->buf_size = buf_size;
return 0;
}
@@ -276,8 +279,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
sizeof(space->context_tbl));
memcpy(&chip->work_space.session_tbl, &space->session_tbl,
sizeof(space->session_tbl));
- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE);
- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE);
+ memcpy(chip->work_space.context_buf, space->context_buf,
+ space->buf_size);
+ memcpy(chip->work_space.session_buf, space->session_buf,
+ space->buf_size);
rc = tpm2_load_space(chip);
if (rc) {
@@ -456,7 +461,7 @@ static int tpm2_save_space(struct tpm_chip *chip)
continue;
rc = tpm2_save_context(chip, space->context_tbl[i],
- space->context_buf, PAGE_SIZE,
+ space->context_buf, space->buf_size,
&offset);
if (rc == -ENOENT) {
space->context_tbl[i] = 0;
@@ -474,9 +479,8 @@ static int tpm2_save_space(struct tpm_chip *chip)
continue;
rc = tpm2_save_context(chip, space->session_tbl[i],
- space->session_buf, PAGE_SIZE,
+ space->session_buf, space->buf_size,
&offset);
-
if (rc == -ENOENT) {
/* handle error saving session, just forget it */
space->session_tbl[i] = 0;
@@ -522,8 +526,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
sizeof(space->context_tbl));
memcpy(&space->session_tbl, &chip->work_space.session_tbl,
sizeof(space->session_tbl));
- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE);
- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE);
+ memcpy(space->context_buf, chip->work_space.context_buf,
+ space->buf_size);
+ memcpy(space->session_buf, chip->work_space.session_buf,
+ space->buf_size);
return 0;
}
diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c
index 1a0e97a5da5a4..162fb16243d03 100644
--- a/drivers/char/tpm/tpmrm-dev.c
+++ b/drivers/char/tpm/tpmrm-dev.c
@@ -22,7 +22,7 @@ static int tpmrm_open(struct inode *inode, struct file *file)
if (priv == NULL)
return -ENOMEM;
- rc = tpm2_init_space(&priv->space);
+ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE);
if (rc) {
kfree(priv);
return -ENOMEM;
--
2.25.1
^ permalink raw reply related [flat|nested] 147+ messages in thread* [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 123/125] tpm: Unify the mismatching TPM space buffer sizes Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 19:12 ` Pavel Machek
2020-09-01 15:11 ` [PATCH 4.19 125/125] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
` (4 subsequent siblings)
128 siblings, 1 reply; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+34ee1b45d88571c2fa8b,
Dan Carpenter, Peilin Ye, Jiri Kosina
From: Peilin Ye <yepeilin.cs@gmail.com>
commit 25a097f5204675550afb879ee18238ca917cba7a upstream.
`uref->usage_index` is not always being properly checked, causing
hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hiddev.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -532,12 +532,16 @@ static noinline int hiddev_ioctl_usage(s
switch (cmd) {
case HIDIOCGUSAGE:
+ if (uref->usage_index >= field->report_count)
+ goto inval;
uref->value = field->value[uref->usage_index];
if (copy_to_user(user_arg, uref, sizeof(*uref)))
goto fault;
goto goodreturn;
case HIDIOCSUSAGE:
+ if (uref->usage_index >= field->report_count)
+ goto inval;
field->value[uref->usage_index] = uref->value;
goto goodreturn;
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
2020-09-01 15:11 ` [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
@ 2020-09-01 19:12 ` Pavel Machek
2020-09-01 19:36 ` Dan Carpenter
0 siblings, 1 reply; 147+ messages in thread
From: Pavel Machek @ 2020-09-01 19:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, syzbot+34ee1b45d88571c2fa8b, Dan Carpenter,
Peilin Ye, Jiri Kosina
[-- Attachment #1: Type: text/plain, Size: 576 bytes --]
Hi!
> commit 25a097f5204675550afb879ee18238ca917cba7a upstream.
>
> `uref->usage_index` is not always being properly checked, causing
> hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
Well, the code is quite confusig, but:
a) does HIDIOCGCOLLECTIONINDEX need same checking?
b) should we check this using some kind of _nospec() variant to
prevent speculation attacks?
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
2020-09-01 19:12 ` Pavel Machek
@ 2020-09-01 19:36 ` Dan Carpenter
0 siblings, 0 replies; 147+ messages in thread
From: Dan Carpenter @ 2020-09-01 19:36 UTC (permalink / raw)
To: Pavel Machek
Cc: Greg Kroah-Hartman, linux-kernel, stable,
syzbot+34ee1b45d88571c2fa8b, Peilin Ye, Jiri Kosina
On Tue, Sep 01, 2020 at 09:12:09PM +0200, Pavel Machek wrote:
> Hi!
>
> > commit 25a097f5204675550afb879ee18238ca917cba7a upstream.
> >
> > `uref->usage_index` is not always being properly checked, causing
> > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
>
> Well, the code is quite confusig, but:
>
> a) does HIDIOCGCOLLECTIONINDEX need same checking?
It's checked in the previous switch statement.
>
> b) should we check this using some kind of _nospec() variant to
> prevent speculation attacks?
I don't think so. I wrote up an explanation earlier just because the
code was so confusing.
https://lkml.org/lkml/2020/7/20/523
regards,
dan carpenter
^ permalink raw reply [flat|nested] 147+ messages in thread
* [PATCH 4.19 125/125] ALSA: usb-audio: Update documentation comment for MS2109 quirk
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
@ 2020-09-01 15:11 ` Greg Kroah-Hartman
2020-09-01 22:22 ` [PATCH 4.19 000/125] 4.19.143-rc1 review Shuah Khan
` (3 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hector Martin, Takashi Iwai
From: Hector Martin <marcan@marcan.st>
commit 74a2a7de81a2ef20732ec02087314e92692a7a1b upstream.
As the recent fix addressed the channel swap problem more properly,
update the comment as well.
Fixes: 1b7ecc241a67 ("ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109")
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200816084431.102151-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks-table.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3524,8 +3524,8 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* A
* they pretend to be 96kHz mono as a workaround for stereo being broken
* by that...
*
- * They also have swapped L-R channels, but that's for userspace to deal
- * with.
+ * They also have an issue with initial stream alignment that causes the
+ * channels to be swapped and out of phase, which is dealt with in quirks.c.
*/
{
.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 000/125] 4.19.143-rc1 review
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2020-09-01 15:11 ` [PATCH 4.19 125/125] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
@ 2020-09-01 22:22 ` Shuah Khan
2020-09-02 6:54 ` Naresh Kamboju
` (2 subsequent siblings)
128 siblings, 0 replies; 147+ messages in thread
From: Shuah Khan @ 2020-09-01 22:22 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
lkft-triage, stable, Shuah Khan
On 9/1/20 9:09 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.143-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 000/125] 4.19.143-rc1 review
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2020-09-01 22:22 ` [PATCH 4.19 000/125] 4.19.143-rc1 review Shuah Khan
@ 2020-09-02 6:54 ` Naresh Kamboju
2020-09-02 10:06 ` Pavel Machek
2020-09-02 16:47 ` Guenter Roeck
128 siblings, 0 replies; 147+ messages in thread
From: Naresh Kamboju @ 2020-09-02 6:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Shuah Khan, patches, lkft-triage, Ben Hutchings,
linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck
On Tue, 1 Sep 2020 at 20:53, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.143-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Summary
------------------------------------------------------------------------
kernel: 4.19.143-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: ae6e3cc29bb4eca8baf48409319aa290efcba5f5
git describe: v4.19.142-126-gae6e3cc29bb4
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.142-126-gae6e3cc29bb4
No regressions (compared to build v4.19.142)
No fixes (compared to build v4.19.142)
Ran 35939 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* libhugetlbfs
* linux-log-parser
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cve-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-mm-tests
* network-basic-tests
* ltp-fs-tests
* ltp-ipc-tests
* ltp-open-posix-tests
* ltp-sched-tests
* igt-gpu-tools
* ssuite
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 000/125] 4.19.143-rc1 review
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2020-09-02 6:54 ` Naresh Kamboju
@ 2020-09-02 10:06 ` Pavel Machek
2020-09-03 9:20 ` Greg Kroah-Hartman
2020-09-02 16:47 ` Guenter Roeck
128 siblings, 1 reply; 147+ messages in thread
From: Pavel Machek @ 2020-09-02 10:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
[-- Attachment #1: Type: text/plain, Size: 735 bytes --]
Hi!
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
CIP testing did not find any problems (test:x86_siemens failure is
because those boards are offline).
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/184417281
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 147+ messages in thread* Re: [PATCH 4.19 000/125] 4.19.143-rc1 review
2020-09-02 10:06 ` Pavel Machek
@ 2020-09-03 9:20 ` Greg Kroah-Hartman
0 siblings, 0 replies; 147+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-03 9:20 UTC (permalink / raw)
To: Pavel Machek
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Wed, Sep 02, 2020 at 12:06:21PM +0200, Pavel Machek wrote:
> Hi!
>
> > This is the start of the stable review cycle for the 4.19.143 release.
> > There are 125 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> > Anything received after that time might be too late.
>
> CIP testing did not find any problems (test:x86_siemens failure is
> because those boards are offline).
>
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/184417281
Thanks for testing two of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 147+ messages in thread
* Re: [PATCH 4.19 000/125] 4.19.143-rc1 review
2020-09-01 15:09 [PATCH 4.19 000/125] 4.19.143-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2020-09-02 10:06 ` Pavel Machek
@ 2020-09-02 16:47 ` Guenter Roeck
128 siblings, 0 replies; 147+ messages in thread
From: Guenter Roeck @ 2020-09-02 16:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Tue, Sep 01, 2020 at 05:09:15PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 155 pass: 155 fail: 0
Qemu test results:
total: 421 pass: 421 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 147+ messages in thread