The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e9abc611a941d4051cde1d94b2ab7473fdb50102 Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas(a)kwiboo.se>
Date: Wed, 20 Feb 2019 22:40:06 +0000
Subject: [PATCH] drm/rockchip: vop: reset scale mode when win is disabled
NV12 framebuffers produced by the VPU shows distorted on RK3288
after win has been disabled when scaling is active.
This issue can be reproduced using a 1080p modeset by:
- Scale a 1280x720 NV12 framebuffer to 1920x1080 on win0
- Disable win0
- Display a 1920x1080 NV12 framebuffer without scaling on win0
- Output will now show the framebuffer distorted
And by:
- Scale a 1280x720 NV12 framebuffer to 1920x1080
- Change to a 720p modeset (win gets disabled and scaling reset to none)
- Output will now show the framebuffer distorted
Fix this by setting scale mode to none when win is disabled.
Fixes: 4c156c21c794 ("drm/rockchip: vop: support plane scale")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jonas Karlman <jonas(a)kwiboo.se>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/AM3PR03MB0966DE3E19BACE07328C…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index c7d4c6073ea5..0d4ade9d4722 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -541,6 +541,18 @@ static void vop_core_clks_disable(struct vop *vop)
clk_disable(vop->hclk);
}
+static void vop_win_disable(struct vop *vop, const struct vop_win_data *win)
+{
+ if (win->phy->scl && win->phy->scl->ext) {
+ VOP_SCL_SET_EXT(vop, win, yrgb_hor_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, yrgb_ver_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, cbcr_hor_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, cbcr_ver_scl_mode, SCALE_NONE);
+ }
+
+ VOP_WIN_SET(vop, win, enable, 0);
+}
+
static int vop_enable(struct drm_crtc *crtc)
{
struct vop *vop = to_vop(crtc);
@@ -586,7 +598,7 @@ static int vop_enable(struct drm_crtc *crtc)
struct vop_win *vop_win = &vop->win[i];
const struct vop_win_data *win = vop_win->data;
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
}
spin_unlock(&vop->reg_lock);
@@ -735,7 +747,7 @@ static void vop_plane_atomic_disable(struct drm_plane *plane,
spin_lock(&vop->reg_lock);
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
spin_unlock(&vop->reg_lock);
}
@@ -1622,7 +1634,7 @@ static int vop_initial(struct vop *vop)
int channel = i * 2 + 1;
VOP_WIN_SET(vop, win, channel, (channel + 1) << 4 | channel);
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
VOP_WIN_SET(vop, win, gate, 1);
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e9abc611a941d4051cde1d94b2ab7473fdb50102 Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas(a)kwiboo.se>
Date: Wed, 20 Feb 2019 22:40:06 +0000
Subject: [PATCH] drm/rockchip: vop: reset scale mode when win is disabled
NV12 framebuffers produced by the VPU shows distorted on RK3288
after win has been disabled when scaling is active.
This issue can be reproduced using a 1080p modeset by:
- Scale a 1280x720 NV12 framebuffer to 1920x1080 on win0
- Disable win0
- Display a 1920x1080 NV12 framebuffer without scaling on win0
- Output will now show the framebuffer distorted
And by:
- Scale a 1280x720 NV12 framebuffer to 1920x1080
- Change to a 720p modeset (win gets disabled and scaling reset to none)
- Output will now show the framebuffer distorted
Fix this by setting scale mode to none when win is disabled.
Fixes: 4c156c21c794 ("drm/rockchip: vop: support plane scale")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jonas Karlman <jonas(a)kwiboo.se>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/AM3PR03MB0966DE3E19BACE07328C…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index c7d4c6073ea5..0d4ade9d4722 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -541,6 +541,18 @@ static void vop_core_clks_disable(struct vop *vop)
clk_disable(vop->hclk);
}
+static void vop_win_disable(struct vop *vop, const struct vop_win_data *win)
+{
+ if (win->phy->scl && win->phy->scl->ext) {
+ VOP_SCL_SET_EXT(vop, win, yrgb_hor_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, yrgb_ver_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, cbcr_hor_scl_mode, SCALE_NONE);
+ VOP_SCL_SET_EXT(vop, win, cbcr_ver_scl_mode, SCALE_NONE);
+ }
+
+ VOP_WIN_SET(vop, win, enable, 0);
+}
+
static int vop_enable(struct drm_crtc *crtc)
{
struct vop *vop = to_vop(crtc);
@@ -586,7 +598,7 @@ static int vop_enable(struct drm_crtc *crtc)
struct vop_win *vop_win = &vop->win[i];
const struct vop_win_data *win = vop_win->data;
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
}
spin_unlock(&vop->reg_lock);
@@ -735,7 +747,7 @@ static void vop_plane_atomic_disable(struct drm_plane *plane,
spin_lock(&vop->reg_lock);
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
spin_unlock(&vop->reg_lock);
}
@@ -1622,7 +1634,7 @@ static int vop_initial(struct vop *vop)
int channel = i * 2 + 1;
VOP_WIN_SET(vop, win, channel, (channel + 1) << 4 | channel);
- VOP_WIN_SET(vop, win, enable, 0);
+ vop_win_disable(vop, win);
VOP_WIN_SET(vop, win, gate, 1);
}
The patch below does not apply to the 5.0-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5cec2d2e5839f9c0fec319c523a911e0a7fd299f Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos(a)android.com>
Date: Fri, 1 Mar 2019 15:06:06 -0800
Subject: [PATCH] binder: fix race between munmap() and direct reclaim
An munmap() on a binder device causes binder_vma_close() to be called
which clears the alloc->vma pointer.
If direct reclaim causes binder_alloc_free_page() to be called, there
is a race where alloc->vma is read into a local vma pointer and then
used later after the mm->mmap_sem is acquired. This can result in
calling zap_page_range() with an invalid vma which manifests as a
use-after-free in zap_page_range().
The fix is to check alloc->vma after acquiring the mmap_sem (which we
were acquiring anyway) and skip zap_page_range() if it has changed
to NULL.
Signed-off-by: Todd Kjos <tkjos(a)google.com>
Reviewed-by: Joel Fernandes (Google) <joel(a)joelfernandes.org>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 6389467670a0..195f120c4e8c 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -927,14 +927,13 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
index = page - alloc->pages;
page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
+
+ mm = alloc->vma_vm_mm;
+ if (!mmget_not_zero(mm))
+ goto err_mmget;
+ if (!down_write_trylock(&mm->mmap_sem))
+ goto err_down_write_mmap_sem_failed;
vma = binder_alloc_get_vma(alloc);
- if (vma) {
- if (!mmget_not_zero(alloc->vma_vm_mm))
- goto err_mmget;
- mm = alloc->vma_vm_mm;
- if (!down_read_trylock(&mm->mmap_sem))
- goto err_down_write_mmap_sem_failed;
- }
list_lru_isolate(lru, item);
spin_unlock(lock);
@@ -945,10 +944,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
zap_page_range(vma, page_addr, PAGE_SIZE);
trace_binder_unmap_user_end(alloc, index);
-
- up_read(&mm->mmap_sem);
- mmput(mm);
}
+ up_write(&mm->mmap_sem);
+ mmput(mm);
trace_binder_unmap_kernel_start(alloc, index);
This is a note to let you know that I've just added the patch titled
Revert "tty: pty: Fix race condition between release_one_tty and
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 0eae4686a128d87503863a261e84887750c8bc68 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Date: Fri, 29 Mar 2019 15:47:40 +0100
Subject: Revert "tty: pty: Fix race condition between release_one_tty and
pty_write"
This reverts commit b9ca5f8560af244489b4a1bc1ae88b341f24bc95 as 0-day
shows it has a circular locking dependency.
Fixes: b9ca5f8560af ("tty: pty: Fix race condition between release_one_tty and pty_write")
Reported-by: kernel test robot <lkp(a)intel.com>
Cc: Sahara <keun-o.park(a)darkmatter.ae>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/pty.c | 7 -------
drivers/tty/tty_io.c | 3 ---
2 files changed, 10 deletions(-)
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index ef72031ab5b9..00099a8439d2 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -116,12 +116,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
if (tty->stopped)
return 0;
- mutex_lock(&tty_mutex);
- if (to->magic != TTY_MAGIC) {
- mutex_unlock(&tty_mutex);
- return -EIO;
- }
-
if (c > 0) {
spin_lock_irqsave(&to->port->lock, flags);
/* Stuff the data into the input queue of the other end */
@@ -131,7 +125,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
tty_flip_buffer_push(to->port);
spin_unlock_irqrestore(&to->port->lock, flags);
}
- mutex_unlock(&tty_mutex);
return c;
}
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index c27777f3b8c4..5fa250157025 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1448,13 +1448,10 @@ static void release_one_tty(struct work_struct *work)
struct tty_driver *driver = tty->driver;
struct module *owner = driver->owner;
- mutex_lock(&tty_mutex);
if (tty->ops->cleanup)
tty->ops->cleanup(tty);
tty->magic = 0;
- mutex_unlock(&tty_mutex);
-
tty_driver_kref_put(driver);
module_put(owner);
--
2.21.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 1f6f316a537d - Linux 5.0.5
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out a ref:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ref: 1f6f316a537d - Linux 5.0.5
We then merged the patchset with `git am`:
bluetooth-check-l2cap-option-sizes-returned-from-l2cap_get_conf_opt.patch
bluetooth-verify-that-l2cap_get_conf_opt-provides-large-enough-buffer.patch
netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch
dccp-do-not-use-ipv6-header-for-ipv4-flow.patch
genetlink-fix-a-memory-leak-on-error-path.patch
gtp-change-net_udp_tunnel-dependency-to-select.patch
ipv6-make-ip6_create_rt_rcu-return-ip6_null_entry-instead-of-null.patch
mac8390-fix-mmio-access-size-probe.patch
misdn-hfcpci-test-both-vendor-device-id-for-digium-hfc4s.patch
net-aquantia-fix-rx-checksum-offload-for-udp-tcp-over-ipv6.patch
net-datagram-fix-unbounded-loop-in-__skb_try_recv_datagram.patch
net-packet-set-__gfp_nowarn-upon-allocation-in-alloc_pg_vec.patch
net-phy-meson-gxl-fix-interrupt-support.patch
net-rose-fix-a-possible-stack-overflow.patch
net-stmmac-fix-memory-corruption-with-large-mtus.patch
net-sysfs-call-dev_hold-if-kobject_init_and_add-success.patch
net-usb-aqc111-extend-hwid-table-by-qnap-device.patch
packets-always-register-packet-sk-in-the-same-order.patch
rhashtable-still-do-rehash-when-we-get-eexist.patch
sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch
sctp-use-memdup_user-instead-of-vmemdup_user.patch
tcp-do-not-use-ipv6-header-for-ipv4-flow.patch
tipc-allow-service-ranges-to-be-connect-ed-on-rdm-dgram.patch
tipc-change-to-check-tipc_own_id-to-return-in-tipc_net_stop.patch
tipc-fix-cancellation-of-topology-subscriptions.patch
tun-properly-test-for-iff_up.patch
vrf-prevent-adding-upper-devices.patch
vxlan-don-t-call-gro_cells_destroy-before-device-is-unregistered.patch
thunderx-enable-page-recycling-for-non-xdp-case.patch
thunderx-eliminate-extra-calls-to-put_page-for-pages-held-for-recycling.patch
net-dsa-mv88e6xxx-fix-few-issues-in-mv88e6390x_port_set_cmode.patch
net-mii-fix-pause-cap-advertisement-from-linkmode_adv_to_lcl_adv_t-helper.patch
net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
r8169-fix-cable-re-plugging-issue.patch
ila-fix-rhashtable-walker-list-corruption.patch
tun-add-a-missing-rcu_read_unlock-in-error-path.patch
powerpc-fsl-fix-the-flush-of-branch-predictor.patch
btrfs-fix-incorrect-file-size-after-shrinking-truncate-and-fsync.patch
btrfs-remove-warn_on-in-log_dir_items.patch
btrfs-don-t-report-readahead-errors-and-don-t-update-statistics.patch
btrfs-raid56-properly-unmap-parity-page-in-finish_parity_scrub.patch
btrfs-fix-bound-checking-in-qgroup_trace_new_subtree_blocks.patch
btrfs-avoid-possible-qgroup_rsv_size-overflow-in-btrfs_calculate_inode_block_rsv_size.patch
btrfs-fix-assertion-failure-on-fsync-with-no_holes-enabled.patch
locks-wake-any-locks-blocked-on-request-before-deadlock-check.patch
tracing-initialize-variable-in-create_dyn_event.patch
arm-imx6q-cpuidle-fix-bug-that-cpu-might-not-wake-up-at-expected-time.patch
powerpc-bpf-fix-generation-of-load-store-dw-instructions.patch
vfio-ccw-only-free-cp-on-final-interrupt.patch
nfs-fix-nfs4_lock_state-refcounting-in-nfs4_alloc_-lock-unlock-data.patch
nfs-fix-mount-umount-race-in-nlmclnt.patch
nfsv4.1-don-t-free-interrupted-slot-on-open.patch
net-dsa-qca8k-remove-leftover-phy-accessors.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/aarch64/b8766c0c99352d958c320bd68c…
kernel build: https://artifacts.cki-project.org/builds/aarch64/b8766c0c99352d958c320bd68c…
ppc64le:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/ppc64le/766f91ea7654ddc047f58cf70e…
kernel build: https://artifacts.cki-project.org/builds/ppc64le/766f91ea7654ddc047f58cf70e…
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/x86_64/fe13fc3ed745531769b18d22725…
kernel build: https://artifacts.cki-project.org/builds/x86_64/fe13fc3ed745531769b18d22725…
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
✅ Boot test [0]
✅ LTP lite - release 20190115 [1]
✅ Loopdev Sanity [2]
✅ xfstests: xfs [3]
✅ AMTU (Abstract Machine Test Utility) [4]
🚧 ✅ Networking route: pmtu [5]
🚧 ❎ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ httpd: php sanity [8]
🚧 ✅ iotop: sanity [9]
🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport
🚧 ✅ tuned: tune-processes-through-perf [10]
✅ Usex - version 1.9-29 [11]
ppc64le:
✅ Boot test [0]
✅ LTP lite - release 20190115 [1]
✅ Loopdev Sanity [2]
✅ xfstests: xfs [3]
✅ AMTU (Abstract Machine Test Utility) [4]
🚧 ✅ Networking route: pmtu [5]
🚧 ❎ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ httpd: php sanity [8]
🚧 ✅ iotop: sanity [9]
🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport
🚧 ✅ selinux-policy: serge-testsuite [12]
🚧 ✅ tuned: tune-processes-through-perf [10]
✅ Usex - version 1.9-29 [11]
x86_64:
✅ Boot test [0]
✅ LTP lite - release 20190115 [1]
✅ Loopdev Sanity [2]
✅ xfstests: xfs [3]
✅ AMTU (Abstract Machine Test Utility) [4]
🚧 ✅ Networking route: pmtu [5]
🚧 ❎ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ httpd: php sanity [8]
🚧 ✅ iotop: sanity [9]
🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport
🚧 ✅ selinux-policy: serge-testsuite [12]
🚧 ✅ tuned: tune-processes-through-perf [10]
✅ Usex - version 1.9-29 [11]
Test source:
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
Waived tests (marked with 🚧)
-----------------------------
This test run included waived tests. Such tests are executed but their results
are not taken into account. Tests are waived when their results are not
reliable enough, e.g. when they're just introduced or are being fixed.