September 2019 - Linux-stable-mirror

[PATCH] ar5523: check NULL before memcpy() in ar5523_cmd()

by Denis Efremov

memcpy() call with "idata == NULL && ilen == 0" results in undefined behavior in ar5523_cmd(). For example, NULL is passed in callchain "ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch adds idata check before memcpy() call in ar5523_cmd() to prevent an undefined behavior. Cc: Pontus Fuchs <pontus.fuchs(a)gmail.com> Cc: Kalle Valo <kvalo(a)codeaurora.org> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: stable(a)vger.kernel.org Signed-off-by: Denis Efremov <efremov(a)linux.com> --- drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c index b94759daeacc..f25af5bc5282 100644 --- a/drivers/net/wireless/ath/ar5523/ar5523.c +++ b/drivers/net/wireless/ath/ar5523/ar5523.c @@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, if (flags & AR5523_CMD_FLAG_MAGIC) hdr->magic = cpu_to_be32(1 << 24); - memcpy(hdr + 1, idata, ilen); + if (idata) + memcpy(hdr + 1, idata, ilen); cmd->odata = odata; cmd->olen = olen; -- 2.21.0

5 years, 2 months

3
3
0 0

[PATCH AUTOSEL 5.3 001/203] ALSA: hda: Flush interrupts on disabling

by Sasha Levin

From: Chris Wilson <chris(a)chris-wilson.co.uk> [ Upstream commit caa8422d01e983782548648e125fd617cadcec3f ] I was looking at <4> [241.835158] general protection fault: 0000 [#1] PREEMPT SMP PTI <4> [241.835181] CPU: 1 PID: 214 Comm: kworker/1:3 Tainted: G U 5.2.0-CI-CI_DRM_6509+ #1 <4> [241.835199] Hardware name: Dell Inc. OptiPlex 745 /0GW726, BIOS 2.3.1 05/21/2007 <4> [241.835234] Workqueue: events snd_hdac_bus_process_unsol_events [snd_hda_core] <4> [241.835256] RIP: 0010:input_handle_event+0x16d/0x5e0 <4> [241.835270] Code: 48 8b 93 58 01 00 00 8b 52 08 89 50 04 8b 83 f8 06 00 00 48 8b 93 00 07 00 00 8d 70 01 48 8d 04 c2 83 e1 08 89 b3 f8 06 00 00 <66> 89 28 66 44 89 60 02 44 89 68 04 8b 93 f8 06 00 00 0f 84 fd fe <4> [241.835304] RSP: 0018:ffffc9000019fda0 EFLAGS: 00010046 <4> [241.835317] RAX: 6b6b6b6ec6c6c6c3 RBX: ffff8880290fefc8 RCX: 0000000000000000 <4> [241.835332] RDX: 000000006b6b6b6b RSI: 000000006b6b6b6c RDI: 0000000000000046 <4> [241.835347] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000001 <4> [241.835362] R10: ffffc9000019faa0 R11: 0000000000000000 R12: 0000000000000004 <4> [241.835377] R13: 0000000000000000 R14: ffff8880290ff1d0 R15: 0000000000000293 <4> [241.835392] FS: 0000000000000000(0000) GS:ffff88803de80000(0000) knlGS:0000000000000000 <4> [241.835409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [241.835422] CR2: 00007ffe9a99e9b7 CR3: 000000002f588000 CR4: 00000000000006e0 <4> [241.835436] Call Trace: <4> [241.835449] input_event+0x45/0x70 <4> [241.835464] snd_jack_report+0xdc/0x100 <4> [241.835490] snd_hda_jack_report_sync+0x83/0xc0 [snd_hda_codec] <4> [241.835512] snd_hdac_bus_process_unsol_events+0x5a/0x70 [snd_hda_core] <4> [241.835530] process_one_work+0x245/0x610 which has the hallmarks of a worker queued from interrupt after it was supposedly cancelled (note the POISON_FREE), and I could not see where the interrupt would be flushed on shutdown so added the likely suspects. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111174 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/hda/hdac_controller.c | 2 ++ sound/pci/hda/hda_intel.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c index 3b0110545070a..196bbc85699e5 100644 --- a/sound/hda/hdac_controller.c +++ b/sound/hda/hdac_controller.c @@ -447,6 +447,8 @@ static void azx_int_disable(struct hdac_bus *bus) list_for_each_entry(azx_dev, &bus->stream_list, list) snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); + synchronize_irq(bus->irq); + /* disable SIE for all streams */ snd_hdac_chip_writeb(bus, INTCTL, 0); diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 99fc0917339bb..0ed2be83706d6 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -1349,9 +1349,9 @@ static int azx_free(struct azx *chip) } if (bus->chip_init) { + azx_stop_chip(chip); azx_clear_irq_pending(chip); azx_stop_all_streams(chip); - azx_stop_chip(chip); } if (bus->irq >= 0) -- 2.20.1

5 years, 2 months

8
216
0 0

[PATCH 1/3] hwmon: Fix HWMON_P_MIN_ALARM mask

by Nuno Sá

Both HWMON_P_MIN_ALARM and HWMON_P_MAX_ALARM were using BIT(hwmon_power_max_alarm). Fixes: aa7f29b07c870 ("hwmon: Add support for power min, lcrit, min_alarm and lcrit_alarm") CC: <stable(a)vger.kernel.org> Signed-off-by: Nuno Sá <nuno.sa(a)analog.com> --- include/linux/hwmon.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h index 04c36b7a61dd..72579168189d 100644 --- a/include/linux/hwmon.h +++ b/include/linux/hwmon.h @@ -235,7 +235,7 @@ enum hwmon_power_attributes { #define HWMON_P_LABEL BIT(hwmon_power_label) #define HWMON_P_ALARM BIT(hwmon_power_alarm) #define HWMON_P_CAP_ALARM BIT(hwmon_power_cap_alarm) -#define HWMON_P_MIN_ALARM BIT(hwmon_power_max_alarm) +#define HWMON_P_MIN_ALARM BIT(hwmon_power_min_alarm) #define HWMON_P_MAX_ALARM BIT(hwmon_power_max_alarm) #define HWMON_P_LCRIT_ALARM BIT(hwmon_power_lcrit_alarm) #define HWMON_P_CRIT_ALARM BIT(hwmon_power_crit_alarm) -- 2.23.0

5 years, 2 months

2
1
0 0

[PATCH 4.19 00/63] 4.19.76-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.76 release. There are 63 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue 01 Oct 2019 01:47:47 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.76-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.76-rc1 Ka-Cheong Poon <ka-cheong.poon(a)oracle.com> net/rds: An rds_sock is added too early to the hash table Cong Wang <xiyou.wangcong(a)gmail.com> net_sched: check cops->tcf_block in tc_bind_tclass() Jian-Hong Pan <jian-hong(a)endlessm.com> Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices Fernando Fernandez Mancera <ffmancera(a)riseup.net> netfilter: nft_socket: fix erroneous socket assignment Darrick J. Wong <darrick.wong(a)oracle.com> xfs: don't crash on null attr fork xfs_bmapi_read Ilia Mirkin <imirkin(a)alum.mit.edu> drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling Hans de Goede <hdegoede(a)redhat.com> ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 Jian-Hong Pan <jian-hong(a)endlessm.com> Bluetooth: btrtl: HCI reset on close for Realtek BT chip Stephen Hemminger <stephen(a)networkplumber.org> net: don't warn in inet diag when IPV6 is disabled Chris Wilson <chris(a)chris-wilson.co.uk> drm: Flush output polling on shutdown Chao Yu <yuchao0(a)huawei.com> f2fs: fix to do sanity check on segment bitmap of LFS curseg Michal Suchanek <msuchanek(a)suse.de> net/ibmvnic: Fix missing { in __ibmvnic_reset Mikulas Patocka <mpatocka(a)redhat.com> dm zoned: fix invalid memory access Chao Yu <yuchao0(a)huawei.com> Revert "f2fs: avoid out-of-range memory access" zhengbin <zhengbin13(a)huawei.com> blk-mq: move cancel of requeue_work to the front of blk_exit_queue Jianchao Wang <jianchao.w.wang(a)oracle.com> blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs Steven Price <steven.price(a)arm.com> initramfs: don't free a non-existent initrd Coly Li <colyli(a)suse.de> bcache: remove redundant LIST_HEAD(journal) from run_cache_set() Dexuan Cui <decui(a)microsoft.com> PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it Surbhi Palande <f2fsnewbie(a)gmail.com> f2fs: check all the data segments against all node ones Marc Zyngier <maz(a)kernel.org> irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices Lorenz Bauer <lmb(a)cloudflare.com> bpf: libbpf: retry loading program on EAGAIN Shirish S <shirish.s(a)amd.com> Revert "drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD" Himanshu Madhani <himanshu.madhani(a)cavium.com> scsi: qla2xxx: Return switch command on a timeout Quinn Tran <quinn.tran(a)cavium.com> scsi: qla2xxx: Remove all rports if fabric scan retry fails Quinn Tran <quinn.tran(a)cavium.com> scsi: qla2xxx: Turn off IOCB timeout timer on IOCB completion Waiman Long <longman(a)redhat.com> locking/lockdep: Add debug_locks check in __lock_downgrade() - again Waiman Long <longman(a)redhat.com> locking/lockdep: Add debug_locks check in __lock_downgrade() David Lechner <david(a)lechnology.com> power: supply: sysfs: ratelimit property read error message Nathan Chancellor <natechancellor(a)gmail.com> pinctrl: sprd: Use define directive for sprd_pinconf_params values Vadim Sukhomlinov <sukhomlinov(a)google.com> tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Clobber user CFLAGS variable Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Apply AMD controller workaround for Raven platform Shih-Yuan Lee (FourDollars) <fourdollars(a)debian.org> ALSA: hda - Add laptop imic fixup for ASUS M9V laptop Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: fix wrong packet parameter for Alesis iO26 Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Add DSD support for EVGA NU Audio Ilya Pshonkin <sudokamikaze(a)protonmail.com> ALSA: usb-audio: Add Hiby device family to quirks for native DSD support Takashi Iwai <tiwai(a)suse.de> ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt() Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: cht_bsw_max98090_ti: Enable codec clock once and keep it enabled Marco Felsch <m.felsch(a)pengutronix.de> media: tvp5150: fix switch exit in set control handler Naftali Goldstein <naftali.goldstein(a)intel.com> iwlwifi: mvm: always init rs_fw with 20MHz bandwidth rates Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> iwlwifi: mvm: send BCAST management frames to the right station Saeed Mahameed <saeedm(a)mellanox.com> net/mlx5e: Rx, Check ip headers sanity Saeed Mahameed <saeedm(a)mellanox.com> net/mlx5e: Rx, Fixup skb checksum for packets with tail padding Saeed Mahameed <saeedm(a)mellanox.com> net/mlx5e: XDP, Avoid checksum complete when XDP prog is loaded Or Gerlitz <ogerlitz(a)mellanox.com> net/mlx5e: Allow reporting of checksum unnecessary Cong Wang <xiyou.wangcong(a)gmail.com> mlx5: fix get_ip_proto() Alaa Hleihel <alaa(a)mellanox.com> net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets Natali Shechtman <natali(a)mellanox.com> net/mlx5e: Set ECN for received packets using CQE indication Aurelien Aptel <aaptel(a)suse.com> CIFS: fix deadlock in cached root handling Gustavo A. R. Silva <gustavo(a)embeddedor.com> crypto: talitos - fix missing break in switch statement Tokunori Ikegami <ikegami.t(a)gmail.com> mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for HP X500 PIXART OEM mouse Alan Stern <stern(a)rowland.harvard.edu> HID: hidraw: Fix invalid read in hidraw_ioctl Alan Stern <stern(a)rowland.harvard.edu> HID: logitech: Fix general protection fault caused by Logitech driver Roderick Colenbrander <roderick.colenbrander(a)sony.com> HID: sony: Fix memory corruption issue on cleanup. Alan Stern <stern(a)rowland.harvard.edu> HID: prodikeys: Fix general protection fault during probe Jack Morgenstein <jackm(a)dev.mellanox.co.il> IB/core: Add an unbound WQ type to the new CQ API Nick Desaulniers <ndesaulniers(a)google.com> drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines Greg Kurz <groug(a)kaod.org> powerpc/xive: Fix bogus error code returned by OPAL Leon Romanovsky <leon(a)kernel.org> RDMA/restrack: Protect from reentry to resource return path Juliet Kim <julietk(a)linux.vnet.ibm.com> net/ibmvnic: free reset work of removed device from queue Marcel Holtmann <marcel(a)holtmann.org> Revert "Bluetooth: validate BLE connection interval updates" ------------- Diffstat: Makefile | 4 +- arch/powerpc/include/asm/opal.h | 2 +- arch/powerpc/platforms/powernv/opal-wrappers.S | 2 +- arch/powerpc/sysdev/xive/native.c | 11 ++ block/blk-core.c | 2 +- block/blk-flush.c | 6 +- block/blk-mq.c | 19 +-- block/blk-sysfs.c | 3 + block/blk.h | 2 +- drivers/acpi/acpi_video.c | 37 ++++++ drivers/bluetooth/btrtl.c | 20 +++ drivers/bluetooth/btrtl.h | 6 + drivers/bluetooth/btusb.c | 4 + drivers/char/tpm/tpm-chip.c | 3 + drivers/crypto/talitos.c | 1 + drivers/gpu/drm/amd/display/dc/calcs/Makefile | 4 + drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c | 5 +- drivers/gpu/drm/drm_probe_helper.c | 9 +- drivers/gpu/drm/nouveau/dispnv50/head.c | 28 ++++- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lg.c | 10 +- drivers/hid/hid-lg4ff.c | 1 - drivers/hid/hid-prodikeys.c | 12 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-sony.c | 2 +- drivers/hid/hidraw.c | 2 +- drivers/infiniband/core/cq.c | 8 +- drivers/infiniband/core/device.c | 15 ++- drivers/infiniband/core/mad.c | 2 +- drivers/infiniband/core/restrack.c | 4 +- drivers/irqchip/irq-gic-v3-its.c | 9 +- drivers/md/bcache/super.c | 1 - drivers/md/dm-zoned-target.c | 2 - drivers/media/i2c/tvp5150.c | 2 +- drivers/mtd/chips/cfi_cmdset_0002.c | 18 ++- drivers/net/ethernet/ibm/ibmvnic.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 3 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 28 +++++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 ++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 126 ++++++++++++++++--- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 9 ++ drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 6 + drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- drivers/pci/controller/pci-hyperv.c | 2 +- drivers/pinctrl/sprd/pinctrl-sprd.c | 6 +- drivers/power/supply/power_supply_sysfs.c | 3 +- drivers/scsi/qla2xxx/qla_gs.c | 134 +++++++++++---------- drivers/scsi/qla2xxx/qla_init.c | 11 +- fs/cifs/smb2ops.c | 44 +++++++ fs/f2fs/segment.c | 44 ++++++- fs/f2fs/super.c | 4 +- fs/xfs/libxfs/xfs_bmap.c | 29 +++-- include/rdma/ib_verbs.h | 9 +- init/initramfs.c | 2 +- kernel/locking/lockdep.c | 6 + net/bluetooth/hci_event.c | 5 - net/bluetooth/l2cap_core.c | 9 +- net/ipv4/raw_diag.c | 3 - net/netfilter/nft_socket.c | 6 +- net/rds/bind.c | 40 +++--- net/sched/sch_api.c | 2 + sound/firewire/dice/dice-alesis.c | 2 +- sound/pci/hda/hda_intel.c | 3 +- sound/pci/hda/patch_analog.c | 1 + sound/soc/fsl/fsl_ssi.c | 6 +- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 47 +++++++- sound/usb/quirks.c | 2 + tools/lib/bpf/bpf.c | 17 ++- tools/objtool/Makefile | 2 +- 73 files changed, 669 insertions(+), 232 deletions(-)

5 years, 2 months

12
82
0 0

[PATCH 5.2 00/45] 5.2.18-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.2.18 release. There are 45 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue 01 Oct 2019 01:47:47 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.2.18-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.2.18-rc1 Ka-Cheong Poon <ka-cheong.poon(a)oracle.com> net/rds: An rds_sock is added too early to the hash table Cong Wang <xiyou.wangcong(a)gmail.com> net_sched: check cops->tcf_block in tc_bind_tclass() Jian-Hong Pan <jian-hong(a)endlessm.com> Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices Fernando Fernandez Mancera <ffmancera(a)riseup.net> netfilter: nft_socket: fix erroneous socket assignment Florian Westphal <fw(a)strlen.de> xfrm: policy: avoid warning splat when merging nodes Darrick J. Wong <darrick.wong(a)oracle.com> xfs: don't crash on null attr fork xfs_bmapi_read Ilia Mirkin <imirkin(a)alum.mit.edu> drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling Hans de Goede <hdegoede(a)redhat.com> ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 Jian-Hong Pan <jian-hong(a)endlessm.com> Bluetooth: btrtl: HCI reset on close for Realtek BT chip Stephen Hemminger <stephen(a)networkplumber.org> net: don't warn in inet diag when IPV6 is disabled Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/dp: Add DP_DPCD_QUIRK_NO_SINK_COUNT Chris Wilson <chris(a)chris-wilson.co.uk> drm: Flush output polling on shutdown Chao Yu <yuchao0(a)huawei.com> f2fs: fix to do sanity check on segment bitmap of LFS curseg Michal Suchanek <msuchanek(a)suse.de> net/ibmvnic: Fix missing { in __ibmvnic_reset Mikulas Patocka <mpatocka(a)redhat.com> dm zoned: fix invalid memory access Chao Yu <yuchao0(a)huawei.com> Revert "f2fs: avoid out-of-range memory access" Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Clobber user CFLAGS variable Heikki Krogerus <heikki.krogerus(a)linux.intel.com> platform/x86: i2c-multi-instantiate: Derive the device name from parent Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Apply AMD controller workaround for Raven platform Shih-Yuan Lee (FourDollars) <fourdollars(a)debian.org> ALSA: hda - Add laptop imic fixup for ASUS M9V laptop Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: fix wrong packet parameter for Alesis iO26 Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Add DSD support for EVGA NU Audio Ilya Pshonkin <sudokamikaze(a)protonmail.com> ALSA: usb-audio: Add Hiby device family to quirks for native DSD support Vitaly Wool <vitalywool(a)gmail.com> Revert "mm/z3fold.c: fix race between migration and destruction" Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Revert "HID: logitech-hidpp: add USB PID for a few more supported mice" Peng Fan <peng.fan(a)nxp.com> clk: imx: imx8mm: fix audio pll setting Gustavo A. R. Silva <gustavo(a)embeddedor.com> crypto: talitos - fix missing break in switch statement Tokunori Ikegami <ikegami.t(a)gmail.com> mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for HP X500 PIXART OEM mouse Alan Stern <stern(a)rowland.harvard.edu> HID: hidraw: Fix invalid read in hidraw_ioctl Hans de Goede <hdegoede(a)redhat.com> HID: logitech-dj: Fix crash when initial logi_dj_recv_query_paired_devices fails Alan Stern <stern(a)rowland.harvard.edu> HID: logitech: Fix general protection fault caused by Logitech driver Roderick Colenbrander <roderick.colenbrander(a)sony.com> HID: sony: Fix memory corruption issue on cleanup. Alan Stern <stern(a)rowland.harvard.edu> HID: prodikeys: Fix general protection fault during probe David S. Miller <davem(a)davemloft.net> Revert "net: hns: fix LED configuration for marvell phy" Nick Desaulniers <ndesaulniers(a)google.com> drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines Greg Kurz <groug(a)kaod.org> powerpc/xive: Fix bogus error code returned by OPAL Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Don't replace the dc_state for fast updates Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Skip determining update type for async updates Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Allow cursor async updates for framebuffer swaps Juliet Kim <julietk(a)linux.vnet.ibm.com> net/ibmvnic: free reset work of removed device from queue Bjorn Andersson <bjorn.andersson(a)linaro.org> phy: qcom-qmp: Correct ready status, again Marc Gonzalez <marc.w.gonzalez(a)free.fr> phy: qcom-qmp: Raise qcom_qmp_phy_enable() polling delay Steve French <stfrench(a)microsoft.com> smb3: fix unmount hang in open_shroot Marcel Holtmann <marcel(a)holtmann.org> Revert "Bluetooth: validate BLE connection interval updates" ------------- Diffstat: Makefile | 4 +- arch/powerpc/include/asm/opal.h | 2 +- arch/powerpc/platforms/powernv/opal-call.c | 2 +- arch/powerpc/sysdev/xive/native.c | 11 +++ drivers/acpi/acpi_video.c | 37 ++++++++++ drivers/bluetooth/btrtl.c | 20 +++++ drivers/bluetooth/btrtl.h | 6 ++ drivers/bluetooth/btusb.c | 4 + drivers/clk/imx/clk-imx8mm.c | 4 +- drivers/crypto/talitos.c | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 56 ++++++++++---- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 4 + drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + drivers/gpu/drm/drm_dp_helper.c | 4 +- drivers/gpu/drm/drm_probe_helper.c | 9 ++- drivers/gpu/drm/nouveau/dispnv50/head.c | 28 ++++++- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lg.c | 10 ++- drivers/hid/hid-lg4ff.c | 1 - drivers/hid/hid-logitech-dj.c | 10 +-- drivers/hid/hid-logitech-hidpp.c | 20 ----- drivers/hid/hid-prodikeys.c | 12 ++- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-sony.c | 2 +- drivers/hid/hidraw.c | 2 +- drivers/md/dm-zoned-target.c | 2 - drivers/mtd/chips/cfi_cmdset_0002.c | 18 +++-- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 23 +----- drivers/net/ethernet/ibm/ibmvnic.c | 9 ++- drivers/phy/qualcomm/phy-qcom-qmp.c | 33 ++++----- drivers/platform/x86/i2c-multi-instantiate.c | 2 +- fs/cifs/smb2ops.c | 21 +++--- fs/f2fs/segment.c | 44 +++++++++-- fs/xfs/libxfs/xfs_bmap.c | 29 ++++++-- include/drm/drm_dp_helper.h | 7 ++ mm/z3fold.c | 90 ----------------------- net/bluetooth/hci_event.c | 5 -- net/bluetooth/l2cap_core.c | 9 +-- net/ipv4/raw_diag.c | 3 - net/netfilter/nft_socket.c | 6 +- net/rds/bind.c | 40 +++++----- net/sched/sch_api.c | 2 + net/xfrm/xfrm_policy.c | 6 +- sound/firewire/dice/dice-alesis.c | 2 +- sound/pci/hda/hda_intel.c | 3 +- sound/pci/hda/patch_analog.c | 1 + sound/usb/quirks.c | 2 + tools/objtool/Makefile | 2 +- tools/testing/selftests/net/xfrm_policy.sh | 7 ++ 49 files changed, 349 insertions(+), 272 deletions(-)

5 years, 2 months

8
53
0 0

[PATCH] arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node"

by Marek Szyprowski

Commit ef72171b3621 ("arm64: dts: exynos: Remove unneeded address space mapping for soc node") changed the address and size cells in root node from 2 to 1, but /memory nodes for the affected boards were not updated. This went unnoticed on Exynos5433-based TM2(e) boards, because they use u-boot, which updates /memory node to the correct values. On the other hand, the mentioned commit broke boot on Exynos7-based Espresso board, which bootloader doesn't touch /memory node at all. This patch reverts commit ef72171b3621, so Exynos5433 and Exynos7 SoCs again matches other ARM64 platforms with 64bit mappings in root node. Reported-by: Alim Akhtar <alim.akhtar(a)samsung.com> Fixes: ef72171b3621 ("arm64: dts: exynos: Remove unneeded address space mapping for soc node") Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: <stable(a)vger.kernel.org> Tested-by: Alim Akhtar <alim.akhtar(a)samsung.com> --- A few more comments: 1. I've added 'tested-by' tag from Alim, as his original report pointed that reverting the offending commit fixes the boot issue. 2. This patch applies down to v4.18. 3. For v5.3 release, two patches: - "arm64: dts: exynos: Move GPU under /soc node for Exynos5433" - "arm64: dts: exynos: Move GPU under /soc node for Exynos7" has to be applied first to ensure that GPU node will have correct 'reg' property (nodes under /soc still use 32bit mappings). I'm not sure if this can be expressed somehow in stable porting tags. Best regards Marek Szyprowski Samsung R&D Institute Poland --- arch/arm64/boot/dts/exynos/exynos5433.dtsi | 6 +++--- arch/arm64/boot/dts/exynos/exynos7.dtsi | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/arm64/boot/dts/exynos/exynos5433.dtsi b/arch/arm64/boot/dts/exynos/exynos5433.dtsi index 239bf44d174b..f69530730219 100644 --- a/arch/arm64/boot/dts/exynos/exynos5433.dtsi +++ b/arch/arm64/boot/dts/exynos/exynos5433.dtsi @@ -18,8 +18,8 @@ / { compatible = "samsung,exynos5433"; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <2>; interrupt-parent = <&gic>; @@ -260,7 +260,7 @@ compatible = "simple-bus"; #address-cells = <1>; #size-cells = <1>; - ranges; + ranges = <0x0 0x0 0x0 0x18000000>; chipid@10000000 { compatible = "samsung,exynos4210-chipid"; diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi index f09800f355db..3a00ef0a17ff 100644 --- a/arch/arm64/boot/dts/exynos/exynos7.dtsi +++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi @@ -12,8 +12,8 @@ / { compatible = "samsung,exynos7"; interrupt-parent = <&gic>; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <2>; aliases { pinctrl0 = &pinctrl_alive; @@ -87,7 +87,7 @@ compatible = "simple-bus"; #address-cells = <1>; #size-cells = <1>; - ranges; + ranges = <0 0 0 0x18000000>; chipid@10000000 { compatible = "samsung,exynos4210-chipid"; -- 2.17.1

5 years, 2 months

3
2
0 0

[PATCH 5.3 00/25] 5.3.2-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.3.2 release. There are 25 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue 01 Oct 2019 01:47:47 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.2-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.3.2-rc1 Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Clobber user CFLAGS variable Heikki Krogerus <heikki.krogerus(a)linux.intel.com> platform/x86: i2c-multi-instantiate: Derive the device name from parent Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Apply AMD controller workaround for Raven platform Shih-Yuan Lee (FourDollars) <fourdollars(a)debian.org> ALSA: hda - Add laptop imic fixup for ASUS M9V laptop Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: fix wrong packet parameter for Alesis iO26 Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Add DSD support for EVGA NU Audio Ilya Pshonkin <sudokamikaze(a)protonmail.com> ALSA: usb-audio: Add Hiby device family to quirks for native DSD support Vitaly Wool <vitalywool(a)gmail.com> Revert "mm/z3fold.c: fix race between migration and destruction" Peng Fan <peng.fan(a)nxp.com> clk: imx: imx8mm: fix audio pll setting Gustavo A. R. Silva <gustavo(a)embeddedor.com> crypto: talitos - fix missing break in switch statement Tokunori Ikegami <ikegami.t(a)gmail.com> mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for HP X500 PIXART OEM mouse Alan Stern <stern(a)rowland.harvard.edu> HID: hidraw: Fix invalid read in hidraw_ioctl Hans de Goede <hdegoede(a)redhat.com> HID: logitech-dj: Fix crash when initial logi_dj_recv_query_paired_devices fails Alan Stern <stern(a)rowland.harvard.edu> HID: logitech: Fix general protection fault caused by Logitech driver Roderick Colenbrander <roderick.colenbrander(a)sony.com> HID: sony: Fix memory corruption issue on cleanup. Alan Stern <stern(a)rowland.harvard.edu> HID: prodikeys: Fix general protection fault during probe Greg Kurz <groug(a)kaod.org> powerpc/xive: Fix bogus error code returned by OPAL Nick Desaulniers <ndesaulniers(a)google.com> drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Don't replace the dc_state for fast updates Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Skip determining update type for async updates Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Allow cursor async updates for framebuffer swaps Jon Hunter <jonathanh(a)nvidia.com> clocksource/drivers: Do not warn on probe defer Jon Hunter <jonathanh(a)nvidia.com> clocksource/drivers/timer-of: Do not warn on deferred probe Jeremy Sowden <jeremy(a)azazel.net> netfilter: add missing IS_ENABLED(CONFIG_NF_TABLES) check to header-file. ------------- Diffstat: Makefile | 4 +- arch/powerpc/include/asm/opal.h | 2 +- arch/powerpc/platforms/powernv/opal-call.c | 2 +- arch/powerpc/sysdev/xive/native.c | 11 +++ drivers/clk/imx/clk-imx8mm.c | 4 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-probe.c | 4 +- drivers/crypto/talitos.c | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 56 ++++++++++---- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 4 + drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 4 + drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + drivers/gpu/drm/amd/display/dc/dsc/Makefile | 4 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lg.c | 10 ++- drivers/hid/hid-lg4ff.c | 1 - drivers/hid/hid-logitech-dj.c | 10 +-- drivers/hid/hid-prodikeys.c | 12 ++- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-sony.c | 2 +- drivers/hid/hidraw.c | 2 +- drivers/mtd/chips/cfi_cmdset_0002.c | 18 +++-- drivers/platform/x86/i2c-multi-instantiate.c | 2 +- include/net/netfilter/nf_tables.h | 4 + mm/z3fold.c | 90 ----------------------- sound/firewire/dice/dice-alesis.c | 2 +- sound/pci/hda/hda_intel.c | 3 +- sound/pci/hda/patch_analog.c | 1 + sound/usb/quirks.c | 2 + tools/objtool/Makefile | 2 +- 30 files changed, 130 insertions(+), 139 deletions(-)

5 years, 2 months

5
33
0 0

[PATCH] btrfs: fix incorrect updating of log root tree

by Josef Bacik

We've historically had reports of being unable to mount file systems because the tree log root couldn't be read. Usually this is the "parent transid failure", but could be any of the related errors, including "fsid mismatch" or "bad tree block", depending on which block got allocated. The modification of the individual log root items are serialized on the per-log root root_mutex. This means that any modification to the per-subvol log root_item is completely protected. However we update the root item in the log root tree outside of the log root tree log_mutex. We do this in order to allow multiple subvolumes to be updated in each log transaction. This is problematic however because when we are writing the log root tree out we update the super block with the _current_ log root node information. Since these two operations happen independently of each other, you can end up updating the log root tree in between writing out the dirty blocks and setting the super block to point at the current root. This means we'll point at the new root node that hasn't been written out, instead of the one we should be pointing at. Thus whatever garbage or old block we end up pointing at complains when we mount the file system later and try to replay the log. Fix this by copying the log's root item into a local root item copy. Then once we're safely under the log_root_tree->log_mutex we update the root item in the log_root_tree. This way we do not modify the log_root_tree while we're committing it, fixing the problem. cc: stable(a)vger.kernel.org Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Chris Mason <clm(a)fb.com> --- fs/btrfs/tree-log.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index 7cac09a6f007..1d7f22951ef2 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -2908,7 +2908,8 @@ static int walk_log_tree(struct btrfs_trans_handle *trans, * in the tree of log roots */ static int update_log_root(struct btrfs_trans_handle *trans, - struct btrfs_root *log) + struct btrfs_root *log, + struct btrfs_root_item *root_item) { struct btrfs_fs_info *fs_info = log->fs_info; int ret; @@ -2916,10 +2917,10 @@ static int update_log_root(struct btrfs_trans_handle *trans, if (log->log_transid == 1) { /* insert root item on the first sync */ ret = btrfs_insert_root(trans, fs_info->log_root_tree, - &log->root_key, &log->root_item); + &log->root_key, root_item); } else { ret = btrfs_update_root(trans, fs_info->log_root_tree, - &log->root_key, &log->root_item); + &log->root_key, root_item); } return ret; } @@ -3017,6 +3018,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, struct btrfs_fs_info *fs_info = root->fs_info; struct btrfs_root *log = root->log_root; struct btrfs_root *log_root_tree = fs_info->log_root_tree; + struct btrfs_root_item new_root_item; int log_transid = 0; struct btrfs_log_ctx root_log_ctx; struct blk_plug plug; @@ -3080,17 +3082,25 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, goto out; } + /* + * We _must_ update under the root->log_mutex in order to make sure we + * have a consistent view of the log root we are trying to commit at + * this moment. + * + * We _must_ copy this into a local copy, because we are not holding the + * log_root_tree->log_mutex yet. This is important because when we + * commit the log_root_tree we must have a consistent view of the + * log_root_tree when we update the super block to point at the + * log_root_tree bytenr. If we update the log_root_tree here we'll race + * with the commit and possibly point at the new block which we may not + * have written out. + */ btrfs_set_root_node(&log->root_item, log->node); + memcpy(&new_root_item, &log->root_item, sizeof(new_root_item)); root->log_transid++; log->log_transid = root->log_transid; root->log_start_pid = 0; - /* - * Update or create log root item under the root's log_mutex to prevent - * races with concurrent log syncs that can lead to failure to update - * log root item because it was not created yet. - */ - ret = update_log_root(trans, log); /* * IO has been started, blocks of the log tree have WRITTEN flag set * in their headers. new modifications of the log will be written to @@ -3111,6 +3121,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, mutex_unlock(&log_root_tree->log_mutex); mutex_lock(&log_root_tree->log_mutex); + + /* + * Now we are safe to update the log_root_tree because we're under the + * log_mutex, and we're a current writer so we're holding the commit + * open until we drop the log_mutex. + */ + ret = update_log_root(trans, log, &new_root_item); + if (atomic_dec_and_test(&log_root_tree->log_writers)) { /* atomic_dec_and_test implies a barrier */ cond_wake_up_nomb(&log_root_tree->log_writer_wait); -- 2.21.0

5 years, 2 months

3
2
0 0

[PATCH AUTOSEL 4.19 001/128] ALSA: hda: Flush interrupts on disabling

by Sasha Levin

From: Chris Wilson <chris(a)chris-wilson.co.uk> [ Upstream commit caa8422d01e983782548648e125fd617cadcec3f ] I was looking at <4> [241.835158] general protection fault: 0000 [#1] PREEMPT SMP PTI <4> [241.835181] CPU: 1 PID: 214 Comm: kworker/1:3 Tainted: G U 5.2.0-CI-CI_DRM_6509+ #1 <4> [241.835199] Hardware name: Dell Inc. OptiPlex 745 /0GW726, BIOS 2.3.1 05/21/2007 <4> [241.835234] Workqueue: events snd_hdac_bus_process_unsol_events [snd_hda_core] <4> [241.835256] RIP: 0010:input_handle_event+0x16d/0x5e0 <4> [241.835270] Code: 48 8b 93 58 01 00 00 8b 52 08 89 50 04 8b 83 f8 06 00 00 48 8b 93 00 07 00 00 8d 70 01 48 8d 04 c2 83 e1 08 89 b3 f8 06 00 00 <66> 89 28 66 44 89 60 02 44 89 68 04 8b 93 f8 06 00 00 0f 84 fd fe <4> [241.835304] RSP: 0018:ffffc9000019fda0 EFLAGS: 00010046 <4> [241.835317] RAX: 6b6b6b6ec6c6c6c3 RBX: ffff8880290fefc8 RCX: 0000000000000000 <4> [241.835332] RDX: 000000006b6b6b6b RSI: 000000006b6b6b6c RDI: 0000000000000046 <4> [241.835347] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000001 <4> [241.835362] R10: ffffc9000019faa0 R11: 0000000000000000 R12: 0000000000000004 <4> [241.835377] R13: 0000000000000000 R14: ffff8880290ff1d0 R15: 0000000000000293 <4> [241.835392] FS: 0000000000000000(0000) GS:ffff88803de80000(0000) knlGS:0000000000000000 <4> [241.835409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [241.835422] CR2: 00007ffe9a99e9b7 CR3: 000000002f588000 CR4: 00000000000006e0 <4> [241.835436] Call Trace: <4> [241.835449] input_event+0x45/0x70 <4> [241.835464] snd_jack_report+0xdc/0x100 <4> [241.835490] snd_hda_jack_report_sync+0x83/0xc0 [snd_hda_codec] <4> [241.835512] snd_hdac_bus_process_unsol_events+0x5a/0x70 [snd_hda_core] <4> [241.835530] process_one_work+0x245/0x610 which has the hallmarks of a worker queued from interrupt after it was supposedly cancelled (note the POISON_FREE), and I could not see where the interrupt would be flushed on shutdown so added the likely suspects. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111174 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/hda/hdac_controller.c | 2 ++ sound/pci/hda/hda_intel.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c index 74244d8e29090..e858b6fa0c3ad 100644 --- a/sound/hda/hdac_controller.c +++ b/sound/hda/hdac_controller.c @@ -443,6 +443,8 @@ static void azx_int_disable(struct hdac_bus *bus) list_for_each_entry(azx_dev, &bus->stream_list, list) snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); + synchronize_irq(bus->irq); + /* disable SIE for all streams */ snd_hdac_chip_writeb(bus, INTCTL, 0); diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index c3e3d80ff7203..2b8edd343f393 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -1455,9 +1455,9 @@ static int azx_free(struct azx *chip) } if (bus->chip_init) { + azx_stop_chip(chip); azx_clear_irq_pending(chip); azx_stop_all_streams(chip); - azx_stop_chip(chip); } if (bus->irq >= 0) -- 2.20.1

5 years, 2 months

2
129
0 0

[PATCH 02/15] RDMA/iwcm: Fix a lock inversion issue

by Bart Van Assche

This patch fixes the lock inversion complaint: ============================================ WARNING: possible recursive locking detected 5.3.0-rc7-dbg+ #1 Not tainted -------------------------------------------- kworker/u16:6/171 is trying to acquire lock: 00000000035c6e6c (&id_priv->handler_mutex){+.+.}, at: rdma_destroy_id+0x78/0x4a0 [rdma_cm] but task is already holding lock: 00000000bc7c307d (&id_priv->handler_mutex){+.+.}, at: iw_conn_req_handler+0x151/0x680 [rdma_cm] other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&id_priv->handler_mutex); lock(&id_priv->handler_mutex); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by kworker/u16:6/171: #0: 00000000e2eaa773 ((wq_completion)iw_cm_wq){+.+.}, at: process_one_work+0x472/0xac0 #1: 000000001efd357b ((work_completion)(&work->work)#3){+.+.}, at: process_one_work+0x476/0xac0 #2: 00000000bc7c307d (&id_priv->handler_mutex){+.+.}, at: iw_conn_req_handler+0x151/0x680 [rdma_cm] stack backtrace: CPU: 3 PID: 171 Comm: kworker/u16:6 Not tainted 5.3.0-rc7-dbg+ #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: iw_cm_wq cm_work_handler [iw_cm] Call Trace: dump_stack+0x8a/0xd6 __lock_acquire.cold+0xe1/0x24d lock_acquire+0x106/0x240 __mutex_lock+0x12e/0xcb0 mutex_lock_nested+0x1f/0x30 rdma_destroy_id+0x78/0x4a0 [rdma_cm] iw_conn_req_handler+0x5c9/0x680 [rdma_cm] cm_work_handler+0xe62/0x1100 [iw_cm] process_one_work+0x56d/0xac0 worker_thread+0x7a/0x5d0 kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Cc: Or Gerlitz <gerlitz.or(a)gmail.com> Cc: Steve Wise <larrystevenwise(a)gmail.com> Cc: Sagi Grimberg <sagi(a)grimberg.me> Cc: Bernard Metzler <BMT(a)zurich.ibm.com> Cc: Krishnamraju Eraparaju <krishna2(a)chelsio.com> Cc: <stable(a)vger.kernel.org> Fixes: de910bd92137 ("RDMA/cma: Simplify locking needed for serialization of callbacks"; v2.6.27). Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 0e3cf3461999..d78f67623f24 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2396,9 +2396,10 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id, conn_id->cm_id.iw = NULL; cma_exch(conn_id, RDMA_CM_DESTROYING); mutex_unlock(&conn_id->handler_mutex); + mutex_unlock(&listen_id->handler_mutex); cma_deref_id(conn_id); rdma_destroy_id(&conn_id->id); - goto out; + return ret; } mutex_unlock(&conn_id->handler_mutex); -- 2.23.0.444.g18eeb5a265-goog

5 years, 2 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2019