December 2021 - Linux-stable-mirror

[PATCH 5.10.y] drm/cirrus: fix a NULL vs IS_ERR() checks

by Shile Zhang

The function drm_gem_shmem_vmap can returns error pointers as well, which could cause following kernel crash: BUG: unable to handle page fault for address: fffffffffffffffc PGD 1426a12067 P4D 1426a12067 PUD 1426a14067 PMD 0 Oops: 0000 [#1] SMP NOPTI CPU: 12 PID: 3598532 Comm: stress-ng Kdump: loaded Not tainted 5.10.50.x86_64 #1 ... RIP: 0010:memcpy_toio+0x23/0x50 Code: 00 00 00 00 0f 1f 00 0f 1f 44 00 00 48 85 d2 74 28 40 f6 c7 01 75 2b 48 83 fa 01 76 06 40 f6 c7 02 75 17 48 89 d1 48 c1 e9 02 <f3> a5 f6 c2 02 74 02 66 a5 f6 c2 01 74 01 a4 c3 66 a5 48 83 ea 02 RSP: 0018:ffffafbf8a203c68 EFLAGS: 00010216 RAX: 0000000000000000 RBX: fffffffffffffffc RCX: 0000000000000200 RDX: 0000000000000800 RSI: fffffffffffffffc RDI: ffffafbf82000000 RBP: ffffafbf82000000 R08: 0000000000000002 R09: 0000000000000000 R10: 00000000000002b5 R11: 0000000000000000 R12: 0000000000000800 R13: ffff8a6801099300 R14: 0000000000000001 R15: 0000000000000300 FS: 00007f4a6bc5f740(0000) GS:ffff8a8641900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffffc CR3: 00000016d3874001 CR4: 00000000003606e0 Call Trace: drm_fb_memcpy_dstclip+0x5e/0x80 [drm_kms_helper] cirrus_fb_blit_rect.isra.0+0xb7/0xe0 [cirrus] cirrus_pipe_update+0x9f/0xa8 [cirrus] drm_atomic_helper_commit_planes+0xb8/0x220 [drm_kms_helper] drm_atomic_helper_commit_tail+0x42/0x80 [drm_kms_helper] commit_tail+0xce/0x130 [drm_kms_helper] drm_atomic_helper_commit+0x113/0x140 [drm_kms_helper] drm_client_modeset_commit_atomic+0x1c4/0x200 [drm] drm_client_modeset_commit_locked+0x53/0x80 [drm] drm_client_modeset_commit+0x24/0x40 [drm] drm_fbdev_client_restore+0x48/0x85 [drm_kms_helper] drm_client_dev_restore+0x64/0xb0 [drm] drm_release+0xf2/0x110 [drm] __fput+0x96/0x240 task_work_run+0x5c/0x90 exit_to_user_mode_loop+0xce/0xd0 exit_to_user_mode_prepare+0x6a/0x70 syscall_exit_to_user_mode+0x12/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f4a6bd82c2b Fixes: ab3e023b1b4c9 ("drm/cirrus: rewrite and modernize driver.") CC: stable(a)vger.kernel.org Reported-by: Wen Kang <kw01107137(a)alibaba-inc.com> Signed-off-by: Shile Zhang <shile.zhang(a)linux.alibaba.com> --- drivers/gpu/drm/tiny/cirrus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tiny/cirrus.c b/drivers/gpu/drm/tiny/cirrus.c index 744a8e337e41..d64f6bb767ee 100644 --- a/drivers/gpu/drm/tiny/cirrus.c +++ b/drivers/gpu/drm/tiny/cirrus.c @@ -323,7 +323,7 @@ static int cirrus_fb_blit_rect(struct drm_framebuffer *fb, ret = -ENOMEM; vmap = drm_gem_shmem_vmap(fb->obj[0]); - if (!vmap) + if (IS_ERR_OR_NULL(vmap)) goto out_dev_exit; if (cirrus->cpp == fb->format->cpp[0]) -- 2.33.0.rc2

2 years, 8 months

2
10
0 0

[PATCH 01/12] kexec: Allow architecture code to opt-out at runtime

by Joerg Roedel

From: Joerg Roedel <jroedel(a)suse.de> Allow a runtime opt-out of kexec support for architecture code in case the kernel is running in an environment where kexec is not properly supported yet. This will be used on x86 when the kernel is running as an SEV-ES guest. SEV-ES guests need special handling for kexec to hand over all CPUs to the new kernel. This requires special hypervisor support and handling code in the guest which is not yet implemented. Cc: stable(a)vger.kernel.org # v5.10+ Signed-off-by: Joerg Roedel <jroedel(a)suse.de> --- include/linux/kexec.h | 1 + kernel/kexec.c | 14 ++++++++++++++ kernel/kexec_file.c | 9 +++++++++ 3 files changed, 24 insertions(+) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 0c994ae37729..85c30dcd0bdc 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -201,6 +201,7 @@ int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf, unsigned long buf_len); #endif int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf); +bool arch_kexec_supported(void); extern int kexec_add_buffer(struct kexec_buf *kbuf); int kexec_locate_mem_hole(struct kexec_buf *kbuf); diff --git a/kernel/kexec.c b/kernel/kexec.c index c82c6c06f051..d03134160458 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -195,11 +195,25 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments, * that to happen you need to do that yourself. */ +bool __weak arch_kexec_supported(void) +{ + return true; +} + static inline int kexec_load_check(unsigned long nr_segments, unsigned long flags) { int result; + /* + * The architecture may support kexec in general, but the kernel could + * run in an environment where it is not (yet) possible to execute a new + * kernel. Allow the architecture code to opt-out of kexec support when + * it is running in such an environment. + */ + if (!arch_kexec_supported()) + return -ENOSYS; + /* We only trust the superuser with rebooting the system. */ if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 33400ff051a8..96d08a512e9c 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -358,6 +358,15 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, int ret = 0, i; struct kimage **dest_image, *image; + /* + * The architecture may support kexec in general, but the kernel could + * run in an environment where it is not (yet) possible to execute a new + * kernel. Allow the architecture code to opt-out of kexec support when + * it is running in such an environment. + */ + if (!arch_kexec_supported()) + return -ENOSYS; + /* We only trust the superuser with rebooting the system. */ if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; -- 2.31.1

2 years, 8 months

2
1
0 0

[PATCH] mmc: sdhci-xenon: fix 1.8v regulator stabilization

by Marcin Wojtas

From: Alex Leibovich <alexl(a)marvell.com> Automatic Clock Gating is a feature used for the power consumption optimisation. It turned out that during early init phase it may prevent the stable voltage switch to 1.8V - due to that on some platfroms an endless printout in dmesg can be observed: "mmc1: 1.8V regulator output did not became stable" Fix the problem by disabling the ACG at very beginning of the sdhci_init and let that be enabled later. Fixes: 3a3748dba881 ("mmc: sdhci-xenon: Add Marvell Xenon SDHC core functionality") Signed-off-by: Alex Leibovich <alexl(a)marvell.com> Signed-off-by: Marcin Wojtas <mw(a)semihalf.com> Cc: stable(a)vger.kernel.org --- drivers/mmc/host/sdhci-xenon.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c index c67611fdaa8a..4b05f6fdefb4 100644 --- a/drivers/mmc/host/sdhci-xenon.c +++ b/drivers/mmc/host/sdhci-xenon.c @@ -168,7 +168,12 @@ static void xenon_reset_exit(struct sdhci_host *host, /* Disable tuning request and auto-retuning again */ xenon_retune_setup(host); - xenon_set_acg(host, true); + /* + * The ACG should be turned off at the early init time, in order + * to solve a possile issues with the 1.8V regulator stabilization. + * The feature is enabled in later stage. + */ + xenon_set_acg(host, false); xenon_set_sdclk_off_idle(host, sdhc_id, false); -- 2.29.0

2 years, 9 months

4
10
0 0

[PATCH -next] jffs2: fix use-after-free in jffs2_clear_xattr_subsystem

by Baokun Li

When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: ================================================================== BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8 which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of 48-byte region [ffff8881243384b8, ffff8881243384e8) [...] ================================================================== The triggering of the BUG is shown in the following stack: ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock <--- ERROR jffs2_clear_xattr_subsystem <--- free jffs2_clear_xattr_subsystem <--- free again ----------------------------------------------------------- An error is returned in jffs2_do_mount_fs(). If the error is returned by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to be executed. If the error is returned by jffs2_build_filesystem(), the jffs2_clear_xattr_subsystem() also does not need to be executed again. So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root' to fix this UAF problem. Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version. 5)") Cc: stable(a)vger.kernel.org Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jffs2/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c index 2ac410477c4f..71f03a5d36ed 100644 --- a/fs/jffs2/fs.c +++ b/fs/jffs2/fs.c @@ -603,8 +603,8 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc) jffs2_free_ino_caches(c); jffs2_free_raw_node_refs(c); kvfree(c->blocks); - out_inohash: jffs2_clear_xattr_subsystem(c); + out_inohash: kfree(c->inocache_list); out_wbuf: jffs2_flash_cleanup(c); -- 2.31.1

2 years, 9 months

3
4
0 0

[tip: irq/urgent] PCI/MSI: Mask MSI-X vectors only on success

by tip-bot2 for Stefan Roese

The following commit has been merged into the irq/urgent branch of tip: Commit-ID: 83dbf898a2d45289be875deb580e93050ba67529 Gitweb: https://git.kernel.org/tip/83dbf898a2d45289be875deb580e93050ba67529 Author: Stefan Roese <sr(a)denx.de> AuthorDate: Tue, 14 Dec 2021 12:49:32 +01:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Tue, 14 Dec 2021 13:23:32 +01:00 PCI/MSI: Mask MSI-X vectors only on success Masking all unused MSI-X entries is done to ensure that a crash kernel starts from a clean slate, which correponds to the reset state of the device as defined in the PCI-E specificion 3.0 and later: Vector Control for MSI-X Table Entries -------------------------------------- "00: Mask bit: When this bit is set, the function is prohibited from sending a message using this MSI-X Table entry. ... This bit’s state after reset is 1 (entry is masked)." A Marvell NVME device fails to deliver MSI interrupts after trying to enable MSI-X interrupts due to that masking. It seems to take the MSI-X mask bits into account even when MSI-X is disabled. While not specification compliant, this can be cured by moving the masking into the success path, so that the MSI-X table entries stay in device reset state when the MSI-X setup fails. [ tglx: Move it into the success path, add comment and amend changelog ] Fixes: aa8092c1d1f1 ("PCI/MSI: Mask all unused MSI-X entries") Signed-off-by: Stefan Roese <sr(a)denx.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: linux-pci(a)vger.kernel.org Cc: Bjorn Helgaas <bhelgaas(a)google.com> Cc: Michal Simek <michal.simek(a)xilinx.com> Cc: Marek Vasut <marex(a)denx.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20211210161025.3287927-1-sr@denx.de --- drivers/pci/msi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 48e3f4e..6748cf9 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -722,9 +722,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, goto out_disable; } - /* Ensure that all table entries are masked. */ - msix_mask_all(base, tsize); - ret = msix_setup_entries(dev, base, entries, nvec, affd); if (ret) goto out_disable; @@ -751,6 +748,16 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, /* Set MSI-X enabled bits and unmask the function */ pci_intx_for_msi(dev, 0); dev->msix_enabled = 1; + + /* + * Ensure that all table entries are masked to prevent + * stale entries from firing in a crash kernel. + * + * Done late to deal with a broken Marvell NVME device + * which takes the MSI-X mask bits into account even + * when MSI-X is disabled, which prevents MSI delivery. + */ + msix_mask_all(base, tsize); pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0); pcibios_free_irq(dev);

2 years, 9 months

4
3
0 0

FAILED: patch "[PATCH] bpf: Fix toctou on read-only map's constant scalar tracking" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 353050be4c19e102178ccc05988101887c25ae53 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann <daniel(a)iogearbox.net> Date: Tue, 9 Nov 2021 18:48:08 +0000 Subject: [PATCH] bpf: Fix toctou on read-only map's constant scalar tracking Commit a23740ec43ba ("bpf: Track contents of read-only maps as scalars") is checking whether maps are read-only both from BPF program side and user space side, and then, given their content is constant, reading out their data via map->ops->map_direct_value_addr() which is then subsequently used as known scalar value for the register, that is, it is marked as __mark_reg_known() with the read value at verification time. Before a23740ec43ba, the register content was marked as an unknown scalar so the verifier could not make any assumptions about the map content. The current implementation however is prone to a TOCTOU race, meaning, the value read as known scalar for the register is not guaranteed to be exactly the same at a later point when the program is executed, and as such, the prior made assumptions of the verifier with regards to the program will be invalid which can cause issues such as OOB access, etc. While the BPF_F_RDONLY_PROG map flag is always fixed and required to be specified at map creation time, the map->frozen property is initially set to false for the map given the map value needs to be populated, e.g. for global data sections. Once complete, the loader "freezes" the map from user space such that no subsequent updates/deletes are possible anymore. For the rest of the lifetime of the map, this freeze one-time trigger cannot be undone anymore after a successful BPF_MAP_FREEZE cmd return. Meaning, any new BPF_* cmd calls which would update/delete map entries will be rejected with -EPERM since map_get_sys_perms() removes the FMODE_CAN_WRITE permission. This also means that pending update/delete map entries must still complete before this guarantee is given. This corner case is not an issue for loaders since they create and prepare such program private map in successive steps. However, a malicious user is able to trigger this TOCTOU race in two different ways: i) via userfaultfd, and ii) via batched updates. For i) userfaultfd is used to expand the competition interval, so that map_update_elem() can modify the contents of the map after map_freeze() and bpf_prog_load() were executed. This works, because userfaultfd halts the parallel thread which triggered a map_update_elem() at the time where we copy key/value from the user buffer and this already passed the FMODE_CAN_WRITE capability test given at that time the map was not "frozen". Then, the main thread performs the map_freeze() and bpf_prog_load(), and once that had completed successfully, the other thread is woken up to complete the pending map_update_elem() which then changes the map content. For ii) the idea of the batched update is similar, meaning, when there are a large number of updates to be processed, it can increase the competition interval between the two. It is therefore possible in practice to modify the contents of the map after executing map_freeze() and bpf_prog_load(). One way to fix both i) and ii) at the same time is to expand the use of the map's map->writecnt. The latter was introduced in fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY") and further refined in 1f6cb19be2e2 ("bpf: Prevent re-mmap()'ing BPF map as writable for initially r/o mapping") with the rationale to make a writable mmap()'ing of a map mutually exclusive with read-only freezing. The counter indicates writable mmap() mappings and then prevents/fails the freeze operation. Its semantics can be expanded beyond just mmap() by generally indicating ongoing write phases. This would essentially span any parallel regular and batched flavor of update/delete operation and then also have map_freeze() fail with -EBUSY. For the check_mem_access() in the verifier we expand upon the bpf_map_is_rdonly() check ensuring that all last pending writes have completed via bpf_map_write_active() test. Once the map->frozen is set and bpf_map_write_active() indicates a map->writecnt of 0 only then we are really guaranteed to use the map's data as known constants. For map->frozen being set and pending writes in process of still being completed we fall back to marking that register as unknown scalar so we don't end up making assumptions about it. With this, both TOCTOU reproducers from i) and ii) are fixed. Note that the map->writecnt has been converted into a atomic64 in the fix in order to avoid a double freeze_mutex mutex_{un,}lock() pair when updating map->writecnt in the various map update/delete BPF_* cmd flavors. Spanning the freeze_mutex over entire map update/delete operations in syscall side would not be possible due to then causing everything to be serialized. Similarly, something like synchronize_rcu() after setting map->frozen to wait for update/deletes to complete is not possible either since it would also have to span the user copy which can sleep. On the libbpf side, this won't break d66562fba1ce ("libbpf: Add BPF object skeleton support") as the anonymous mmap()-ed "map initialization image" is remapped as a BPF map-backed mmap()-ed memory where for .rodata it's non-writable. Fixes: a23740ec43ba ("bpf: Track contents of read-only maps as scalars") Reported-by: w1tcher.bupt(a)gmail.com Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> diff --git a/include/linux/bpf.h b/include/linux/bpf.h index f715e8863f4d..e7a163a3146b 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -193,7 +193,7 @@ struct bpf_map { atomic64_t usercnt; struct work_struct work; struct mutex freeze_mutex; - u64 writecnt; /* writable mmap cnt; protected by freeze_mutex */ + atomic64_t writecnt; }; static inline bool map_value_has_spin_lock(const struct bpf_map *map) @@ -1419,6 +1419,7 @@ void bpf_map_put(struct bpf_map *map); void *bpf_map_area_alloc(u64 size, int numa_node); void *bpf_map_area_mmapable_alloc(u64 size, int numa_node); void bpf_map_area_free(void *base); +bool bpf_map_write_active(const struct bpf_map *map); void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr); int generic_map_lookup_batch(struct bpf_map *map, const union bpf_attr *attr, diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 50f96ea4452a..1033ee8c0caf 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -132,6 +132,21 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) return map; } +static void bpf_map_write_active_inc(struct bpf_map *map) +{ + atomic64_inc(&map->writecnt); +} + +static void bpf_map_write_active_dec(struct bpf_map *map) +{ + atomic64_dec(&map->writecnt); +} + +bool bpf_map_write_active(const struct bpf_map *map) +{ + return atomic64_read(&map->writecnt) != 0; +} + static u32 bpf_map_value_size(const struct bpf_map *map) { if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH || @@ -601,11 +616,8 @@ static void bpf_map_mmap_open(struct vm_area_struct *vma) { struct bpf_map *map = vma->vm_file->private_data; - if (vma->vm_flags & VM_MAYWRITE) { - mutex_lock(&map->freeze_mutex); - map->writecnt++; - mutex_unlock(&map->freeze_mutex); - } + if (vma->vm_flags & VM_MAYWRITE) + bpf_map_write_active_inc(map); } /* called for all unmapped memory region (including initial) */ @@ -613,11 +625,8 @@ static void bpf_map_mmap_close(struct vm_area_struct *vma) { struct bpf_map *map = vma->vm_file->private_data; - if (vma->vm_flags & VM_MAYWRITE) { - mutex_lock(&map->freeze_mutex); - map->writecnt--; - mutex_unlock(&map->freeze_mutex); - } + if (vma->vm_flags & VM_MAYWRITE) + bpf_map_write_active_dec(map); } static const struct vm_operations_struct bpf_map_default_vmops = { @@ -668,7 +677,7 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) goto out; if (vma->vm_flags & VM_MAYWRITE) - map->writecnt++; + bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); return err; @@ -1139,6 +1148,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; @@ -1174,6 +1184,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr) free_key: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1196,6 +1207,7 @@ static int map_delete_elem(union bpf_attr *attr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; @@ -1226,6 +1238,7 @@ static int map_delete_elem(union bpf_attr *attr) out: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1533,6 +1546,7 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ) || !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; @@ -1597,6 +1611,7 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr) free_key: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1624,8 +1639,7 @@ static int map_freeze(const union bpf_attr *attr) } mutex_lock(&map->freeze_mutex); - - if (map->writecnt) { + if (bpf_map_write_active(map)) { err = -EBUSY; goto err_put; } @@ -4171,6 +4185,9 @@ static int bpf_map_do_batch(const union bpf_attr *attr, union bpf_attr __user *uattr, int cmd) { + bool has_read = cmd == BPF_MAP_LOOKUP_BATCH || + cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH; + bool has_write = cmd != BPF_MAP_LOOKUP_BATCH; struct bpf_map *map; int err, ufd; struct fd f; @@ -4183,16 +4200,13 @@ static int bpf_map_do_batch(const union bpf_attr *attr, map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); - - if ((cmd == BPF_MAP_LOOKUP_BATCH || - cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH) && - !(map_get_sys_perms(map, f) & FMODE_CAN_READ)) { + if (has_write) + bpf_map_write_active_inc(map); + if (has_read && !(map_get_sys_perms(map, f) & FMODE_CAN_READ)) { err = -EPERM; goto err_put; } - - if (cmd != BPF_MAP_LOOKUP_BATCH && - !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { + if (has_write && !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; } @@ -4205,8 +4219,9 @@ static int bpf_map_do_batch(const union bpf_attr *attr, BPF_DO_BATCH(map->ops->map_update_batch); else BPF_DO_BATCH(map->ops->map_delete_batch); - err_put: + if (has_write) + bpf_map_write_active_dec(map); fdput(f); return err; } diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 65d2f93b7030..50efda51515b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4056,7 +4056,22 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size) static bool bpf_map_is_rdonly(const struct bpf_map *map) { - return (map->map_flags & BPF_F_RDONLY_PROG) && map->frozen; + /* A map is considered read-only if the following condition are true: + * + * 1) BPF program side cannot change any of the map content. The + * BPF_F_RDONLY_PROG flag is throughout the lifetime of a map + * and was set at map creation time. + * 2) The map value(s) have been initialized from user space by a + * loader and then "frozen", such that no new map update/delete + * operations from syscall side are possible for the rest of + * the map's lifetime from that point onwards. + * 3) Any parallel/pending map update/delete operations from syscall + * side have been completed. Only after that point, it's safe to + * assume that map value(s) are immutable. + */ + return (map->map_flags & BPF_F_RDONLY_PROG) && + READ_ONCE(map->frozen) && + !bpf_map_write_active(map); } static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val)

2 years, 9 months

5
10
0 0

[PATCH 4.19 000/247] 4.19.178-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.178 release. There are 247 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.178-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.178-rc1 Takeshi Misawa <jeliantsurux(a)gmail.com> net: qrtr: Fix memory leak in qrtr_tun_open Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Update in-core bitset after committing the metadata Jason A. Donenfeld <Jason(a)zx2c4.com> net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending Leon Romanovsky <leonro(a)nvidia.com> ipv6: silence compilation warning for non-IPV6 builds Eric Dumazet <edumazet(a)google.com> ipv6: icmp6: avoid indirect call for icmpv6_send() Jason A. Donenfeld <Jason(a)zx2c4.com> xfrm: interface: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> sunvnet: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> gtp: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> icmp: introduce helper for nat'd source address in network device context Nikos Tsironis <ntsironis(a)arrikto.com> dm era: only resize metadata in preresume Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Reinitialize bitset cache before digesting a new writeset Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Use correct value size in equality function of writeset tree Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Fix bitset memory leaks Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Verify the data block size hasn't changed Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Recover committed writeset after crash Mikulas Patocka <mpatocka(a)redhat.com> dm: fix deadlock when swapping to encrypted device Bob Peterson <rpeterso(a)redhat.com> gfs2: Don't skip dlm unlock if glock has an lvb Al Viro <viro(a)zeniv.linux.org.uk> sparc32: fix a user-triggerable oops in clear_user() Chao Yu <yuchao0(a)huawei.com> f2fs: fix out-of-repair __setattr_copy() Chen Yu <yu.c.chen(a)intel.com> cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available Muchun Song <songmuchun(a)bytedance.com> printk: fix deadlock when kernel panic Maxim Kiselev <bigunclemax(a)gmail.com> gpio: pcf857x: Fix missing first interrupt Frank Li <Frank.Li(a)nxp.com> mmc: sdhci-esdhc-imx: fix kernel panic when remove module Fangrui Song <maskray(a)google.com> module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols Suzuki K Poulose <suzuki.poulose(a)arm.com> arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55 Dan Williams <dan.j.williams(a)intel.com> libnvdimm/dimm: Avoid race between probe and available_slots_show() Mike Kravetz <mike.kravetz(a)oracle.com> hugetlb: fix copy_huge_page_from_user contig page struct assumption NeilBrown <neilb(a)suse.de> x86: fix seq_file iteration for pat/memtype.c NeilBrown <neilb(a)suse.de> seq_file: document how per-entry resources are managed. Pan Bian <bianpan2016(a)163.com> fs/affs: release old buffer head on error path Pan Bian <bianpan2016(a)163.com> mtd: spi-nor: hisi-sfc: Put child node np on error path Alexander Usyskin <alexander.usyskin(a)intel.com> watchdog: mei_wdt: request stop on unregister He Zhe <zhe.he(a)windriver.com> arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing Jiri Kosina <jkosina(a)suse.cz> floppy: reintroduce O_NDELAY fix Sean Christopherson <seanjc(a)google.com> x86/reboot: Force all cpus to exit VMX root if VMX is supported Pavel Machek <pavel(a)denx.de> media: ipu3-cio2: Fix mbus_code processing in cio2_subdev_set_fmt() Martin Kaiser <martin(a)kaiser.cx> staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table Amey Narkhede <ameynarkhede03(a)gmail.com> staging: gdm724x: Fix DMA from stack Ilya Lipnitskiy <ilya.lipnitskiy(a)gmail.com> staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c Frank Wunderlich <frank-w(a)public-files.de> dts64: mt7622: fix slow sd card access Jiri Bohac <jbohac(a)suse.cz> pstore: Fix typo in compression option name Sabyrzhan Tasbolatov <snovitoll(a)gmail.com> drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue Ricky Wu <ricky_wu(a)realtek.com> misc: rtsx: init of rts522a add OCP power off when no card is present Paul Cercueil <paul(a)crapouillou.net> seccomp: Add missing return in non-void function Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - handle BigEndian for cipher Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - IV register does not work on A10 and A13 Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - checking sg length is not sufficient Ard Biesheuvel <ardb(a)kernel.org> crypto: arm64/sha - add missing module aliases Filipe Manana <fdmanana(a)suse.com> btrfs: fix extent buffer leak on failure to copy root Josef Bacik <josef(a)toxicpanda.com> btrfs: fix reloc root leak with 0 ref reloc roots on recovery Josef Bacik <josef(a)toxicpanda.com> btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: trusted: Fix migratable=1 failing James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm_tis: Clean up locality release James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm_tis: Fix check_locality for correct locality acquisition PeiSen Hou <pshou(a)realtek.com> ALSA: hda/realtek: modify EAPD in the ALC886 Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: mos7720: fix error code in mos7720_write() Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: mos7840: fix error code in mos7840_write() Johan Hovold <johan(a)kernel.org> USB: serial: ftdi_sio: fix FTX sub-integer prescaler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 Paul Cercueil <paul(a)crapouillou.net> usb: musb: Fix runtime PM race in musb_queue_resume_work Lech Perczak <lech.perczak(a)gmail.com> USB: serial: option: update interface mapping for ZTE P685M Marcos Paulo de Souza <mpdesouza(a)suse.com> Input: i8042 - add ASUS Zenbook Flip to noselftest list Dan Carpenter <dan.carpenter(a)oracle.com> Input: joydev - prevent potential read overflow in ioctl Olivier Crête <olivier.crete(a)ocrete.ca> Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S jeffrey.lin <jeffrey.lin(a)rad-ic.com> Input: raydium_ts_i2c - do not send zero length Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Ignore attempts to overwrite the touch_max value from HID Qinglang Miao <miaoqinglang(a)huawei.com> ACPI: configfs: add missing check after configfs_register_default_group() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: property: Fix fwnode string properties matching Mikulas Patocka <mpatocka(a)redhat.com> blk-settings: align max_sectors on "logical_block_size" boundary Randy Dunlap <rdunlap(a)infradead.org> scsi: bnx2fc: Fix Kconfig warning & CNIC build errors Miaohe Lin <linmiaohe(a)huawei.com> mm/rmap: fix potential pte_unmap on an not mapped pte Maxime Ripard <maxime(a)cerno.tech> i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition Marc Zyngier <maz(a)kernel.org> arm64: Add missing ISB after invalidating TLB in __primary_switch Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix jumbo packet handling on RTL8168e Miaohe Lin <linmiaohe(a)huawei.com> mm/hugetlb: fix potential double free in hugetlb_register_node() error path Miaohe Lin <linmiaohe(a)huawei.com> mm/memory.c: fix potential pte_unmap_unlock pte error Dan Carpenter <dan.carpenter(a)oracle.com> ocfs2: fix a use after free on error Taehee Yoo <ap420073(a)gmail.com> vxlan: move debug check after netdev unregister Chuhong Yuan <hslester96(a)gmail.com> net/mlx4_core: Add missed mlx4_free_cmd_mailbox() Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Fix add TC filter for IPv6 Jann Horn <jannh(a)google.com> Take mmap lock in cacheflush syscall Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> i40e: Fix VFs not created Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Fix overwriting flow control settings during driver loading Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Add zero-initialization of AQ command structures Slawomir Laba <slawomirx.laba(a)intel.com> i40e: Fix flow for IPv6 next header (extension header) Bard Liao <yung-chuan.liao(a)linux.intel.com> regmap: sdw: use _no_pm functions in regmap_read/write Theodore Ts'o <tytso(a)mit.edu> ext4: fix potential htree index checksum corruption Konrad Dybcio <konrad.dybcio(a)somainline.org> drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) Heiner Kallweit <hkallweit1(a)gmail.com> PCI: Align checking of syscall user config accessors Jorgen Hansen <jhansen(a)vmware.com> VMCI: Use set_page_dirty_lock() when unregistering guest memory Simon South <simon(a)simonsouth.net> pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() Aswath Govindraju <a-govindraju(a)ti.com> misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users Aswath Govindraju <a-govindraju(a)ti.com> misc: eeprom_93xx46: Fix module alias to enable module autoprobe Randy Dunlap <rdunlap(a)infradead.org> sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set Dan Carpenter <dan.carpenter(a)oracle.com> Input: elo - fix an error code in elo_connect() Namhyung Kim <namhyung(a)kernel.org> perf test: Fix unaligned access in sample parsing test Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix missing CYC processing in PSB Dan Carpenter <dan.carpenter(a)oracle.com> Input: sur40 - fix an error code in sur40_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> spi: pxa2xx: Fix the controller numbering for Wildcat Point AngeloGioacchino Del Regno <angelogioacchino.delregno(a)somainline.org> clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix software emulation interrupt Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/dlpar: handle ibm, configure-connector delay status Dan Carpenter <dan.carpenter(a)oracle.com> mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() Alain Volmat <alain.volmat(a)foss.st.com> spi: stm32: properly handle 0 byte transfer Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Correct skb on loopback path Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Fix coding error in rxe_recv.c Arnaldo Carvalho de Melo <acme(a)redhat.com> perf tools: Fix DSO filtering when not finding a map for a sampled address Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracepoint: Do not fail unregistering a probe due to memory failure Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> amba: Fix resource leak for drivers without .remove Vladimir Murzin <vladimir.murzin(a)arm.com> ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores Takeshi Saito <takeshi.saito.xv(a)renesas.com> mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to 128-bytes Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/47x: Disable 256k page size Cédric Le Goater <clg(a)kaod.org> KVM: PPC: Make the VMX instruction emulation routines static Shay Drory <shayd(a)nvidia.com> IB/umad: Return EPOLLERR in case of when device disassociated Shay Drory <shayd(a)nvidia.com> IB/umad: Return EIO in case of when device disassociated Geert Uytterhoeven <geert(a)linux-m68k.org> auxdisplay: ht16k33: Fix refresh rate handling Pan Bian <bianpan2016(a)163.com> isofs: release buffer head before return Krzysztof Kozlowski <krzk(a)kernel.org> regulator: s5m8767: Drop regulators OF node reference Pan Bian <bianpan2016(a)163.com> spi: atmel: Put allocated master before return David Howells <dhowells(a)redhat.com> certs: Fix blacklist flag type confusion Pan Bian <bianpan2016(a)163.com> regulator: axp20x: Fix reference cout leak Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: h6: Fix clock divider range on some clocks Yishai Hadas <yishaih(a)nvidia.com> RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation Tom Rix <trix(a)redhat.com> clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined Bartosz Golaszewski <bgolaszewski(a)baylibre.com> rtc: s5m: select REGMAP_I2C Claudiu Beznea <claudiu.beznea(a)microchip.com> power: reset: at91-sama5d2_shdwc: fix wkupdbc mask Nicolas Boichat <drinkcat(a)chromium.org> of/fdt: Make sure no-map does not remove already reserved regions KarimAllah Ahmed <karahmed(a)amazon.de> fdt: Properly handle "no-map" field in the memory region Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> mfd: bd9571mwv: Use devm_mfd_add_devices() Ferry Toth <ftoth(a)exalondelft.nl> dmaengine: hsu: disable spurious interrupt Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: owl-dma: Fix a resource leak in the remove function Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: fsldma: Fix a resource leak in the remove function Randy Dunlap <rdunlap(a)infradead.org> HID: core: detect and skip invalid inputs to snto32() Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: h6: Fix CEC clock Pratyush Yadav <p.yadav(a)ti.com> spi: cadence-quadspi: Abort read if dummy cycles required are too many Jan Kara <jack(a)suse.cz> quota: Fix memory leak when handling corrupted quota file Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL Eric W. Biederman <ebiederm(a)xmission.com> capabilities: Don't allow writing ambiguous v3 file capabilities Tom Rix <trix(a)redhat.com> jffs2: fix use after free in jffs2_sum_write_data() Colin Ian King <colin.king(a)canonical.com> fs/jfs: fix potential integer overflow on shift of a int Lakshmi Ramasubramanian <nramas(a)linux.microsoft.com> ima: Free IMA measurement buffer after kexec syscall Lakshmi Ramasubramanian <nramas(a)linux.microsoft.com> ima: Free IMA measurement buffer on error Daniele Alessandrelli <daniele.alessandrelli(a)intel.com> crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() Jan Henrik Weinstock <jan.weinstock(a)rwth-aachen.de> hwrng: timeriomem - Fix cooldown period calculation Zhihao Cheng <chengzhihao1(a)huawei.com> btrfs: clarify error returns values in __load_free_space_cache Andrea Parri (Microsoft) <parri.andrea(a)gmail.com> Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() Dan Carpenter <dan.carpenter(a)oracle.com> drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() Yi Chen <chenyi77(a)huawei.com> f2fs: fix to avoid inconsistent quota data Sebastian Reichel <sre(a)kernel.org> ASoC: cpcap: fix microphone timeslot mask Florian Fainelli <f.fainelli(a)gmail.com> ata: ahci_brcm: Add back regulators management Christophe Leroy <christophe.leroy(a)csgroup.eu> crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size error) Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values Tom Rix <trix(a)redhat.com> media: pxa_camera: declare variable when DEBUG is defined Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: cx25821: Fix a bug when reallocating some dma memory Luo Meng <luomeng12(a)huawei.com> media: qm1d1c0042: fix error return code in qm1d1c0042_init() Joe Perches <joe(a)perches.com> media: lmedm04: Fix misuse of comma Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth reduction. Jiri Olsa <jolsa(a)kernel.org> crypto: bcm - Rename struct device_private to bcm_device_private Dan Carpenter <dan.carpenter(a)oracle.com> ASoC: cs42l56: fix up error handling in probe Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: tm6000: Fix memleak in tm6000_start_stream Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: media/pci: Fix memleak in empress_init Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: em28xx: Fix use-after-free in em28xx_alloc_urbs Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: vsp1: Fix an error handling path in the probe function Dan Carpenter <dan.carpenter(a)oracle.com> media: camss: missing error code in msm_video_register() Jacopo Mondi <jacopo(a)jmondi.org> media: i2c: ov5670: Fix PIXEL_RATE minimum value Nathan Chancellor <natechancellor(a)gmail.com> MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Nathan Chancellor <natechancellor(a)gmail.com> MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Chenyang Li <lichenyang(a)loongson.cn> drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - fix kmap usage Dan Carpenter <dan.carpenter(a)oracle.com> gma500: clean up error handling in init Jialin Zhang <zhangjialin11(a)huawei.com> drm/gma500: Fix error return code in psb_driver_load() Randy Dunlap <rdunlap(a)infradead.org> fbdev: aty: SPARC64 requires FB_ATY_CT Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: mvneta: Remove per-cpu queue mapping for Armada 3700 Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Reset link when the link never comes back Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: skip send_request_unmap for timeout reset Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: add memory barrier to protect long term buffer Colin Ian King <colin.king(a)canonical.com> b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Ayush Sawal <ayush.sawal(a)chelsio.com> cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds Eric Dumazet <edumazet(a)google.com> tcp: fix SO_RCVLOWAT related hangs under mem pressure Jesper Dangaard Brouer <brouer(a)redhat.com> bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx Colin Ian King <colin.king(a)canonical.com> mac80211: fix potential overflow when multiplying to u32 integers Juergen Gross <jgross(a)suse.com> xen/netback: fix spurious event detection for common event case Edwin Peer <edwin.peer(a)broadcom.com> bnxt_en: reverse order of TX disable and carrier off Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: Set to CLOSED state even on error Linus Lüssing <ll(a)simonwunderlich.de> ath9k: fix data bus crash when setting nf_override via debugfs Marco Elver <elver(a)google.com> bpf_lru_list: Read double-checked variable once without lock Jae Hyun Yoo <jae.hyun.yoo(a)intel.com> soc: aspeed: snoop: Add clock control logic Arnd Bergmann <arnd(a)arndb.de> ARM: s3c: fix fiq for clang IAS Vincent Knecht <vincent.knecht(a)mailoo.org> arm64: dts: msm8916: Fix reserved and rfsa nodes unit address Rosen Penev <rosenp(a)gmail.com> ARM: dts: armada388-helios4: assign pinctrl to each fan Rosen Penev <rosenp(a)gmail.com> ARM: dts: armada388-helios4: assign pinctrl to LEDs Chen-Yu Tsai <wens(a)csie.org> staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Make "trimming xfer length" a debug message Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Abort transaction after errors with unknown reason Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Do not update data length if it is 0 on inbound transfers Tony Lindgren <tony(a)atomide.com> ARM: dts: Configure missing thermal interrupt for 4430 Pan Bian <bianpan2016(a)163.com> memory: ti-aemif: Drop child node when jumping out loop Pan Bian <bianpan2016(a)163.com> Bluetooth: Put HCI device if inquiry procedure interrupts Pan Bian <bianpan2016(a)163.com> Bluetooth: drop HCI device reference before return Jack Pham <jackp(a)codeaurora.org> usb: gadget: u_audio: Free requests only after callback Maximilian Luz <luzmaximilian(a)gmail.com> ACPICA: Fix exception code class checks Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> cpufreq: brcmstb-avs-cpufreq: Free resources in error path Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: A64: properly connect USB PHY to port 0 Andrii Nakryiko <andrii(a)kernel.org> bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args Krzysztof Kozlowski <krzk(a)kernel.org> arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso Krzysztof Kozlowski <krzk(a)kernel.org> arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Monk Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5 Christopher William Snowhill <chris(a)kode54.net> Bluetooth: Fix initializing response id after clearing struct Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function Rakesh Pillai <pillair(a)codeaurora.org> ath10k: Fix error handling in case of CE pipe init failure Eric Biggers <ebiggers(a)google.com> random: fix the RNDRESEEDCRNG ioctl Alexander Lobakin <alobakin(a)pm.me> MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode Jan Kara <jack(a)suse.cz> bfq: Avoid false bfq queue merging Ansuel Smith <ansuelsmth(a)gmail.com> PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 Sumit Garg <sumit.garg(a)linaro.org> kdb: Make memory allocations more robust Nick Desaulniers <ndesaulniers(a)google.com> vmlinux.lds.h: add DWARF v5 sections Peter Zijlstra <peterz(a)infradead.org> locking/static_key: Fix false positive warnings on concurrent dec/inc Peter Zijlstra <peterz(a)infradead.org> jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations Rong Chen <rong.a.chen(a)intel.com> scripts/recordmcount.pl: support big endian for ARCH sh Shyam Prasad N <sprasad(a)microsoft.com> cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath. Christoph Schemmel <christoph.schemmel(a)gmail.com> NET: usb: qmi_wwan: Adding support for Cinterion MV31 Ming Lei <ming.lei(a)redhat.com> block: don't release queue's sysfs lock during switching elevator Ming Lei <ming.lei(a)redhat.com> block: fix race between switching elevator and removing queues Ming Lei <ming.lei(a)redhat.com> block: split .sysfs_lock into two locks Ming Lei <ming.lei(a)redhat.com> block: add helper for checking if queue is registered Rolf Eike Beer <eb(a)emlix.com> scripts: set proper OpenSSL include dir also for sign-file Rolf Eike Beer <eb(a)emlix.com> scripts: use pkg-config to locate libcrypto Sameer Pujar <spujar(a)nvidia.com> arm64: tegra: Add power-domain for Tegra210 HDA Rustam Kovhaev <rkovhaev(a)gmail.com> ntfs: check for valid standard information attribute Stefan Ursella <stefan.ursella(a)wolfvision.net> usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Johan Hovold <johan(a)kernel.org> USB: quirks: sort quirk entries Will McVicker <willmcvicker(a)google.com> HID: make arrays usage and value to be the same ------------- Diffstat: Documentation/filesystems/seq_file.txt | 6 + Makefile | 4 +- arch/arm/boot/compressed/head.S | 4 +- arch/arm/boot/dts/armada-388-helios4.dts | 28 +++- arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +- arch/arm/boot/dts/exynos3250-monk.dts | 2 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos5250-spring.dts | 2 +- arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +- arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- arch/arm/boot/dts/omap443x.dtsi | 2 + arch/arm64/Kconfig | 2 +- .../boot/dts/allwinner/sun50i-a64-pinebook.dts | 5 +- .../boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 - arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 6 +- .../boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +- arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 + arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/arm64/crypto/sha1-ce-glue.c | 1 + arch/arm64/crypto/sha2-ce-glue.c | 2 + arch/arm64/crypto/sha3-ce-glue.c | 4 + arch/arm64/crypto/sha512-ce-glue.c | 2 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/head.S | 1 + arch/arm64/kernel/probes/uprobes.c | 2 +- arch/mips/kernel/vmlinux.lds.S | 1 + arch/mips/lantiq/irq.c | 2 +- arch/mips/mm/c-r4k.c | 2 +- arch/nios2/kernel/sys_nios2.c | 11 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/kernel/head_8xx.S | 2 +- arch/powerpc/kvm/powerpc.c | 8 +- arch/powerpc/platforms/pseries/dlpar.c | 7 +- arch/sparc/Kconfig | 2 +- arch/sparc/lib/memset.S | 1 + arch/x86/kernel/reboot.c | 29 ++-- arch/x86/mm/pat.c | 3 +- block/bfq-iosched.c | 1 + block/blk-core.c | 1 + block/blk-mq-sysfs.c | 12 +- block/blk-settings.c | 12 ++ block/blk-sysfs.c | 49 ++++--- block/blk-wbt.c | 2 +- block/blk.h | 2 +- block/elevator.c | 30 ++-- certs/blacklist.c | 2 +- crypto/ecdh_helper.c | 3 + drivers/acpi/acpi_configfs.c | 7 +- drivers/acpi/property.c | 44 ++++-- drivers/amba/bus.c | 20 +-- drivers/ata/ahci_brcm.c | 14 +- drivers/auxdisplay/ht16k33.c | 3 +- drivers/base/regmap/regmap-sdw.c | 4 +- drivers/block/floppy.c | 27 ++-- drivers/bluetooth/btqcomsmd.c | 27 ++-- drivers/char/hw_random/timeriomem-rng.c | 2 +- drivers/char/random.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 50 +------ drivers/clk/meson/clk-pll.c | 2 +- drivers/clk/qcom/gcc-msm8998.c | 100 ++++++------- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 10 +- drivers/clocksource/mxs_timer.c | 5 +- drivers/cpufreq/brcmstb-avs-cpufreq.c | 24 +++- drivers/cpufreq/intel_pstate.c | 5 +- drivers/crypto/bcm/cipher.c | 2 +- drivers/crypto/bcm/cipher.h | 4 +- drivers/crypto/bcm/util.c | 2 +- drivers/crypto/chelsio/chtls/chtls_cm.h | 3 - drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 159 +++++++++++++-------- drivers/crypto/talitos.c | 28 ++-- drivers/crypto/talitos.h | 1 + drivers/dma/fsldma.c | 6 + drivers/dma/hsu/pci.c | 21 +-- drivers/dma/owl-dma.c | 1 + drivers/gpio/gpio-pcf857x.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 8 +- drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +-- drivers/gpu/drm/gma500/psb_drv.c | 2 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +- drivers/hid/hid-core.c | 9 +- drivers/hid/wacom_wac.c | 7 +- drivers/hv/channel_mgmt.c | 3 +- drivers/i2c/busses/i2c-brcmstb.c | 2 +- drivers/infiniband/core/user_mad.c | 17 ++- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/sw/rxe/rxe_net.c | 5 + drivers/infiniband/sw/rxe/rxe_recv.c | 11 +- drivers/input/joydev.c | 7 +- drivers/input/joystick/xpad.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 4 + drivers/input/touchscreen/elo.c | 4 +- drivers/input/touchscreen/raydium_i2c_ts.c | 3 +- drivers/input/touchscreen/sur40.c | 1 + drivers/md/dm-core.h | 4 + drivers/md/dm-crypt.c | 1 + drivers/md/dm-era-target.c | 93 +++++++----- drivers/md/dm.c | 60 ++++++++ drivers/media/i2c/ov5670.c | 3 +- drivers/media/pci/cx25821/cx25821-core.c | 4 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 2 +- drivers/media/pci/saa7134/saa7134-empress.c | 5 +- drivers/media/platform/pxa_camera.c | 3 + drivers/media/platform/qcom/camss/camss-video.c | 1 + drivers/media/platform/vsp1/vsp1_drv.c | 4 +- drivers/media/tuners/qm1d1c0042.c | 4 +- drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +- drivers/media/usb/em28xx/em28xx-core.c | 6 +- drivers/media/usb/tm6000/tm6000-dvb.c | 4 + drivers/media/usb/uvc/uvc_v4l2.c | 18 +-- drivers/memory/ti-aemif.c | 8 +- drivers/mfd/bd9571mwv.c | 6 +- drivers/mfd/wm831x-auxadc.c | 3 +- drivers/misc/aspeed-lpc-snoop.c | 30 +++- drivers/misc/cardreader/rts5227.c | 5 + drivers/misc/eeprom/eeprom_93xx46.c | 1 + drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 3 +- drivers/mmc/host/usdhi6rol0.c | 4 +- drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- drivers/mtd/spi-nor/hisi-sfc.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 ++ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 3 +- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 39 ++++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 3 + drivers/net/ethernet/chelsio/cxgb4/sge.c | 11 +- drivers/net/ethernet/ibm/ibmvnic.c | 16 ++- drivers/net/ethernet/intel/i40e/i40e_main.c | 41 ++---- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 +- drivers/net/ethernet/marvell/mvneta.c | 9 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 + drivers/net/ethernet/realtek/r8169.c | 4 +- drivers/net/ethernet/sun/sunvnet_common.c | 23 +-- drivers/net/gtp.c | 5 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan.c | 11 +- drivers/net/wireless/ath/ath10k/snoc.c | 5 +- drivers/net/wireless/ath/ath9k/debug.c | 5 +- drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/xen-netback/interface.c | 8 +- drivers/nvdimm/dimm_devs.c | 18 ++- drivers/of/fdt.c | 12 +- drivers/pci/controller/dwc/pcie-qcom.c | 4 +- drivers/pci/syscall.c | 10 +- drivers/power/reset/at91-sama5d2_shdwc.c | 2 +- drivers/pwm/pwm-rockchip.c | 1 - drivers/regulator/axp20x-regulator.c | 7 +- drivers/regulator/s5m8767.c | 8 +- drivers/rtc/Kconfig | 1 + drivers/scsi/bnx2fc/Kconfig | 1 + drivers/spi/spi-atmel.c | 2 +- drivers/spi/spi-pxa2xx-pci.c | 27 ++-- drivers/spi/spi-s3c24xx-fiq.S | 9 +- drivers/spi/spi-stm32.c | 4 + drivers/staging/gdm724x/gdm_usb.c | 10 +- drivers/staging/mt7621-dma/Makefile | 2 +- .../mt7621-dma/{mtk-hsdma.c => hsdma-mt7621.c} | 2 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +- drivers/target/iscsi/cxgbit/cxgbit_target.c | 3 +- drivers/usb/core/quirks.c | 9 +- drivers/usb/dwc2/hcd.c | 15 +- drivers/usb/dwc2/hcd_intr.c | 14 +- drivers/usb/dwc3/gadget.c | 19 ++- drivers/usb/gadget/function/u_audio.c | 17 ++- drivers/usb/musb/musb_core.c | 31 ++-- drivers/usb/serial/ftdi_sio.c | 5 +- drivers/usb/serial/mos7720.c | 4 +- drivers/usb/serial/mos7840.c | 4 +- drivers/usb/serial/option.c | 3 +- drivers/video/fbdev/Kconfig | 2 +- drivers/watchdog/mei_wdt.c | 1 + fs/affs/namei.c | 4 +- fs/btrfs/ctree.c | 7 +- fs/btrfs/free-space-cache.c | 6 +- fs/btrfs/relocation.c | 4 +- fs/cifs/connect.c | 1 + fs/ext4/namei.c | 7 +- fs/f2fs/file.c | 7 +- fs/f2fs/inline.c | 4 + fs/gfs2/lock_dlm.c | 8 +- fs/isofs/dir.c | 1 + fs/isofs/namei.c | 1 + fs/jffs2/summary.c | 3 + fs/jfs/jfs_dmap.c | 2 +- fs/ntfs/inode.c | 6 + fs/ocfs2/cluster/heartbeat.c | 8 +- fs/pstore/platform.c | 4 +- fs/quota/quota_v2.c | 11 +- include/acpi/acexcep.h | 10 +- include/asm-generic/vmlinux.lds.h | 7 +- include/linux/blkdev.h | 2 + include/linux/device-mapper.h | 5 + include/linux/filter.h | 2 +- include/linux/icmpv6.h | 44 +++++- include/linux/ipv6.h | 2 +- include/linux/kexec.h | 5 + include/linux/key.h | 1 + include/linux/rmap.h | 3 +- include/net/icmp.h | 10 ++ include/net/tcp.h | 9 +- kernel/bpf/bpf_lru_list.c | 7 +- kernel/debug/kdb/kdb_private.h | 2 +- kernel/jump_label.c | 26 ++-- kernel/kexec_file.c | 5 + kernel/module.c | 21 ++- kernel/printk/printk_safe.c | 16 ++- kernel/seccomp.c | 2 + kernel/tracepoint.c | 80 ++++++++--- mm/hugetlb.c | 4 +- mm/memory.c | 16 ++- net/bluetooth/a2mp.c | 3 +- net/bluetooth/hci_core.c | 6 +- net/core/filter.c | 13 +- net/ipv4/icmp.c | 34 +++++ net/ipv6/icmp.c | 19 +-- net/ipv6/ip6_icmp.c | 46 +++++- net/mac80211/mesh_hwmp.c | 2 +- net/qrtr/tun.c | 12 +- net/xfrm/xfrm_interface.c | 6 +- scripts/Makefile | 9 +- scripts/recordmcount.pl | 6 +- security/commoncap.c | 12 +- security/integrity/ima/ima_kexec.c | 3 + security/integrity/ima/ima_mok.c | 5 +- security/keys/key.c | 2 + security/keys/trusted.c | 2 +- sound/pci/hda/patch_realtek.c | 11 ++ sound/soc/codecs/cpcap.c | 12 +- sound/soc/codecs/cs42l56.c | 3 +- sound/usb/pcm.c | 2 +- tools/perf/tests/sample-parsing.c | 2 +- tools/perf/util/event.c | 2 + .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 + 240 files changed, 1568 insertions(+), 737 deletions(-)

2 years, 9 months

11
276
0 0

[PATCH] PCI: xgene: Fix IB window setup

by Rob Herring

Commit 6dce5aa59e0b ("PCI: xgene: Use inbound resources for setup") broke PCI support on XGene. The cause is the IB resources are now sorted in address order instead of being in DT dma-ranges order. The result is which inbound registers are used for each region are swapped. I don't know the details about this h/w, but it appears that IB region 0 registers can't handle a size greater than 4GB. In any case, limiting the size for region 0 is enough to get back to the original assignment of dma-ranges to regions. Reported-by: Stéphane Graber <stgraber(a)ubuntu.com> Fixes: 6dce5aa59e0b ("PCI: xgene: Use inbound resources for setup") Link: https://lore.kernel.org/all/CA+enf=v9rY_xnZML01oEgKLmvY1NGBUUhnSJaETmXtDtXf… Cc: stable(a)vger.kernel.org # v5.5+ Signed-off-by: Rob Herring <robh(a)kernel.org> --- drivers/pci/controller/pci-xgene.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c index 56d0d50338c8..d83dbd977418 100644 --- a/drivers/pci/controller/pci-xgene.c +++ b/drivers/pci/controller/pci-xgene.c @@ -465,7 +465,7 @@ static int xgene_pcie_select_ib_reg(u8 *ib_reg_mask, u64 size) return 1; } - if ((size > SZ_1K) && (size < SZ_1T) && !(*ib_reg_mask & (1 << 0))) { + if ((size > SZ_1K) && (size < SZ_4G) && !(*ib_reg_mask & (1 << 0))) { *ib_reg_mask |= (1 << 0); return 0; } -- 2.32.0

2 years, 10 months

6
12
0 0

[PATCH] powerpc/603: Fix boot failure with DEBUG_PAGEALLOC and KFENCE

by Christophe Leroy

Allthough kernel text is always mapped with BATs, we still have inittext mapped with pages, so TLB miss handling is required when CONFIG_DEBUG_PAGEALLOC or CONFIG_KFENCE is set. The final solution should be to set a BAT that also maps inittext but that BAT then needs to be cleared at end of init, and it will require more changes to be able to do it properly. As DEBUG_PAGEALLOC or KFENCE are debugging, performance is not a big deal so let's fix it simply for now to enable easy stable application. Reported-by: Maxime Bizon <mbizon(a)freebox.fr> Fixes: 035b19a15a98 ("powerpc/32s: Always map kernel text and rodata with BATs") Cc: stable(a)vger.kernel.org Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> --- arch/powerpc/kernel/head_book3s_32.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/head_book3s_32.S index 68e5c0a7e99d..2e2a8211b17b 100644 --- a/arch/powerpc/kernel/head_book3s_32.S +++ b/arch/powerpc/kernel/head_book3s_32.S @@ -421,14 +421,14 @@ InstructionTLBMiss: */ /* Get PTE (linux-style) and check access */ mfspr r3,SPRN_IMISS -#ifdef CONFIG_MODULES +#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) lis r1, TASK_SIZE@h /* check if kernel address */ cmplw 0,r1,r3 #endif mfspr r2, SPRN_SDR1 li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER rlwinm r2, r2, 28, 0xfffff000 -#ifdef CONFIG_MODULES +#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) bgt- 112f lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC -- 2.33.1

2 years, 10 months

3
3
0 0

[PATCH v2] drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX

by Brian Norris

If the display is not enable()d, then we aren't holding a runtime PM reference here. Thus, it's easy to accidentally cause a hang, if user space is poking around at /dev/drm_dp_aux0 at the "wrong" time. Let's get the panel and PM state right before trying to talk AUX. Fixes: 0d97ad03f422 ("drm/bridge: analogix_dp: Remove duplicated code") Cc: <stable(a)vger.kernel.org> Cc: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Brian Norris <briannorris(a)chromium.org> --- Changes in v2: - Fix spelling in Subject - DRM_DEV_ERROR() -> drm_err() - Propagate errors from un-analogix_dp_prepare_panel() .../drm/bridge/analogix/analogix_dp_core.c | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c index b7d2e4449cfa..6fc46ac93ef8 100644 --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c @@ -1632,8 +1632,27 @@ static ssize_t analogix_dpaux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) { struct analogix_dp_device *dp = to_dp(aux); + int ret, ret2; - return analogix_dp_transfer(dp, msg); + ret = analogix_dp_prepare_panel(dp, true, false); + if (ret) { + drm_err(dp->drm_dev, "Failed to prepare panel (%d)\n", ret); + return ret; + } + + pm_runtime_get_sync(dp->dev); + ret = analogix_dp_transfer(dp, msg); + pm_runtime_put(dp->dev); + + ret2 = analogix_dp_prepare_panel(dp, false, false); + if (ret2) { + drm_err(dp->drm_dev, "Failed to unprepare panel (%d)\n", ret2); + /* Prefer the analogix_dp_transfer() error, if it exists. */ + if (!ret) + ret = ret2; + } + + return ret; } struct analogix_dp_device * -- 2.33.0.800.g4c38ced690-goog

2 years, 10 months

3
8
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2021