From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index 88fba2ba549f..7534455ffc6a 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index c47aa34fdc0a..5d97b3e45fbb 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index f29af4fc3d09..8fca4779ae6a 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
DIPM is unsupported or broken on sunxi. Trying to enable the power
management policy med_power_with_dipm on an Allwinner A20 SoC based board
leads to immediate I/O errors and the attached SATA disk disappears from
the /dev filesystem. A reset (power cycle) is required to make the SATA
controller or disk work again. The A10 and A20 SoC data sheets and manuals
don't mention DIPM at all [1], so it's fair to assume that it's simply not
supported. But even if it were, it should be considered broken and best be
disabled in the ahci_sunxi driver.
Fixes: c5754b5220f0 ("ARM: sunxi: Add support for Allwinner SUNXi SoCs sata to ahci_platform")
[1] https://github.com/allwinner-zh/documents/tree/master/
Signed-off-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
---
drivers/ata/ahci_sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
index cb69b737cb49..56b695136977 100644
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -200,7 +200,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap)
}
static const struct ata_port_info ahci_sunxi_port_info = {
- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
+ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
.pio_mask = ATA_PIO4,
.udma_mask = ATA_UDMA6,
.port_ops = &ahci_platform_ops,
--
2.26.2
From: Martin Wilck <mwilck(a)suse.com>
We have observed a few crashes run_timer_softirq(), where a broken
timer_list struct belonging to an anatt_timer was encountered. The broken
structures look like this, and we see actually multiple ones attached to
the same timer base:
crash> struct timer_list 0xffff92471bcfdc90
struct timer_list {
entry = {
next = 0xdead000000000122, // LIST_POISON2
pprev = 0x0
},
expires = 4296022933,
function = 0xffffffffc06de5e0 <nvme_anatt_timeout>,
flags = 20
}
If such a timer is encountered in run_timer_softirq(), the kernel
crashes. The test scenario was an I/O load test with lots of NVMe
controllers, some of which were removed and re-added on the storage side.
I think this may happen if the rdma recovery_work starts, in this call
chain:
nvme_rdma_error_recovery_work()
/* this stops all sorts of activity for the controller, but not
the multipath-related work queue and timer */
nvme_rdma_reconnect_or_remove(ctrl)
=> kicks reconnect_work
work queue: reconnect_work
nvme_rdma_reconnect_ctrl_work()
nvme_rdma_setup_ctrl()
nvme_rdma_configure_admin_queue()
nvme_init_identify()
nvme_mpath_init()
# this sets some fields of the timer_list without taking a lock
timer_setup()
nvme_read_ana_log()
mod_timer() or del_timer_sync()
Similar for TCP. The idea for the patch is based on the observation that
nvme_rdma_reset_ctrl_work() calls nvme_stop_ctrl()->nvme_mpath_stop(),
whereas nvme_rdma_error_recovery_work() stops only the keepalive timer, but
not the anatt timer.
I admit that the root cause analysis isn't rock solid yet. In particular, I
can't explain why we see LIST_POISON2 in the "next" pointer, which would
indicate that the timer has been detached before; yet we find it linked to
the timer base when the crash occurs.
OTOH, the anatt_timer is only touched in nvme_mpath_init() (see above) and
nvme_mpath_stop(), so the hypothesis that modifying active timers may cause
the issue isn't totally out of sight. I suspect that the LIST_POISON2 may
come to pass in multiple steps.
If anyone has better ideas, please advise. The issue occurs very
sporadically; verifying this by testing will be difficult.
Signed-off-by: Martin Wilck <mwilck(a)suse.com>
Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me>
Reviewed-by: Chao Leng <lengchao(a)huawei.com>
Cc: stable(a)vger.kernel.org
----
Changes in v3: Changed the subject line, as suggested by Sagi Grimberg
Changes in v2: Moved call to nvme_mpath_stop() further down, directly before
the call of nvme_rdma_reconnect_or_remove() (Chao Leng)
---
drivers/nvme/host/multipath.c | 1 +
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/tcp.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index a1d476e1ac02..c63dd5dfa7ff 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -586,6 +586,7 @@ void nvme_mpath_stop(struct nvme_ctrl *ctrl)
del_timer_sync(&ctrl->anatt_timer);
cancel_work_sync(&ctrl->ana_work);
}
+EXPORT_SYMBOL_GPL(nvme_mpath_stop);
#define SUBSYS_ATTR_RW(_name, _mode, _show, _store) \
struct device_attribute subsys_attr_##_name = \
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index be905d4fdb47..fc07a7b0dc1d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1202,6 +1202,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
return;
}
+ nvme_mpath_stop(&ctrl->ctrl);
nvme_rdma_reconnect_or_remove(ctrl);
}
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index a0f00cb8f9f3..46287b4f4d10 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2068,6 +2068,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)
return;
}
+ nvme_mpath_stop(ctrl);
nvme_tcp_reconnect_or_remove(ctrl);
}
--
2.31.1
This is the start of the stable review cycle for the 4.19.189 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.189-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.189-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Shou-Chieh Hsu <shouchieh(a)chromium.org>
HID: google: add don USB id
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Ali Saidi <alisaidi(a)amazon.com>
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Linus Torvalds <torvalds(a)linux-foundation.org>
gup: document and work around "COW can break either way" issue
Pali Rohár <pali(a)kernel.org>
net: phy: marvell: fix detection of PHY on Topaz switches
Fredrik Strupe <fredrik(a)strupe.net>
ARM: 9071/1: uprobes: Don't hook on thumb instructions
Russell King <rmk+kernel(a)armlinux.org.uk>
ARM: footbridge: fix PCI interrupt mapping
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in open function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in do_reset function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: avoid calling napi_disable() twice
Jason Xing <xingwanli(a)kuaishou.com>
i40e: fix the panic when running bpf in xdpdrv mode
Hristo Venev <hristo(a)venev.name>
net: ip6_tunnel: Unregister catch-all devices
Hristo Venev <hristo(a)venev.name>
net: sit: Unregister catch-all devices
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: davicom: Fix regulator not turned off on failed probe
Eric Dumazet <edumazet(a)google.com>
netfilter: nft_limit: avoid possible divide error in nft_limit_init
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: conntrack: do not print icmpv6 as unknown via /proc
Jolly Shah <jollys(a)google.com>
scsi: libsas: Reset num_scatter if libata marks qc as NODATA
Nathan Chancellor <nathan(a)kernel.org>
arm64: alternatives: Move length validation in alternative_{insn, endif}
Peter Collingbourne <pcc(a)google.com>
arm64: fix inline asm in load_unaligned_zeropad()
Linus Torvalds <torvalds(a)linux-foundation.org>
readdir: make sure to verify directory entry for legacy interfaces too
Jaegeuk Kim <jaegeuk(a)google.com>
dm verity fec: fix misaligned RS roots IO
Ping Cheng <pinglinux(a)gmail.com>
HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
Arnd Bergmann <arnd(a)arndb.de>
Input: i8042 - fix Pegatron C15B ID entry
Caleb Connolly <caleb(a)connolly.tech>
Input: s6sy761 - fix coordinate read bit shift
Seevalamuthu Mariappan <seevalam(a)codeaurora.org>
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
Guenter Roeck <linux(a)roeck-us.net>
pcnet32: Use pci_resource_len to validate PCI resource
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec seclevel
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec seclevels for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec devkey
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devkeys for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec dev
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devs for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec keys for monitors
Martin Wilck <mwilck(a)suse.com>
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
Alexander Shiyan <shc_work(a)mail.ru>
ASoC: fsl_esai: Fix TDM slot setup for I2S mode
Rob Clark <robdclark(a)chromium.org>
drm/msm: Fix a5xx/a6xx timestamps
Arnd Bergmann <arnd(a)arndb.de>
ARM: keystone: fix integer overflow warning
Tong Zhu <zhutong(a)amazon.com>
neighbour: Disregard DEAD dst in neigh_update
Wang Qing <wangqing(a)vivo.com>
arc: kernel: Return -EFAULT if copy_to_user() fails
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dw: Make it dependent to HAS_IOMEM
Matti Vaittinen <matti.vaittinen(a)fi.rohmeurope.com>
gpio: sysfs: Obey valid_mask
Fabian Vogt <fabian(a)ritter-vogt.de>
Input: nspire-keypad - enable interrupts only when opened
Or Cohen <orcohen(a)paloaltonetworks.com>
net/sctp: fix race condition in sctp_destroy_sock
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 ++
arch/arm/boot/dts/omap4.dtsi | 5 ++
arch/arm/boot/dts/omap44xx-clocks.dtsi | 8 ---
arch/arm/boot/dts/omap5.dtsi | 5 ++
arch/arm/mach-footbridge/cats-pci.c | 4 +-
arch/arm/mach-footbridge/ebsa285-pci.c | 4 +-
arch/arm/mach-footbridge/netwinder-pci.c | 2 +-
arch/arm/mach-footbridge/personal-pci.c | 5 +-
arch/arm/mach-keystone/keystone.c | 4 +-
arch/arm/probes/uprobes/core.c | 4 +-
arch/arm64/include/asm/alternative.h | 8 +--
arch/arm64/include/asm/word-at-a-time.h | 10 ++--
arch/ia64/mm/discontig.c | 6 +--
arch/s390/kernel/entry.S | 1 +
arch/x86/events/intel/uncore_snbep.c | 61 +++++++++-------------
arch/x86/kernel/crash.c | 2 +-
drivers/dma/dw/Kconfig | 2 +
drivers/gpio/gpiolib-sysfs.c | 8 +++
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 +-
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 +-
drivers/hid/hid-alps.c | 1 +
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/wacom_wac.c | 8 ++-
drivers/input/keyboard/nspire-keypad.c | 56 +++++++++++---------
drivers/input/serio/i8042-x86ia64io.h | 1 +
drivers/input/touchscreen/s6sy761.c | 4 +-
drivers/md/dm-verity-fec.c | 11 ++--
drivers/md/dm-verity-fec.h | 1 +
drivers/net/dsa/mv88e6xxx/chip.c | 30 +++++------
drivers/net/ethernet/amd/pcnet32.c | 5 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/ethernet/davicom/dm9000.c | 6 ++-
drivers/net/ethernet/ibm/ibmvnic.c | 14 +----
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +++
drivers/net/geneve.c | 6 +++
drivers/net/phy/marvell.c | 28 ++++++++--
drivers/net/xen-netback/xenbus.c | 12 +++--
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +--
drivers/scsi/libsas/sas_ata.c | 9 ++--
drivers/scsi/scsi_transport_srp.c | 2 +-
fs/readdir.c | 6 +++
include/linux/marvell_phy.h | 5 +-
kernel/locking/lockdep.c | 3 +-
kernel/locking/qrwlock.c | 7 +--
mm/gup.c | 44 +++++++++++++---
mm/huge_memory.c | 7 ++-
net/core/neighbour.c | 2 +-
net/ieee802154/nl802154.c | 29 ++++++++++
net/ipv6/ip6_tunnel.c | 10 ++++
net/ipv6/sit.c | 4 +-
net/mac80211/cfg.c | 4 +-
net/netfilter/nf_conntrack_standalone.c | 1 +
net/netfilter/nft_limit.c | 4 +-
net/sctp/socket.c | 13 ++---
sound/soc/fsl/fsl_esai.c | 8 +--
tools/arch/ia64/include/asm/barrier.h | 3 --
59 files changed, 322 insertions(+), 197 deletions(-)