aarch32 has pairs of registers to access the high and low parts of 64bit
registers. KVM has a union of 64bit sys_regs[] and 32bit copro[]. The
32bit accessors read the high or low part of the 64bit sys_reg[] value
through the union.
Both sys_reg_descs[] and cp15_regs[] list access_csselr() as the accessor
for CSSELR{,_EL1}. access_csselr() is only aware of the 64bit sys_regs[],
and expects r->reg to be 'CSSELR_EL1' in the enum, index 2 of the 64bit
array.
cp15_regs[] uses the 32bit copro[] alias of sys_regs[]. Here CSSELR is
c0_CSSELR which is the same location in sys_reg[]. r->reg is 'c0_CSSELR',
index 4 in the 32bit array.
access_csselr() uses the 32bit r->reg value to access the 64bit array,
so reads and write the wrong value. sys_regs[4], is ACTLR_EL1, which
is subsequently save/restored when we enter the guest.
ACTLR_EL1 is supposed to be read-only for the guest. This register
only affects execution at EL1, and the host's value is restored before
we return to host EL1.
Rename access_csselr() to access_csselr_el1(), to indicate it expects
the 64bit register index, and pass it CSSELR_EL1 from cp15_regs[].
Cc: stable(a)vger.kernel.org
Signed-off-by: James Morse <james.morse(a)arm.com>
----
Providing access_csselr_cp15() wouldn't work as with VHE CSSELR_EL1 is
loaded on the CPU while this code runs. access_csselr_cp15() would have
to map it back the 64bit resgister to use vcpu_write_sys_reg(). We may
as well do it in the table.
arch/arm64/kvm/sys_regs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 51db934702b6..2eda539f3281 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1302,7 +1302,7 @@ static bool access_clidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
return true;
}
-static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+static bool access_csselr_el1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
const struct sys_reg_desc *r)
{
if (p->is_write)
@@ -1566,7 +1566,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
{ SYS_DESC(SYS_CCSIDR_EL1), access_ccsidr },
{ SYS_DESC(SYS_CLIDR_EL1), access_clidr },
- { SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
+ { SYS_DESC(SYS_CSSELR_EL1), access_csselr_el1, reset_unknown, CSSELR_EL1 },
{ SYS_DESC(SYS_CTR_EL0), access_ctr },
{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
@@ -2060,7 +2060,7 @@ static const struct sys_reg_desc cp15_regs[] = {
{ Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
{ Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
- { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, c0_CSSELR },
+ { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr_el1, NULL, CSSELR_EL1 },
};
static const struct sys_reg_desc cp15_64_regs[] = {
--
2.20.1
From: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
[ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ]
As of today the ICCM and DCCM size checks are incorrectly using
mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ
and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in
runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes.
Fix that.
Reported-by: Paul Greco <pmgreco(a)us.ibm.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
Signed-off-by: Vineet Gupta <vgupta(a)synopsys.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arc/kernel/setup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 3013f3f82b95..66e4dc8bce1d 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -12,6 +12,7 @@
#include <linux/root_dev.h>
#include <linux/console.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/cpu.h>
#include <linux/clk-provider.h>
#include <linux/of_fdt.h>
@@ -308,12 +309,12 @@ static void arc_chk_core_config(void)
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
panic("Linux built with incorrect DCCM Base address\n");
- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
+ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
panic("Linux built with incorrect DCCM Size\n");
#endif
#ifdef CONFIG_ARC_HAS_ICCM
- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
+ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
panic("Linux built with incorrect ICCM Size\n");
#endif
--
2.25.1
From: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
[ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ]
As of today the ICCM and DCCM size checks are incorrectly using
mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ
and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in
runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes.
Fix that.
Reported-by: Paul Greco <pmgreco(a)us.ibm.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
Signed-off-by: Vineet Gupta <vgupta(a)synopsys.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arc/kernel/setup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 9f96120eee6e..82464fae7772 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -12,6 +12,7 @@
#include <linux/root_dev.h>
#include <linux/console.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/cpu.h>
#include <linux/of_fdt.h>
#include <linux/of.h>
@@ -333,12 +334,12 @@ static void arc_chk_core_config(void)
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
panic("Linux built with incorrect DCCM Base address\n");
- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
+ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
panic("Linux built with incorrect DCCM Size\n");
#endif
#ifdef CONFIG_ARC_HAS_ICCM
- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
+ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
panic("Linux built with incorrect ICCM Size\n");
#endif
--
2.25.1
From: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
[ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ]
As of today the ICCM and DCCM size checks are incorrectly using
mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ
and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in
runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes.
Fix that.
Reported-by: Paul Greco <pmgreco(a)us.ibm.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
Signed-off-by: Vineet Gupta <vgupta(a)synopsys.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arc/kernel/setup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 6b8d106e0d53..11c2c4a3fe69 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -15,6 +15,7 @@
#include <linux/clocksource.h>
#include <linux/console.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/cpu.h>
#include <linux/of_fdt.h>
#include <linux/of.h>
@@ -355,12 +356,12 @@ static void arc_chk_core_config(void)
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
panic("Linux built with incorrect DCCM Base address\n");
- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
+ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
panic("Linux built with incorrect DCCM Size\n");
#endif
#ifdef CONFIG_ARC_HAS_ICCM
- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
+ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
panic("Linux built with incorrect ICCM Size\n");
#endif
--
2.25.1
From: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
[ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ]
As of today the ICCM and DCCM size checks are incorrectly using
mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ
and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in
runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes.
Fix that.
Reported-by: Paul Greco <pmgreco(a)us.ibm.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
Signed-off-by: Vineet Gupta <vgupta(a)synopsys.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arc/kernel/setup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 89c97dcfa360..c10994daee39 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -15,6 +15,7 @@
#include <linux/clocksource.h>
#include <linux/console.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/cpu.h>
#include <linux/of_fdt.h>
#include <linux/of.h>
@@ -406,12 +407,12 @@ static void arc_chk_core_config(void)
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
panic("Linux built with incorrect DCCM Base address\n");
- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
+ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
panic("Linux built with incorrect DCCM Size\n");
#endif
#ifdef CONFIG_ARC_HAS_ICCM
- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
+ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
panic("Linux built with incorrect ICCM Size\n");
#endif
--
2.25.1
From: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
[ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ]
As of today the ICCM and DCCM size checks are incorrectly using
mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ
and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in
runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes.
Fix that.
Reported-by: Paul Greco <pmgreco(a)us.ibm.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
Signed-off-by: Vineet Gupta <vgupta(a)synopsys.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arc/kernel/setup.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index aa41af6ef4ac..efdedf83b954 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -11,6 +11,7 @@
#include <linux/clocksource.h>
#include <linux/console.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/cpu.h>
#include <linux/of_clk.h>
#include <linux/of_fdt.h>
@@ -409,12 +410,12 @@ static void arc_chk_core_config(void)
if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
panic("Linux built with incorrect DCCM Base address\n");
- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
+ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
panic("Linux built with incorrect DCCM Size\n");
#endif
#ifdef CONFIG_ARC_HAS_ICCM
- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
+ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
panic("Linux built with incorrect ICCM Size\n");
#endif
--
2.25.1
Commit 9495b7e92f716ab2bd6814fab5e97ab4a39adfdd ("driver core: platform:
Initialize dma_parms for platform devices") in v5.7-rc5 causes
vb2_dma_contig_clear_max_seg_size() to kfree memory that was not
allocated by vb2_dma_contig_set_max_seg_size().
The assumption in vb2_dma_contig_set_max_seg_size() seems to be that
dev->dma_parms is always NULL when the driver is probed, and the case
where dev->dma_parms has bee initialized by someone else than the driver
(by calling vb2_dma_contig_set_max_seg_size) will cause a failure.
All the current users of these functions are platform devices, which now
always have dma_parms set by the driver core. To fix the issue for v5.7,
make vb2_dma_contig_set_max_seg_size() return an error if dma_parms is
NULL to be on the safe side, and remove the kfree code from
vb2_dma_contig_clear_max_seg_size().
For v5.8 we should remove the two functions and move the
dma_set_max_seg_size() calls into the drivers.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com>
Fixes: 9495b7e92f71 ("driver core: platform: Initialize dma_parms for platform devices")
Cc: stable(a)vger.kernel.org
---
Changes in v2:
* vb2_dma_contig_clear_max_seg_size to empty static inline
* Added cc: stable and fixes tag
.../common/videobuf2/videobuf2-dma-contig.c | 20 ++-----------------
include/media/videobuf2-dma-contig.h | 2 +-
2 files changed, 3 insertions(+), 19 deletions(-)
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
index d3a3ee5b597b..f4b4a7c135eb 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
@@ -726,9 +726,8 @@ EXPORT_SYMBOL_GPL(vb2_dma_contig_memops);
int vb2_dma_contig_set_max_seg_size(struct device *dev, unsigned int size)
{
if (!dev->dma_parms) {
- dev->dma_parms = kzalloc(sizeof(*dev->dma_parms), GFP_KERNEL);
- if (!dev->dma_parms)
- return -ENOMEM;
+ dev_err(dev, "Failed to set max_seg_size: dma_parms is NULL\n");
+ return -ENODEV;
}
if (dma_get_max_seg_size(dev) < size)
return dma_set_max_seg_size(dev, size);
@@ -737,21 +736,6 @@ int vb2_dma_contig_set_max_seg_size(struct device *dev, unsigned int size)
}
EXPORT_SYMBOL_GPL(vb2_dma_contig_set_max_seg_size);
-/*
- * vb2_dma_contig_clear_max_seg_size() - release resources for DMA parameters
- * @dev: device for configuring DMA parameters
- *
- * This function releases resources allocated to configure DMA parameters
- * (see vb2_dma_contig_set_max_seg_size() function). It should be called from
- * device drivers on driver remove.
- */
-void vb2_dma_contig_clear_max_seg_size(struct device *dev)
-{
- kfree(dev->dma_parms);
- dev->dma_parms = NULL;
-}
-EXPORT_SYMBOL_GPL(vb2_dma_contig_clear_max_seg_size);
-
MODULE_DESCRIPTION("DMA-contig memory handling routines for videobuf2");
MODULE_AUTHOR("Pawel Osciak <pawel(a)osciak.com>");
MODULE_LICENSE("GPL");
diff --git a/include/media/videobuf2-dma-contig.h b/include/media/videobuf2-dma-contig.h
index 5604818d137e..5be313cbf7d7 100644
--- a/include/media/videobuf2-dma-contig.h
+++ b/include/media/videobuf2-dma-contig.h
@@ -25,7 +25,7 @@ vb2_dma_contig_plane_dma_addr(struct vb2_buffer *vb, unsigned int plane_no)
}
int vb2_dma_contig_set_max_seg_size(struct device *dev, unsigned int size);
-void vb2_dma_contig_clear_max_seg_size(struct device *dev);
+static inline void vb2_dma_contig_clear_max_seg_size(struct device *dev) { }
extern const struct vb2_mem_ops vb2_dma_contig_memops;
--
Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki.
Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki
CPU_LOONGSON2EF need software to maintain cache consistency,
so modify the 'cpu_needs_post_dma_flush' function to return true
when the cpu type is CPU_LOONGSON2EF.
Cc: stable(a)vger.kernel.org
Signed-off-by: Lichao Liu <liulichao(a)loongson.cn>
---
arch/mips/mm/dma-noncoherent.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/mm/dma-noncoherent.c b/arch/mips/mm/dma-noncoherent.c
index fcea92d95d86..563c2c0d0c81 100644
--- a/arch/mips/mm/dma-noncoherent.c
+++ b/arch/mips/mm/dma-noncoherent.c
@@ -33,6 +33,7 @@ static inline bool cpu_needs_post_dma_flush(void)
case CPU_R10000:
case CPU_R12000:
case CPU_BMIPS5000:
+ case CPU_LOONGSON2EF:
return true;
default:
/*
--
2.17.1
This is a note to let you know that I've just added the patch titled
staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 15ea976a1f12b5fd76b1bd6ff3eb5132fd28047f Mon Sep 17 00:00:00 2001
From: Pascal Terjan <pterjan(a)google.com>
Date: Sat, 23 May 2020 22:12:47 +0100
Subject: staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
The value in shared headers was fixed 9 years ago in commit 8d661f1e462d
("ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro") and
while looking at using shared headers for other duplicated constants
I noticed this driver uses the old value.
The macros are also defined twice in this file so I am deleting the
second definition.
Signed-off-by: Pascal Terjan <pterjan(a)google.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200523211247.23262-1-pterjan@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8712/wifi.h | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h
index be731f1a2209..91b65731fcaa 100644
--- a/drivers/staging/rtl8712/wifi.h
+++ b/drivers/staging/rtl8712/wifi.h
@@ -440,7 +440,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
/* block-ack parameters */
#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
@@ -532,13 +532,6 @@ struct ieee80211_ht_addt_info {
#define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004
#define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010
-/* block-ack parameters */
-#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
-#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
-#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
-#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
-
/*
* A-PMDU buffer sizes
* According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
--
2.26.2
This is a note to let you know that I've just added the patch titled
vt: keyboard: avoid signed integer overflow in k_ascii
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From b86dab054059b970111b5516ae548efaae5b3aae Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Date: Mon, 25 May 2020 16:27:40 -0700
Subject: vt: keyboard: avoid signed integer overflow in k_ascii
When k_ascii is invoked several times in a row there is a potential for
signed integer overflow:
UBSAN: Undefined behaviour in drivers/tty/vt/keyboard.c:888:19 signed integer overflow:
10 * 1111111111 cannot be represented in type 'int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.11 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xce/0x128 lib/dump_stack.c:118
ubsan_epilogue+0xe/0x30 lib/ubsan.c:154
handle_overflow+0xdc/0xf0 lib/ubsan.c:184
__ubsan_handle_mul_overflow+0x2a/0x40 lib/ubsan.c:205
k_ascii+0xbf/0xd0 drivers/tty/vt/keyboard.c:888
kbd_keycode drivers/tty/vt/keyboard.c:1477 [inline]
kbd_event+0x888/0x3be0 drivers/tty/vt/keyboard.c:1495
While it can be worked around by using check_mul_overflow()/
check_add_overflow(), it is better to introduce a separate flag to
signal that number pad is being used to compose a symbol, and
change type of the accumulator from signed to unsigned, thus
avoiding undefined behavior when it overflows.
Reported-by: Kyungtae Kim <kt0755(a)gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200525232740.GA262061@dtor-ws
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/vt/keyboard.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 15d33fa0c925..568b2171f335 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -127,7 +127,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */
static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */
static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */
static bool dead_key_next;
-static int npadch = -1; /* -1 or number assembled on pad */
+
+/* Handles a number being assembled on the number pad */
+static bool npadch_active;
+static unsigned int npadch_value;
+
static unsigned int diacr;
static char rep; /* flag telling character repeat */
@@ -845,12 +849,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag)
shift_state &= ~(1 << value);
/* kludge */
- if (up_flag && shift_state != old_state && npadch != -1) {
+ if (up_flag && shift_state != old_state && npadch_active) {
if (kbd->kbdmode == VC_UNICODE)
- to_utf8(vc, npadch);
+ to_utf8(vc, npadch_value);
else
- put_queue(vc, npadch & 0xff);
- npadch = -1;
+ put_queue(vc, npadch_value & 0xff);
+ npadch_active = false;
}
}
@@ -868,7 +872,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
{
- int base;
+ unsigned int base;
if (up_flag)
return;
@@ -882,10 +886,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
base = 16;
}
- if (npadch == -1)
- npadch = value;
- else
- npadch = npadch * base + value;
+ if (!npadch_active) {
+ npadch_value = 0;
+ npadch_active = true;
+ }
+
+ npadch_value = npadch_value * base + value;
}
static void k_lock(struct vc_data *vc, unsigned char value, char up_flag)
--
2.26.2
This is a note to let you know that I've just added the patch titled
tty: hvc_console, fix crashes on parallel open/close
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 24eb2377f977fe06d84fca558f891f95bc28a449 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby(a)suse.cz>
Date: Tue, 26 May 2020 16:56:32 +0200
Subject: tty: hvc_console, fix crashes on parallel open/close
hvc_open sets tty->driver_data to NULL when open fails at some point.
Typically, the failure happens in hp->ops->notifier_add(). If there is
a racing process which tries to open such mangled tty, which was not
closed yet, the process will crash in hvc_open as tty->driver_data is
NULL.
All this happens because close wants to know whether open failed or not.
But ->open should not NULL this and other tty fields for ->close to be
happy. ->open should call tty_port_set_initialized(true) and close
should check by tty_port_initialized() instead. So do this properly in
this driver.
So this patch removes these from ->open:
* tty_port_tty_set(&hp->port, NULL). This happens on last close.
* tty->driver_data = NULL. Dtto.
* tty_port_put(&hp->port). This happens in shutdown and until now, this
must have been causing a reference underflow, if I am not missing
something.
Signed-off-by: Jiri Slaby <jslaby(a)suse.cz>
Cc: stable <stable(a)vger.kernel.org>
Reported-and-tested-by: Raghavendra <rananta(a)codeaurora.org>
Link: https://lore.kernel.org/r/20200526145632.13879-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/hvc/hvc_console.c | 23 ++++++++---------------
1 file changed, 8 insertions(+), 15 deletions(-)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 436cc51c92c3..cdcc64ea2554 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -371,15 +371,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
* tty fields and return the kref reference.
*/
if (rc) {
- tty_port_tty_set(&hp->port, NULL);
- tty->driver_data = NULL;
- tty_port_put(&hp->port);
printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc);
- } else
+ } else {
/* We are ready... raise DTR/RTS */
if (C_BAUD(tty))
if (hp->ops->dtr_rts)
hp->ops->dtr_rts(hp, 1);
+ tty_port_set_initialized(&hp->port, true);
+ }
/* Force wakeup of the polling thread */
hvc_kick();
@@ -389,22 +388,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
static void hvc_close(struct tty_struct *tty, struct file * filp)
{
- struct hvc_struct *hp;
+ struct hvc_struct *hp = tty->driver_data;
unsigned long flags;
if (tty_hung_up_p(filp))
return;
- /*
- * No driver_data means that this close was issued after a failed
- * hvc_open by the tty layer's release_dev() function and we can just
- * exit cleanly because the kref reference wasn't made.
- */
- if (!tty->driver_data)
- return;
-
- hp = tty->driver_data;
-
spin_lock_irqsave(&hp->port.lock, flags);
if (--hp->port.count == 0) {
@@ -412,6 +401,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
/* We are done with the tty pointer now. */
tty_port_tty_set(&hp->port, NULL);
+ if (!tty_port_initialized(&hp->port))
+ return;
+
if (C_HUPCL(tty))
if (hp->ops->dtr_rts)
hp->ops->dtr_rts(hp, 0);
@@ -428,6 +420,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
* waking periodically to check chars_in_buffer().
*/
tty_wait_until_sent(tty, HVC_CLOSE_WAIT);
+ tty_port_set_initialized(&hp->port, false);
} else {
if (hp->port.count < 0)
printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
--
2.26.2
This is a note to let you know that I've just added the patch titled
serial: 8250: Enable 16550A variants by default on non-x86
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 15a3f03d5ec0118f1e5db3fc1018686e72744e37 Mon Sep 17 00:00:00 2001
From: Josh Triplett <josh(a)joshtriplett.org>
Date: Tue, 26 May 2020 09:13:57 -0700
Subject: serial: 8250: Enable 16550A variants by default on non-x86
Some embedded devices still use these serial ports; make sure they're
still enabled by default on architectures more likely to have them, to
avoid rendering someone's console unavailable.
Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com>
Reported-by: Maxim Kochetkov <fido_max(a)inbox.ru>
Fixes: dc56ecb81a0a ("serial: 8250: Support disabling mdelay-filled probes of 16550A variants")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Josh Triplett <josh(a)joshtriplett.org>
Link: https://lore.kernel.org/r/a20b5fb7dd295cfb48160eecf4bdebd76332d67d.15905094…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/8250/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index af0688156dd0..8195a31519ea 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -63,6 +63,7 @@ config SERIAL_8250_PNP
config SERIAL_8250_16550A_VARIANTS
bool "Support for variants of the 16550A serial port"
depends on SERIAL_8250
+ default !X86
help
The 8250 driver can probe for many variants of the venerable 16550A
serial port. Doing so takes additional time at boot.
--
2.26.2
From: Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
Replace superfluous VM_BUG_ON() with comment about correct usage.
Technically reverts commit 1d148e218a0d0566b1c06f2f45f1436d53b049b2
("mm: add VM_BUG_ON_PAGE() to page_mapcount()"), but context have changed.
Function isolate_migratepages_block() runs some checks out of lru_lock
when choose pages for migration. After checking PageLRU() it checks extra
page references by comparing page_count() and page_mapcount(). Between
these two checks page could be removed from lru, freed and taken by slab.
As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
Race window is tiny. For certain workload this happens around once a year.
page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
flags: 0x500000000008100(slab|head)
raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:628!
invalid opcode: 0000 [#1] SMP NOPTI
CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1
Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
RIP: 0010:isolate_migratepages_block+0x986/0x9b0
Code in isolate_migratepages_block() was added in commit 119d6d59dcc0
("mm, compaction: avoid isolating pinned pages") before adding VM_BUG_ON
into page_mapcount().
This race has been predicted in 2015 by Vlastimil Babka (see link below).
[akpm(a)linux-foundation.org: comment tweaks, per Hugh]
Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz
Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/
Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.st… (v1)
Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()")
Signed-off-by: Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Acked-by: Hugh Dickins <hughd(a)google.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Vlastimil Babka <vbabka(a)suse.cz>
Cc: David Rientjes <rientjes(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/mm.h | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/include/linux/mm.h~mm-remove-vm_bug_onpageslab-from-page_mapcount
+++ a/include/linux/mm.h
@@ -782,6 +782,11 @@ static inline void *kvcalloc(size_t n, s
extern void kvfree(const void *addr);
+/*
+ * Mapcount of compound page as a whole, does not include mapped sub-pages.
+ *
+ * Must be called only for compound pages or any their tail sub-pages.
+ */
static inline int compound_mapcount(struct page *page)
{
VM_BUG_ON_PAGE(!PageCompound(page), page);
@@ -801,10 +806,16 @@ static inline void page_mapcount_reset(s
int __page_mapcount(struct page *page);
+/*
+ * Mapcount of 0-order page; when compound sub-page, includes
+ * compound_mapcount().
+ *
+ * Result is undefined for pages which cannot be mapped into userspace.
+ * For example SLAB or special types of pages. See function page_has_type().
+ * They use this place in struct page differently.
+ */
static inline int page_mapcount(struct page *page)
{
- VM_BUG_ON_PAGE(PageSlab(page), page);
-
if (unlikely(PageCompound(page)))
return __page_mapcount(page);
return atomic_read(&page->_mapcount) + 1;
_
From: Hugh Dickins <hughd(a)google.com>
Subject: mm,thp: stop leaking unreleased file pages
When collapse_file() calls try_to_release_page(), it has already isolated
the page: so if releasing buffers happens to fail (as it sometimes does),
remember to putback_lru_page(): otherwise that page is left unreclaimable
and unfreeable, and the file extent uncollapsible.
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2005231837500.1766@eggly.anvils
Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
Signed-off-by: Hugh Dickins <hughd(a)google.com>
Acked-by: Song Liu <songliubraving(a)fb.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: <stable(a)vger.kernel.org> [5.4+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/khugepaged.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/khugepaged.c~mmthp-stop-leaking-unreleased-file-pages
+++ a/mm/khugepaged.c
@@ -1692,6 +1692,7 @@ static void collapse_file(struct mm_stru
if (page_has_private(page) &&
!try_to_release_page(page, GFP_KERNEL)) {
result = SCAN_PAGE_HAS_PRIVATE;
+ putback_lru_page(page);
goto out_unlock;
}
_
The patch titled
Subject: kernel/relay.c: handle alloc_percpu returning NULL in relay_open
has been added to the -mm tree. Its filename is
relay-handle-alloc_percpu-returning-null-in-relay_open.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/relay-handle-alloc_percpu-returnin…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/relay-handle-alloc_percpu-returnin…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Daniel Axtens <dja(a)axtens.net>
Subject: kernel/relay.c: handle alloc_percpu returning NULL in relay_open
alloc_percpu() may return NULL, which means chan->buf may be set to NULL.
In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an
invalid pointer:
BUG: Unable to handle kernel data access at 0x7dae0000
Faulting instruction address: 0xc0000000003f3fec
...
NIP [c0000000003f3fec] relay_open+0x29c/0x600
LR [c0000000003f3fc0] relay_open+0x270/0x600
Call Trace:
[c000000054353a70] [c0000000003f3fb4] relay_open+0x264/0x600 (unreliable)
[c000000054353b00] [c000000000451764] __blk_trace_setup+0x254/0x600
[c000000054353bb0] [c000000000451b78] blk_trace_setup+0x68/0xa0
[c000000054353c10] [c0000000010da77c] sg_ioctl+0x7bc/0x2e80
[c000000054353cd0] [c000000000758cbc] do_vfs_ioctl+0x13c/0x1300
[c000000054353d90] [c000000000759f14] ksys_ioctl+0x94/0x130
[c000000054353de0] [c000000000759ff8] sys_ioctl+0x48/0xb0
[c000000054353e20] [c00000000000bcd0] system_call+0x5c/0x68
Check if alloc_percpu returns NULL.
This was found by syzkaller both on x86 and powerpc, and the reproducer it
found on powerpc is capable of hitting the issue as an unprivileged user.
Link: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net
Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers")
Signed-off-by: Daniel Axtens <dja(a)axtens.net>
Reviewed-by: Michael Ellerman <mpe(a)ellerman.id.au>
Reviewed-by: Andrew Donnellan <ajd(a)linux.ibm.com>
Acked-by: David Rientjes <rientjes(a)google.com>
Reported-by: syzbot+1e925b4b836afe85a1c6(a)syzkaller-ppc64.appspotmail.com
Reported-by: syzbot+587b2421926808309d21(a)syzkaller-ppc64.appspotmail.com
Reported-by: syzbot+58320b7171734bf79d26(a)syzkaller.appspotmail.com
Reported-by: syzbot+d6074fb08bdb2e010520(a)syzkaller.appspotmail.com
Cc: Akash Goel <akash.goel(a)intel.com>
Cc: Andrew Donnellan <ajd(a)linux.ibm.com>
Cc: Guenter Roeck <linux(a)roeck-us.net>
Cc: Salvatore Bonaccorso <carnil(a)debian.org>
Cc: <stable(a)vger.kernel.org> [4.10+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/relay.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/relay.c~relay-handle-alloc_percpu-returning-null-in-relay_open
+++ a/kernel/relay.c
@@ -581,6 +581,11 @@ struct rchan *relay_open(const char *bas
return NULL;
chan->buf = alloc_percpu(struct rchan_buf *);
+ if (!chan->buf) {
+ kfree(chan);
+ return NULL;
+ }
+
chan->version = RELAYFS_CHANNEL_VERSION;
chan->n_subbufs = n_subbufs;
chan->subbuf_size = subbuf_size;
_
Patches currently in -mm which might be from dja(a)axtens.net are
kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source.patch
kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source-v4.patch
stringh-fix-incompatibility-between-fortify_source-and-kasan.patch
relay-handle-alloc_percpu-returning-null-in-relay_open.patch
This is the start of the stable review cycle for the 4.19.115 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 13 Apr 2020 11:51:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.115-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.115-rc1
Hans Verkuil <hans.verkuil(a)cisco.com>
drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()
Roger Quadros <rogerq(a)ti.com>
usb: dwc3: don't set gadget->is_otg flag
Chris Lew <clew(a)codeaurora.org>
rpmsg: glink: Remove chunk size word align warning
Arun KS <arunks(a)codeaurora.org>
arm64: Fix size of __early_cpu_boot_status
Rob Clark <robdclark(a)chromium.org>
drm/msm: stop abusing dma_map/unmap for cache
Taniya Das <tdas(a)codeaurora.org>
clk: qcom: rcg: Return failure for RCG update
Qiujun Huang <hqjagain(a)gmail.com>
fbcon: fix null-ptr-deref in fbcon_switch
Avihai Horon <avihaih(a)mellanox.com>
RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
Qiujun Huang <hqjagain(a)gmail.com>
Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/cma: Teach lockdep about the order of rtnl and lock
Jason Gunthorpe <jgg(a)ziepe.ca>
RDMA/ucma: Put a lock around every call to the rdma_cm layer
Ilya Dryomov <idryomov(a)gmail.com>
ceph: canonicalize server path in place
Xiubo Li <xiubli(a)redhat.com>
ceph: remove the extra slashes in the server path
Kaike Wan <kaike.wan(a)intel.com>
IB/hfi1: Fix memory leaks in sysfs registration and unregistration
Kaike Wan <kaike.wan(a)intel.com>
IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
Paul Cercueil <paul(a)crapouillou.net>
ASoC: jz4740-i2s: Fix divider written at incorrect offset in register
Martin Kaiser <martin(a)kaiser.cx>
hwrng: imx-rngc - fix an error path
David Ahern <dsahern(a)kernel.org>
tools/accounting/getdelays.c: fix netlink attribute length
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Wrap around when skip TRBs
Jason A. Donenfeld <Jason(a)zx2c4.com>
random: always use batched entropy for get_random_u{32,64}
Petr Machata <petrm(a)mellanox.com>
mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE
Richard Palethorpe <rpalethorpe(a)suse.com>
slcan: Don't transmit uninitialized stack data in padding
Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting
Oleksij Rempel <o.rempel(a)pengutronix.de>
net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: bcm_sf2: Ensure correct sub-node is parsed
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: bcm_sf2: Do not register slave MDIO bus with OF
Jarod Wilson <jarod(a)redhat.com>
ipv6: don't auto-add link-local address to lag ports
Randy Dunlap <rdunlap(a)infradead.org>
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
Sam Protsenko <semen.protsenko(a)linaro.org>
include/linux/notifier.h: SRCU: fix ctags
Miklos Szeredi <mszeredi(a)redhat.com>
bitops: protect variables in set_mask_bits() macro
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: always acquire cpu_hotplug_lock before pinst->lock
Amritha Nambiar <amritha.nambiar(a)intel.com>
net: Fix Tx hash bound checking
David Howells <dhowells(a)redhat.com>
rxrpc: Fix sendmsg(MSG_WAITALL) handling
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Sean Young <sean(a)mess.org>
media: rc: IR signal for Panasonic air conditioner too long
Lucas Stach <l.stach(a)pengutronix.de>
drm/etnaviv: replace MMU flush marker with flush sequence
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix gcc build warnings
James Zhu <James.Zhu(a)amd.com>
drm/amdgpu: fix typo for vcn1 idle check
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
initramfs: restore default compression behavior
Gerd Hoffmann <kraxel(a)redhat.com>
drm/bochs: downgrade pci_request_region failure from error to warning
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
Prabhath Sajeepa <psajeepa(a)purestorage.com>
nvme-rdma: Avoid double freeing of async event data
Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
sctp: fix possibly using a bad saddr with a given dst
Qiujun Huang <hqjagain(a)gmail.com>
sctp: fix refcount bug in sctp_wfree
William Dauchy <w.dauchy(a)criteo.com>
net, ip_tunnel: fix interface lookup with no key
Qian Cai <cai(a)lca.pw>
ipv4: fix a RCU-list lock in fib_triestat_seq_show
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/kernel/head.S | 2 +-
drivers/char/hw_random/imx-rngc.c | 4 +-
drivers/char/random.c | 20 ++------
drivers/clk/qcom/clk-rcg2.c | 2 +-
drivers/extcon/extcon-axp288.c | 32 ++++++++++++
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 +++++
drivers/gpu/drm/bochs/bochs_hw.c | 6 +--
drivers/gpu/drm/drm_dp_mst_topology.c | 1 +
drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 10 ++--
drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 +
drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 +--
drivers/gpu/drm/etnaviv/etnaviv_mmu.h | 2 +-
drivers/gpu/drm/msm/msm_gem.c | 4 +-
drivers/infiniband/core/cma.c | 14 ++++++
drivers/infiniband/core/ucma.c | 49 ++++++++++++++++++-
drivers/infiniband/hw/hfi1/sysfs.c | 26 +++++++---
drivers/media/rc/lirc_dev.c | 2 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 ++++--
drivers/net/can/slcan.c | 4 +-
drivers/net/dsa/bcm_sf2.c | 9 +++-
.../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 8 +--
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +-
drivers/net/phy/micrel.c | 7 +++
drivers/nvme/host/rdma.c | 8 +--
drivers/power/supply/axp288_charger.c | 57 +++++++++++++++++++++-
drivers/rpmsg/qcom_glink_native.c | 3 --
drivers/usb/dwc3/gadget.c | 3 +-
drivers/video/fbdev/core/fbcon.c | 3 ++
fs/ceph/super.c | 56 +++++++++++++--------
fs/ceph/super.h | 2 +-
include/linux/bitops.h | 14 +++---
include/linux/notifier.h | 3 +-
include/uapi/linux/coresight-stm.h | 6 ++-
kernel/padata.c | 4 +-
mm/mempolicy.c | 6 ++-
net/bluetooth/rfcomm/tty.c | 4 +-
net/core/dev.c | 2 +
net/ipv4/fib_trie.c | 3 ++
net/ipv4/ip_tunnel.c | 6 +--
net/ipv6/addrconf.c | 4 ++
net/rxrpc/sendmsg.c | 4 +-
net/sctp/ipv6.c | 20 +++++---
net/sctp/protocol.c | 28 +++++++----
net/sctp/socket.c | 31 +++++++++---
sound/pci/hda/patch_ca0132.c | 1 +
sound/soc/jz4740/jz4740-i2s.c | 2 +-
tools/accounting/getdelays.c | 2 +-
tools/power/x86/turbostat/turbostat.c | 27 +++++-----
usr/Kconfig | 22 ++++-----
54 files changed, 409 insertions(+), 159 deletions(-)
clang and gas seem to interpret the symbols in memmove.S and
memset.S differently, such that clang does not make them
'weak' as expected, which leads to a linker error, with both
ld.bfd and ld.lld:
ld.lld: error: duplicate symbol: memmove
>>> defined at common.c
>>> kasan/common.o:(memmove) in archive mm/built-in.a
>>> defined at memmove.o:(__memmove) in archive arch/arm64/lib/lib.a
ld.lld: error: duplicate symbol: memset
>>> defined at common.c
>>> kasan/common.o:(memset) in archive mm/built-in.a
>>> defined at memset.o:(__memset) in archive arch/arm64/lib/lib.a
Copy the exact way these are written in memcpy_64.S, which does
not have the same problem.
I don't know why this makes a difference, and it would be good
to have someone with a better understanding of assembler internals
review it.
It might be either a bug in the kernel or a bug in the assembler,
no idea which one. My patch makes it work with all versions of
clang and gcc, which is probably helpful even if it's a workaround
for a clang bug.
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
---
arch/arm64/lib/memcpy.S | 3 +--
arch/arm64/lib/memmove.S | 3 +--
arch/arm64/lib/memset.S | 3 +--
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/lib/memcpy.S b/arch/arm64/lib/memcpy.S
index e0bf83d556f2..dc8d2a216a6e 100644
--- a/arch/arm64/lib/memcpy.S
+++ b/arch/arm64/lib/memcpy.S
@@ -56,9 +56,8 @@
stp \reg1, \reg2, [\ptr], \val
.endm
- .weak memcpy
SYM_FUNC_START_ALIAS(__memcpy)
-SYM_FUNC_START_PI(memcpy)
+SYM_FUNC_START_WEAK_PI(memcpy)
#include "copy_template.S"
ret
SYM_FUNC_END_PI(memcpy)
diff --git a/arch/arm64/lib/memmove.S b/arch/arm64/lib/memmove.S
index 02cda2e33bde..1035dce4bdaf 100644
--- a/arch/arm64/lib/memmove.S
+++ b/arch/arm64/lib/memmove.S
@@ -45,9 +45,8 @@ C_h .req x12
D_l .req x13
D_h .req x14
- .weak memmove
SYM_FUNC_START_ALIAS(__memmove)
-SYM_FUNC_START_PI(memmove)
+SYM_FUNC_START_WEAK_PI(memmove)
cmp dstin, src
b.lo __memcpy
add tmp1, src, count
diff --git a/arch/arm64/lib/memset.S b/arch/arm64/lib/memset.S
index 77c3c7ba0084..a9c1c9a01ea9 100644
--- a/arch/arm64/lib/memset.S
+++ b/arch/arm64/lib/memset.S
@@ -42,9 +42,8 @@ dst .req x8
tmp3w .req w9
tmp3 .req x9
- .weak memset
SYM_FUNC_START_ALIAS(__memset)
-SYM_FUNC_START_PI(memset)
+SYM_FUNC_START_WEAK_PI(memset)
mov dst, dstin /* Preserve return value. */
and A_lw, val, #255
orr A_lw, A_lw, A_lw, lsl #8
--
2.26.2
clang and gas seem to interpret the symbols in memmove_64.S and
memset_64.S differently, such that clang does not make them
'weak' as expected, which leads to a linker error, with both
ld.bfd and ld.lld:
ld.lld: error: duplicate symbol: memmove
>>> defined at common.c
>>> kasan/common.o:(memmove) in archive mm/built-in.a
>>> defined at memmove.o:(__memmove) in archive arch/arm64/lib/lib.a
ld.lld: error: duplicate symbol: memset
>>> defined at common.c
>>> kasan/common.o:(memset) in archive mm/built-in.a
>>> defined at memset.o:(__memset) in archive arch/arm64/lib/lib.a
Copy the exact way these are written in memcpy_64.S, which does
not have the same problem.
I don't know why this makes a difference, and it would be good
to have someone with a better understanding of assembler internals
review it.
It might be either a bug in the kernel or a bug in the assembler,
no idea which one. My patch makes it work with all versions of
clang and gcc, which is probably helpful even if it's a workaround
for a clang bug.
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
arch/x86/lib/memmove_64.S | 4 ++--
arch/x86/lib/memset_64.S | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
index 7ff00ea64e4f..dcca01434be8 100644
--- a/arch/x86/lib/memmove_64.S
+++ b/arch/x86/lib/memmove_64.S
@@ -26,8 +26,8 @@
*/
.weak memmove
-SYM_FUNC_START_ALIAS(memmove)
-SYM_FUNC_START(__memmove)
+SYM_FUNC_START_ALIAS(__memmove)
+SYM_FUNC_START_LOCAL(memmove)
mov %rdi, %rax
diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
index 9ff15ee404a4..a97f2ea4e0b2 100644
--- a/arch/x86/lib/memset_64.S
+++ b/arch/x86/lib/memset_64.S
@@ -19,8 +19,8 @@
*
* rax original destination
*/
-SYM_FUNC_START_ALIAS(memset)
-SYM_FUNC_START(__memset)
+SYM_FUNC_START_ALIAS(__memset)
+SYM_FUNC_START_LOCAL(memset)
/*
* Some CPUs support enhanced REP MOVSB/STOSB feature. It is recommended
* to use it when possible. If not available, use fast string instructions.
--
2.26.2
Changes since v3 [1]:
- Drop extern for new function declarations (Michael)
- Rename memcpy_mcsafe_64.S to copy_mc_64.S instead of copy_mc.S and
related fixups (Michael)
- Add a new symlink
(tools/testing/selftests/powerpc/copyloops/copy_mc_64.S) to the new
copy_mc_64.S to fix selftest build breakage (Michael)
- Drop one instance of copy_safe() that survived from v2 of the patchset
(Vivek)
- Fix 32-bit x86 build breakage (kbuild robot)
- Kill off rather than rename tools/arch/x86/include/asm/mcsafe_test.h
since perf is no longer burden with dealing with the copy_mc_generic()
implementation.
- Build success notification received for revised set (kbuild robot)
[1]: http://lore.kernel.org/r/158992635164.403910.2616621400995359522.stgit@dwil…
---
The primary motivation to go touch memcpy_mcsafe() is that the existing
benefit of doing slow "handle with care" copies is obviated on newer
CPUs. With that concern lifted it also obviates the need to continue to
update the MCA-recovery capability detection code currently gated by
"mcsafe_key". Now the old "mcsafe_key" opt-in to perform the copy with
concerns for recovery fragility can instead be made an opt-out from the
default fast copy implementation (enable_copy_mc_fragile()).
The discussion with Linus on the first iteration of this patch
identified that memcpy_mcsafe() was misnamed relative to its usage. The
new names copy_mc_to_user() and copy_mc_to_kernel() clearly indicate the
intended use case and lets the architecture organize the implementation
accordingly.
For both powerpc and x86 a copy_mc_generic() implementation is added as
the backend for these interfaces.
Patches are relative to tip/master.
---
Dan Williams (2):
x86, powerpc: Rename memcpy_mcsafe() to copy_mc_to_{user,kernel}()
x86/copy_mc: Introduce copy_mc_generic()
arch/powerpc/Kconfig | 2
arch/powerpc/include/asm/string.h | 2
arch/powerpc/include/asm/uaccess.h | 40 +++--
arch/powerpc/lib/Makefile | 2
arch/powerpc/lib/copy_mc_64.S | 4
arch/x86/Kconfig | 2
arch/x86/Kconfig.debug | 2
arch/x86/include/asm/copy_mc_test.h | 75 +++++++++
arch/x86/include/asm/mcsafe_test.h | 75 ---------
arch/x86/include/asm/string_64.h | 32 ----
arch/x86/include/asm/uaccess.h | 21 +++
arch/x86/include/asm/uaccess_64.h | 20 --
arch/x86/kernel/cpu/mce/core.c | 8 -
arch/x86/kernel/quirks.c | 9 -
arch/x86/lib/Makefile | 1
arch/x86/lib/copy_mc.c | 64 ++++++++
arch/x86/lib/copy_mc_64.S | 165 ++++++++++++++++++++
arch/x86/lib/memcpy_64.S | 115 --------------
arch/x86/lib/usercopy_64.c | 21 ---
drivers/md/dm-writecache.c | 15 +-
drivers/nvdimm/claim.c | 2
drivers/nvdimm/pmem.c | 6 -
include/linux/string.h | 9 -
include/linux/uaccess.h | 9 +
include/linux/uio.h | 10 +
lib/Kconfig | 7 +
lib/iov_iter.c | 43 +++--
tools/arch/x86/include/asm/mcsafe_test.h | 13 --
tools/arch/x86/lib/memcpy_64.S | 115 --------------
tools/objtool/check.c | 5 -
tools/perf/bench/Build | 1
tools/perf/bench/mem-memcpy-x86-64-lib.c | 24 ---
tools/testing/nvdimm/test/nfit.c | 48 +++---
.../testing/selftests/powerpc/copyloops/.gitignore | 2
tools/testing/selftests/powerpc/copyloops/Makefile | 6 -
.../selftests/powerpc/copyloops/copy_mc_64.S | 1
.../selftests/powerpc/copyloops/memcpy_mcsafe_64.S | 1
37 files changed, 451 insertions(+), 526 deletions(-)
rename arch/powerpc/lib/{memcpy_mcsafe_64.S => copy_mc_64.S} (98%)
create mode 100644 arch/x86/include/asm/copy_mc_test.h
delete mode 100644 arch/x86/include/asm/mcsafe_test.h
create mode 100644 arch/x86/lib/copy_mc.c
create mode 100644 arch/x86/lib/copy_mc_64.S
delete mode 100644 tools/arch/x86/include/asm/mcsafe_test.h
delete mode 100644 tools/perf/bench/mem-memcpy-x86-64-lib.c
create mode 120000 tools/testing/selftests/powerpc/copyloops/copy_mc_64.S
delete mode 120000 tools/testing/selftests/powerpc/copyloops/memcpy_mcsafe_64.S
base-commit: bba413deb1065f1291cb1f366247513f11215520
This is the start of the stable review cycle for the 4.4.225 release.
There are 65 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 May 2020 18:36:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.225-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.225-rc1
R. Parameswaran <parameswaran.r7(a)gmail.com>
l2tp: device MTU setup, tunnel socket needs a lock
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: sca3000: Remove an erroneous 'get_device()'
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: release me_cl object reference
Dragos Bogdan <dragos.bogdan(a)analog.com>
staging: iio: ad2s1210: Fix SPI reading
Bob Peterson <rpeterso(a)redhat.com>
Revert "gfs2: Don't demote a glock until its revokes are written"
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise PPP sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: protect sock pointer of struct pppol2tp_session with RCU
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise l2tp_eth sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: don't register sessions in l2tp_session_create()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: fix l2tp_eth module loading
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: pass tunnel pointer to ->session_create()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: prevent creation of sessions on terminated tunnels
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel used while creating sessions with netlink
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while handling genl TUNNEL_GET commands
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while handling genl tunnel updates
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while processing genl delete command
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while looking up sessions in l2tp_netlink
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise session's refcount before making it reachable
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: define parameters of l2tp_tunnel_find*() as "const"
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: define parameters of l2tp_session_get*() as "const"
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: remove l2tp_session_find()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: remove useless duplicate session detection in l2tp_netlink
R. Parameswaran <parameswaran.r7(a)gmail.com>
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
R. Parameswaran <parameswaran.r7(a)gmail.com>
New kernel function to get IP overhead on a socket.
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: export debug flags to UAPI
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: take a reference on sessions used in genetlink handlers
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold session while sending creation notifications
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: lock socket before checking flags in connect()
Vishal Verma <vishal.l.verma(a)intel.com>
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Colin Ian King <colin.king(a)canonical.com>
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Theodore Ts'o <tytso(a)mit.edu>
ext4: lock the xattr block before checksuming it
Brent Lu <brent.lu(a)intel.com>
ALSA: pcm: fix incorrect hw_base increase
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: initialize pd->cpu with effective cpumask
Herbert Xu <herbert(a)gondor.apana.org.au>
padata: Replace delayed timer with immediate workqueue in padata_reorder
Peter Zijlstra <peterz(a)infradead.org>
sched/fair, cpumask: Export for_each_cpu_wrap()
Mathias Krause <minipli(a)googlemail.com>
padata: set cpu_index of unused CPUs to -1
Kevin Hao <haokexin(a)gmail.com>
i2c: dev: Fix the race between the release of i2c_dev and cdev
viresh kumar <viresh.kumar(a)linaro.org>
i2c-dev: don't get i2c adapter via i2c_dev
Dan Carpenter <dan.carpenter(a)oracle.com>
i2c: dev: use after free in detach
Wolfram Sang <wsa(a)the-dreams.de>
i2c: dev: don't start function name with 'return'
Erico Nunes <erico.nunes(a)datacom.ind.br>
i2c: dev: switch from register_chrdev to cdev API
Shuah Khan <shuahkh(a)osg.samsung.com>
media: fix media devnode ioctl/syscall and unregister race
Shuah Khan <shuahkh(a)osg.samsung.com>
media: fix use-after-free in cdev_put() when app exits after driver unbind
Mauro Carvalho Chehab <mchehab(a)osg.samsung.com>
media-device: dynamically allocate struct media_devnode
Mauro Carvalho Chehab <mchehab(a)osg.samsung.com>
media-devnode: fix namespace mess
Max Kellermann <max(a)duempel.org>
media-devnode: add missing mutex lock in error handler
Max Kellermann <max(a)duempel.org>
drivers/media/media-devnode: clear private_data before put_device()
Shuah Khan <shuahkh(a)osg.samsung.com>
media: Fix media_open() to clear filp->private_data in error leg
Thomas Gleixner <tglx(a)linutronix.de>
ARM: futex: Address build warning
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Fix misleading driver bug report
Wu Bo <wubo40(a)huawei.com>
ceph: fix double unlock in handle_cap_export()
Sebastian Reichel <sebastian.reichel(a)collabora.com>
HID: multitouch: add eGalaxTouch P80H84 support
Al Viro <viro(a)zeniv.linux.org.uk>
fix multiplication overflow in copy_fdtable()
Roberto Sassu <roberto.sassu(a)huawei.com>
evm: Check also if *tfm is an error pointer in init_desc()
Mathias Krause <minipli(a)googlemail.com>
padata: ensure padata_do_serial() runs on the correct CPU
Mathias Krause <minipli(a)googlemail.com>
padata: ensure the reorder timer callback runs on the correct CPU
Jason A. Donenfeld <Jason(a)zx2c4.com>
padata: get_next is never NULL
Tobias Klauser <tklauser(a)distanz.ch>
padata: Remove unused but set variables
Cao jin <caoj.fnst(a)cn.fujitsu.com>
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
-------------
Diffstat:
Documentation/networking/l2tp.txt | 8 +-
Makefile | 4 +-
arch/arm/include/asm/futex.h | 9 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-multitouch.c | 3 +
drivers/i2c/i2c-dev.c | 60 +++---
drivers/media/media-device.c | 43 +++--
drivers/media/media-devnode.c | 168 +++++++++-------
drivers/media/usb/uvc/uvc_driver.c | 2 +-
drivers/misc/mei/client.c | 2 +
drivers/net/ethernet/intel/igb/igb_main.c | 4 +-
drivers/nvdimm/btt.c | 8 +-
drivers/platform/x86/alienware-wmi.c | 17 +-
drivers/platform/x86/asus-nb-wmi.c | 24 +++
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
drivers/staging/iio/resolver/ad2s1210.c | 17 +-
drivers/usb/core/message.c | 4 +-
fs/ceph/caps.c | 1 +
fs/ext4/xattr.c | 66 ++++---
fs/file.c | 2 +-
fs/gfs2/glock.c | 3 -
include/linux/cpumask.h | 17 ++
include/linux/net.h | 3 +
include/linux/padata.h | 13 +-
include/media/media-device.h | 5 +-
include/media/media-devnode.h | 32 +++-
include/net/ipv6.h | 2 +
include/uapi/linux/if_pppol2tp.h | 13 +-
include/uapi/linux/l2tp.h | 17 +-
kernel/padata.c | 88 ++++-----
lib/cpumask.c | 32 ++++
net/ipv6/datagram.c | 4 +-
net/l2tp/l2tp_core.c | 181 ++++++-----------
net/l2tp/l2tp_core.h | 47 +++--
net/l2tp/l2tp_eth.c | 216 +++++++++++++--------
net/l2tp/l2tp_ip.c | 68 ++++---
net/l2tp/l2tp_ip6.c | 82 ++++----
net/l2tp/l2tp_netlink.c | 124 +++++++-----
net/l2tp/l2tp_ppp.c | 309 ++++++++++++++++++------------
net/socket.c | 46 +++++
security/integrity/evm/evm_crypto.c | 2 +-
sound/core/pcm_lib.c | 1 +
42 files changed, 1014 insertions(+), 736 deletions(-)
Since the driver was first introduced into the kernel, it has only
handled the ciphers associated with WEP, WPA, and WPA2. It fails with
WPA3 even though mac80211 can handle those additional ciphers in software,
b43legacy did not report that it could handle them. By setting MFP_CAPABLE using
ieee80211_set_hw(), the problem is fixed.
With this change, b43legacy will handle the ciohers it knows in hardare,
and let mac80211 handle the others in software. It is not necessary to
use the module parameter NOHWCRYPT to turn hardware encryption off.
Although this change essentially eliminates that module parameter,
I am choosing to keep it for cases where the hardware is broken,
and software encryption is required for all ciphers.
This patch fixes a problem that has been in b43legacy since commit
75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx
devices").
Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Larry Finger <Larry.Finger(a)lwfinger.net>
Cc: Stable <stable(a)vger.kernel.org>
---
drivers/net/wireless/broadcom/b43legacy/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
index 8b6b657c4b85..5208a39fd6f7 100644
--- a/drivers/net/wireless/broadcom/b43legacy/main.c
+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
@@ -3801,6 +3801,7 @@ static int b43legacy_wireless_init(struct ssb_device *dev)
/* fill hw info */
ieee80211_hw_set(hw, RX_INCLUDES_FCS);
ieee80211_hw_set(hw, SIGNAL_DBM);
+ ieee80211_hw_set(hw, MFP_CAPABLE); /* Allow WPA3 in software */
hw->wiphy->interface_modes =
BIT(NL80211_IFTYPE_AP) |
--
2.26.2
This is the start of the stable review cycle for the 4.9.225 release.
There are 64 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 May 2020 18:36:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.225-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.225-rc1
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: sca3000: Remove an erroneous 'get_device()'
John Hubbard <jhubbard(a)nvidia.com>
rapidio: fix an error in get_user_pages_fast() error handling
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: release me_cl object reference
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
Oscar Carter <oscar.carter(a)gmx.com>
staging: greybus: Fix uninitialized scalar variable
Dragos Bogdan <dragos.bogdan(a)analog.com>
staging: iio: ad2s1210: Fix SPI reading
Bob Peterson <rpeterso(a)redhat.com>
Revert "gfs2: Don't demote a glock until its revokes are written"
Arjun Vynipadath <arjun(a)chelsio.com>
cxgb4/cxgb4vf: Fix mac_hlist initialization and free
Arjun Vynipadath <arjun(a)chelsio.com>
cxgb4: free mac_hlist properly
Vishal Verma <vishal.l.verma(a)intel.com>
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Colin Ian King <colin.king(a)canonical.com>
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Arnd Bergmann <arnd(a)arndb.de>
ubsan: build ubsan.c more conservatively
Peter Zijlstra <peterz(a)infradead.org>
x86/uaccess, ubsan: Fix UBSAN vs. SMAP
R. Parameswaran <parameswaran.r7(a)gmail.com>
l2tp: device MTU setup, tunnel socket needs a lock
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
Brent Lu <brent.lu(a)intel.com>
ALSA: pcm: fix incorrect hw_base increase
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise PPP sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: protect sock pointer of struct pppol2tp_session with RCU
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise l2tp_eth sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: don't register sessions in l2tp_session_create()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: fix l2tp_eth module loading
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: pass tunnel pointer to ->session_create()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: prevent creation of sessions on terminated tunnels
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel used while creating sessions with netlink
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while handling genl TUNNEL_GET commands
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while handling genl tunnel updates
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while processing genl delete command
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: hold tunnel while looking up sessions in l2tp_netlink
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise session's refcount before making it reachable
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: define parameters of l2tp_tunnel_find*() as "const"
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: define parameters of l2tp_session_get*() as "const"
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: remove l2tp_session_find()
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: remove useless duplicate session detection in l2tp_netlink
R. Parameswaran <parameswaran.r7(a)gmail.com>
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
R. Parameswaran <parameswaran.r7(a)gmail.com>
New kernel function to get IP overhead on a socket.
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
Asbjørn Sloth Tønnesen <asbjorn(a)asbjorn.st>
net: l2tp: export debug flags to UAPI
Kevin Hao <haokexin(a)gmail.com>
watchdog: Fix the race between the release of watchdog_core_data and cdev
Christoph Hellwig <hch(a)lst.de>
arm64: fix the flush_icache_range arguments in machine_kexec
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: initialize pd->cpu with effective cpumask
Herbert Xu <herbert(a)gondor.apana.org.au>
padata: Replace delayed timer with immediate workqueue in padata_reorder
Mathias Krause <minipli(a)googlemail.com>
padata: set cpu_index of unused CPUs to -1
Kevin Hao <haokexin(a)gmail.com>
i2c: dev: Fix the race between the release of i2c_dev and cdev
Thomas Gleixner <tglx(a)linutronix.de>
ARM: futex: Address build warning
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Fix misleading driver bug report
Wu Bo <wubo40(a)huawei.com>
ceph: fix double unlock in handle_cap_export()
Yoshiyuki Kurauchi <ahochauwaaaaa(a)gmail.com>
gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
James Hilliard <james.hilliard1(a)gmail.com>
component: Silence bind error on -EPROBE_DEFER
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
configfs: fix config_item refcnt leak in configfs_rmdir()
Sebastian Reichel <sebastian.reichel(a)collabora.com>
HID: multitouch: add eGalaxTouch P80H84 support
Frédéric Pierret (fepitre) <frederic.pierret(a)qubes-os.org>
gcc-common.h: Update for GCC 10
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
Alexander Monakov <amonakov(a)ispras.ru>
iommu/amd: Fix over-read of ACPI UID from IVRS table
Al Viro <viro(a)zeniv.linux.org.uk>
fix multiplication overflow in copy_fdtable()
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: Fix return value of ima_write_policy()
Roberto Sassu <roberto.sassu(a)huawei.com>
evm: Check also if *tfm is an error pointer in init_desc()
Mathias Krause <minipli(a)googlemail.com>
padata: ensure padata_do_serial() runs on the correct CPU
Mathias Krause <minipli(a)googlemail.com>
padata: ensure the reorder timer callback runs on the correct CPU
Jason A. Donenfeld <Jason(a)zx2c4.com>
padata: get_next is never NULL
Tobias Klauser <tklauser(a)distanz.ch>
padata: Remove unused but set variables
Cao jin <caoj.fnst(a)cn.fujitsu.com>
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
-------------
Diffstat:
Documentation/networking/l2tp.txt | 8 +-
Makefile | 4 +-
arch/arm/include/asm/futex.h | 9 +-
arch/arm64/kernel/machine_kexec.c | 3 +-
drivers/base/component.c | 8 +-
drivers/dma/tegra210-adma.c | 2 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-multitouch.c | 3 +
drivers/i2c/i2c-dev.c | 48 ++--
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
drivers/iio/dac/vf610_dac.c | 1 +
drivers/iommu/amd_iommu_init.c | 9 +-
drivers/misc/mei/client.c | 2 +
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 13 +-
.../net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 +-
drivers/net/ethernet/intel/igb/igb_main.c | 4 +-
drivers/net/gtp.c | 9 +-
drivers/nvdimm/btt.c | 8 +-
drivers/platform/x86/alienware-wmi.c | 17 +-
drivers/platform/x86/asus-nb-wmi.c | 24 ++
drivers/rapidio/devices/rio_mport_cdev.c | 5 +
drivers/staging/greybus/uart.c | 4 +-
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
drivers/staging/iio/resolver/ad2s1210.c | 17 +-
drivers/usb/core/message.c | 4 +-
drivers/watchdog/watchdog_dev.c | 67 ++---
fs/ceph/caps.c | 1 +
fs/configfs/dir.c | 1 +
fs/file.c | 2 +-
fs/gfs2/glock.c | 3 -
include/linux/net.h | 3 +
include/linux/padata.h | 13 +-
include/uapi/linux/if_pppol2tp.h | 13 +-
include/uapi/linux/l2tp.h | 17 +-
kernel/padata.c | 88 +++---
lib/Makefile | 2 +
net/l2tp/l2tp_core.c | 174 ++++--------
net/l2tp/l2tp_core.h | 46 +--
net/l2tp/l2tp_eth.c | 216 ++++++++------
net/l2tp/l2tp_netlink.c | 79 +++---
net/l2tp/l2tp_ppp.c | 309 ++++++++++++---------
net/socket.c | 46 +++
scripts/gcc-plugins/Makefile | 1 +
scripts/gcc-plugins/gcc-common.h | 4 +
security/integrity/evm/evm_crypto.c | 2 +-
security/integrity/ima/ima_fs.c | 3 +-
sound/core/pcm_lib.c | 1 +
47 files changed, 734 insertions(+), 569 deletions(-)
This is the start of the stable review cycle for the 4.14.182 release.
There are 59 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 May 2020 18:36:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.182-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.182-rc1
Fabrice Gasnier <fabrice.gasnier(a)st.com>
iio: adc: stm32-adc: fix device used to request dma
Peter Ujfalusi <peter.ujfalusi(a)ti.com>
iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel()
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks
Qiushi Wu <wu000273(a)umn.edu>
rxrpc: Fix a memory leak in rxkad_verify_response()
John Hubbard <jhubbard(a)nvidia.com>
rapidio: fix an error in get_user_pages_fast() error handling
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: release me_cl object reference
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: sca3000: Remove an erroneous 'get_device()'
Oscar Carter <oscar.carter(a)gmx.com>
staging: greybus: Fix uninitialized scalar variable
Dragos Bogdan <dragos.bogdan(a)analog.com>
staging: iio: ad2s1210: Fix SPI reading
Bob Peterson <rpeterso(a)redhat.com>
Revert "gfs2: Don't demote a glock until its revokes are written"
Arjun Vynipadath <arjun(a)chelsio.com>
cxgb4/cxgb4vf: Fix mac_hlist initialization and free
Arjun Vynipadath <arjun(a)chelsio.com>
cxgb4: free mac_hlist properly
Geert Uytterhoeven <geert+renesas(a)glider.be>
media: fdp1: Fix R-Car M3-N naming in debug message
Vishal Verma <vishal.l.verma(a)intel.com>
libnvdimm/btt: Fix LBA masking during 'free list' population
Vishal Verma <vishal.l.verma(a)intel.com>
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Arnd Bergmann <arnd(a)arndb.de>
ubsan: build ubsan.c more conservatively
Peter Zijlstra <peterz(a)infradead.org>
x86/uaccess, ubsan: Fix UBSAN vs. SMAP
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/64s: Disable STRICT_KERNEL_RWX
Russell Currey <ruscur(a)russell.cc>
powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE
Christophe Leroy <christophe.leroy(a)c-s.fr>
powerpc: restore alphabetic order in Kconfig
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
apparmor: Fix aa_label refcnt leak in policy_update
Brent Lu <brent.lu(a)intel.com>
ALSA: pcm: fix incorrect hw_base increase
Scott Bahling <sbahling(a)suse.com>
ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise PPP sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: protect sock pointer of struct pppol2tp_session with RCU
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: initialise l2tp_eth sessions before registering them
Guillaume Nault <g.nault(a)alphalink.fr>
l2tp: don't register sessions in l2tp_session_create()
Christoph Hellwig <hch(a)lst.de>
arm64: fix the flush_icache_range arguments in machine_kexec
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: initialize pd->cpu with effective cpumask
Herbert Xu <herbert(a)gondor.apana.org.au>
padata: Replace delayed timer with immediate workqueue in padata_reorder
Mathias Krause <minipli(a)googlemail.com>
padata: set cpu_index of unused CPUs to -1
Thomas Gleixner <tglx(a)linutronix.de>
ARM: futex: Address build warning
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Fix misleading driver bug report
Wu Bo <wubo40(a)huawei.com>
ceph: fix double unlock in handle_cap_export()
Yoshiyuki Kurauchi <ahochauwaaaaa(a)gmail.com>
gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
Thomas Gleixner <tglx(a)linutronix.de>
x86/apic: Move TSC deadline timer debug printk
Tyrel Datwyler <tyreld(a)linux.ibm.com>
scsi: ibmvscsi: Fix WARN_ON during event pool release
James Hilliard <james.hilliard1(a)gmail.com>
component: Silence bind error on -EPROBE_DEFER
Stefano Garzarella <sgarzare(a)redhat.com>
vhost/vsock: fix packet delivery order to monitoring devices
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
configfs: fix config_item refcnt leak in configfs_rmdir()
Arun Easi <aeasi(a)marvell.com>
scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV
Sebastian Reichel <sebastian.reichel(a)collabora.com>
HID: multitouch: add eGalaxTouch P80H84 support
Frédéric Pierret (fepitre) <frederic.pierret(a)qubes-os.org>
gcc-common.h: Update for GCC 10
Richard Weinberger <richard(a)nod.at>
ubi: Fix seq_file usage in detailed_erase_block_info debugfs file
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
Alexander Monakov <amonakov(a)ispras.ru>
iommu/amd: Fix over-read of ACPI UID from IVRS table
Al Viro <viro(a)zeniv.linux.org.uk>
fix multiplication overflow in copy_fdtable()
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: Fix return value of ima_write_policy()
Roberto Sassu <roberto.sassu(a)huawei.com>
evm: Check also if *tfm is an error pointer in init_desc()
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
Mathias Krause <minipli(a)googlemail.com>
padata: ensure padata_do_serial() runs on the correct CPU
Mathias Krause <minipli(a)googlemail.com>
padata: ensure the reorder timer callback runs on the correct CPU
Kevin Hao <haokexin(a)gmail.com>
i2c: dev: Fix the race between the release of i2c_dev and cdev
Kevin Hao <haokexin(a)gmail.com>
watchdog: Fix the race between the release of watchdog_core_data and cdev
Shijie Luo <luoshijie1(a)huawei.com>
ext4: add cond_resched() to ext4_protect_reserved_inode
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/futex.h | 9 +-
arch/arm64/kernel/machine_kexec.c | 3 +-
arch/powerpc/Kconfig | 4 +-
arch/x86/kernel/apic/apic.c | 27 +--
arch/x86/kernel/unwind_orc.c | 7 +
drivers/base/component.c | 8 +-
drivers/dma/tegra210-adma.c | 2 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-multitouch.c | 3 +
drivers/i2c/i2c-dev.c | 48 +++--
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
drivers/iio/accel/sca3000.c | 2 +-
drivers/iio/adc/stm32-adc.c | 20 +-
drivers/iio/dac/vf610_dac.c | 1 +
drivers/iommu/amd_iommu_init.c | 9 +-
drivers/media/platform/rcar_fdp1.c | 2 +-
drivers/misc/mei/client.c | 2 +
drivers/mtd/ubi/debug.c | 12 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 13 +-
.../net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 +-
drivers/net/gtp.c | 9 +-
drivers/nvdimm/btt.c | 33 +--
drivers/nvdimm/btt.h | 2 +
drivers/nvdimm/btt_devs.c | 8 +
drivers/platform/x86/asus-nb-wmi.c | 24 +++
drivers/rapidio/devices/rio_mport_cdev.c | 5 +
drivers/scsi/ibmvscsi/ibmvscsi.c | 4 -
drivers/scsi/qla2xxx/qla_mbx.c | 2 +-
drivers/staging/greybus/uart.c | 4 +-
drivers/staging/iio/resolver/ad2s1210.c | 17 +-
drivers/usb/core/message.c | 4 +-
drivers/vhost/vsock.c | 10 +-
drivers/watchdog/watchdog_dev.c | 67 +++---
fs/ceph/caps.c | 1 +
fs/configfs/dir.c | 1 +
fs/ext4/block_validity.c | 1 +
fs/file.c | 2 +-
fs/gfs2/glock.c | 3 -
include/linux/padata.h | 13 +-
kernel/padata.c | 71 +++---
lib/Makefile | 2 +
net/l2tp/l2tp_core.c | 21 +-
net/l2tp/l2tp_core.h | 3 +
net/l2tp/l2tp_eth.c | 99 +++++++--
net/l2tp/l2tp_ppp.c | 238 +++++++++++++--------
net/rxrpc/rxkad.c | 3 +-
scripts/gcc-plugins/Makefile | 1 +
scripts/gcc-plugins/gcc-common.h | 4 +
security/apparmor/apparmorfs.c | 3 +-
security/integrity/evm/evm_crypto.c | 2 +-
security/integrity/ima/ima_crypto.c | 12 +-
security/integrity/ima/ima_fs.c | 3 +-
sound/core/pcm_lib.c | 1 +
sound/pci/ice1712/ice1712.c | 3 +-
55 files changed, 529 insertions(+), 331 deletions(-)
Since
commit 27d13da8782a ("w1: omap-hdq: Simplify driver with PM runtime autosuspend")
was applied,
I did see timeouts and wrong values when reading a bq27000 connected
to hdq of the omap3. This occurred mainly after boot but remained and
only sometimes settled down after several reads.
root@letux:~# time cat /sys/class/power_supply/bq27000-battery/uevent
POWER_SUPPLY_NAME=bq27000-battery
POWER_SUPPLY_STATUS=Discharging
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_VOLTAGE_NOW=0
POWER_SUPPLY_CURRENT_NOW=0
POWER_SUPPLY_CAPACITY=0
POWER_SUPPLY_CAPACITY_LEVEL=Normal
POWER_SUPPLY_TEMP=-2731
POWER_SUPPLY_TIME_TO_EMPTY_NOW=0
POWER_SUPPLY_TIME_TO_EMPTY_AVG=0
POWER_SUPPLY_TIME_TO_FULL_NOW=0
POWER_SUPPLY_TECHNOLOGY=Li-ion
POWER_SUPPLY_CHARGE_FULL=0
POWER_SUPPLY_CHARGE_NOW=0
POWER_SUPPLY_CHARGE_FULL_DESIGN=0
POWER_SUPPLY_CYCLE_COUNT=0
POWER_SUPPLY_ENERGY_NOW=0
POWER_SUPPLY_POWER_AVG=0
POWER_SUPPLY_HEALTH=Good
POWER_SUPPLY_MANUFACTURER=Texas Instruments
real 0m15.761s
user 0m0.001s
sys 0m0.025s
root@letux:~#
Sometimes the effect did disappear after accessing
the device multiple times, speed went up and results
became correct.
All this indicates that some interrupts from the hdq
controller are lost by the driver.
Enabling debugging revealed that there were spurious tx
and rx timeouts, i.e. the driver does not always recognise
interrupts. The main problem is that rx and tx interrupts
share a single variable which was sometimes reset to
0 wiping out other interrupts. And it was overwritten
by a second interrupt, independent of whether the
previous interrupt was already processed or not.
This patch improves interrupt handling to avoid such
races and loss of interrupt flags.
The ideas are:
* only the hdq_isr() sets bits in hdq_status
* it does not reset any bits
* it does wake_up() if any interrupt is pending
* bits are only reset by the read/write/break functions
if they were waited for
* this makes sure that no interrupts can be lost
* rx/tx/timeout bits are completely decoupled from each
other (and not reset all after waiting for any of them)
* which bits to reset is now specified by a new parameter
to hdq_reset_irqstatus()
* hdq_reset_irqstatus() also returns the state before
resetting so that we can encapsulate the spinlock
* this should now handle the case that the write and read
are both already finished quickly before the hdq_write_byte()
ends.
* Or that two interrupts occur in succession before
they are processed by the driver.
Old code may have reset all status bits making the next
hdq_read_byte() timeout.
* the spinlock now always protects changing of bits in function
hdq_reset_irqstatus() which could become a read-write-modify
problem if the interrupt handler tries to read-modify-write
exactly at the same moment
* we add mutex protection also for hdq_write_byte() just to
be safe to not to disturb a hdq_read_byte() triggered by
some other thread/process.
This patch was tested on a GTA04 and results in no
boot problems any more. And first read after boot is now ok:
root@letux:~# time cat /sys/class/power_supply/bq27000-battery/uevent
POWER_SUPPLY_NAME=bq27000-battery
POWER_SUPPLY_STATUS=Discharging
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_VOLTAGE_NOW=3970000
POWER_SUPPLY_CURRENT_NOW=354144
POWER_SUPPLY_CAPACITY=82
POWER_SUPPLY_CAPACITY_LEVEL=Normal
POWER_SUPPLY_TEMP=266
POWER_SUPPLY_TIME_TO_EMPTY_NOW=7680
POWER_SUPPLY_TIME_TO_EMPTY_AVG=7380
POWER_SUPPLY_TECHNOLOGY=Li-ion
POWER_SUPPLY_CHARGE_FULL=934856
POWER_SUPPLY_CHARGE_NOW=763976
POWER_SUPPLY_CHARGE_FULL_DESIGN=1233792
POWER_SUPPLY_CYCLE_COUNT=82
POWER_SUPPLY_ENERGY_NOW=2852840
POWER_SUPPLY_POWER_AVG=1392840
POWER_SUPPLY_HEALTH=Good
POWER_SUPPLY_MANUFACTURER=Texas Instruments
real 0m0.233s
user 0m0.000s
sys 0m0.025s
root@letux:~#
It was also tested with dev_dbg enabled and more
printk that all activities behave correctly, especially
hdq_write_byte(), hdq_read_byte(), omap_hdq_break().
Not tested is omap_w1_triplet().
Fixes: 27d13da8782a ("w1: omap-hdq: Simplify driver with PM runtime autosuspend")
Cc: stable(a)vger.kernel.org # v5.6+
Signed-off-by: H. Nikolaus Schaller <hns(a)goldelico.com>
---
drivers/w1/masters/omap_hdq.c | 62 ++++++++++++++++++++++++-----------
1 file changed, 42 insertions(+), 20 deletions(-)
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index 9f9ec108b189e2..a6484700f3b388 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -54,10 +54,10 @@ MODULE_PARM_DESC(w1_id, "1-wire id for the slave detection in HDQ mode");
struct hdq_data {
struct device *dev;
void __iomem *hdq_base;
- /* lock status update */
+ /* lock read/write/break operations */
struct mutex hdq_mutex;
+ /* interrupt status and a lock for it */
u8 hdq_irqstatus;
- /* device lock */
spinlock_t hdq_spinlock;
/* mode: 0-HDQ 1-W1 */
int mode;
@@ -120,13 +120,18 @@ static int hdq_wait_for_flag(struct hdq_data *hdq_data, u32 offset,
}
/* Clear saved irqstatus after using an interrupt */
-static void hdq_reset_irqstatus(struct hdq_data *hdq_data)
+static u8 hdq_reset_irqstatus(struct hdq_data *hdq_data, u8 bits)
{
unsigned long irqflags;
+ u8 status;
spin_lock_irqsave(&hdq_data->hdq_spinlock, irqflags);
- hdq_data->hdq_irqstatus = 0;
+ status = hdq_data->hdq_irqstatus;
+ /* this is a read-modify-write */
+ hdq_data->hdq_irqstatus &= ~bits;
spin_unlock_irqrestore(&hdq_data->hdq_spinlock, irqflags);
+
+ return status;
}
/* write out a byte and fill *status with HDQ_INT_STATUS */
@@ -135,6 +140,12 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status)
int ret;
u8 tmp_status;
+ ret = mutex_lock_interruptible(&hdq_data->hdq_mutex);
+ if (ret < 0) {
+ ret = -EINTR;
+ goto rtn;
+ }
+
*status = 0;
hdq_reg_out(hdq_data, OMAP_HDQ_TX_DATA, val);
@@ -144,14 +155,15 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status)
OMAP_HDQ_CTRL_STATUS_DIR | OMAP_HDQ_CTRL_STATUS_GO);
/* wait for the TXCOMPLETE bit */
ret = wait_event_timeout(hdq_wait_queue,
- hdq_data->hdq_irqstatus, OMAP_HDQ_TIMEOUT);
+ (hdq_data->hdq_irqstatus & OMAP_HDQ_INT_STATUS_TXCOMPLETE),
+ OMAP_HDQ_TIMEOUT);
+ *status = hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_TXCOMPLETE);
if (ret == 0) {
dev_dbg(hdq_data->dev, "TX wait elapsed\n");
ret = -ETIMEDOUT;
goto out;
}
- *status = hdq_data->hdq_irqstatus;
/* check irqstatus */
if (!(*status & OMAP_HDQ_INT_STATUS_TXCOMPLETE)) {
dev_dbg(hdq_data->dev, "timeout waiting for"
@@ -170,7 +182,8 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status)
}
out:
- hdq_reset_irqstatus(hdq_data);
+ mutex_unlock(&hdq_data->hdq_mutex);
+rtn:
return ret;
}
@@ -181,7 +194,7 @@ static irqreturn_t hdq_isr(int irq, void *_hdq)
unsigned long irqflags;
spin_lock_irqsave(&hdq_data->hdq_spinlock, irqflags);
- hdq_data->hdq_irqstatus = hdq_reg_in(hdq_data, OMAP_HDQ_INT_STATUS);
+ hdq_data->hdq_irqstatus |= hdq_reg_in(hdq_data, OMAP_HDQ_INT_STATUS);
spin_unlock_irqrestore(&hdq_data->hdq_spinlock, irqflags);
dev_dbg(hdq_data->dev, "hdq_isr: %x\n", hdq_data->hdq_irqstatus);
@@ -238,18 +251,19 @@ static int omap_hdq_break(struct hdq_data *hdq_data)
/* wait for the TIMEOUT bit */
ret = wait_event_timeout(hdq_wait_queue,
- hdq_data->hdq_irqstatus, OMAP_HDQ_TIMEOUT);
+ (hdq_data->hdq_irqstatus & OMAP_HDQ_INT_STATUS_TIMEOUT),
+ OMAP_HDQ_TIMEOUT);
+ tmp_status = hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_TIMEOUT);
if (ret == 0) {
dev_dbg(hdq_data->dev, "break wait elapsed\n");
ret = -EINTR;
goto out;
}
- tmp_status = hdq_data->hdq_irqstatus;
/* check irqstatus */
if (!(tmp_status & OMAP_HDQ_INT_STATUS_TIMEOUT)) {
dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x\n",
- tmp_status);
+ tmp_status);
ret = -ETIMEDOUT;
goto out;
}
@@ -278,7 +292,6 @@ static int omap_hdq_break(struct hdq_data *hdq_data)
" return to zero, %x\n", tmp_status);
out:
- hdq_reset_irqstatus(hdq_data);
mutex_unlock(&hdq_data->hdq_mutex);
rtn:
return ret;
@@ -309,12 +322,15 @@ static int hdq_read_byte(struct hdq_data *hdq_data, u8 *val)
*/
wait_event_timeout(hdq_wait_queue,
(hdq_data->hdq_irqstatus
- & OMAP_HDQ_INT_STATUS_RXCOMPLETE),
+ & (OMAP_HDQ_INT_STATUS_RXCOMPLETE |
+ OMAP_HDQ_INT_STATUS_TIMEOUT)),
OMAP_HDQ_TIMEOUT);
-
+ status = hdq_reset_irqstatus(hdq_data,
+ OMAP_HDQ_INT_STATUS_RXCOMPLETE |
+ OMAP_HDQ_INT_STATUS_TIMEOUT);
hdq_reg_merge(hdq_data, OMAP_HDQ_CTRL_STATUS, 0,
OMAP_HDQ_CTRL_STATUS_DIR);
- status = hdq_data->hdq_irqstatus;
+
/* check irqstatus */
if (!(status & OMAP_HDQ_INT_STATUS_RXCOMPLETE)) {
dev_dbg(hdq_data->dev, "timeout waiting for"
@@ -322,11 +338,12 @@ static int hdq_read_byte(struct hdq_data *hdq_data, u8 *val)
ret = -ETIMEDOUT;
goto out;
}
+ } else { /* interrupt had occurred before hdq_read_byte was called */
+ hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_RXCOMPLETE);
}
/* the data is ready. Read it in! */
*val = hdq_reg_in(hdq_data, OMAP_HDQ_RX_DATA);
out:
- hdq_reset_irqstatus(hdq_data);
mutex_unlock(&hdq_data->hdq_mutex);
rtn:
return ret;
@@ -367,15 +384,15 @@ static u8 omap_w1_triplet(void *_hdq, u8 bdir)
(hdq_data->hdq_irqstatus
& OMAP_HDQ_INT_STATUS_RXCOMPLETE),
OMAP_HDQ_TIMEOUT);
+ /* Must clear irqstatus for another RXCOMPLETE interrupt */
+ hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_RXCOMPLETE);
+
if (err == 0) {
dev_dbg(hdq_data->dev, "RX wait elapsed\n");
goto out;
}
id_bit = (hdq_reg_in(_hdq, OMAP_HDQ_RX_DATA) & 0x01);
- /* Must clear irqstatus for another RXCOMPLETE interrupt */
- hdq_reset_irqstatus(hdq_data);
-
/* read comp_bit */
hdq_reg_merge(_hdq, OMAP_HDQ_CTRL_STATUS,
ctrl | OMAP_HDQ_CTRL_STATUS_DIR, mask);
@@ -383,6 +400,9 @@ static u8 omap_w1_triplet(void *_hdq, u8 bdir)
(hdq_data->hdq_irqstatus
& OMAP_HDQ_INT_STATUS_RXCOMPLETE),
OMAP_HDQ_TIMEOUT);
+ /* Must clear irqstatus for another RXCOMPLETE interrupt */
+ hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_RXCOMPLETE);
+
if (err == 0) {
dev_dbg(hdq_data->dev, "RX wait elapsed\n");
goto out;
@@ -409,6 +429,9 @@ static u8 omap_w1_triplet(void *_hdq, u8 bdir)
(hdq_data->hdq_irqstatus
& OMAP_HDQ_INT_STATUS_TXCOMPLETE),
OMAP_HDQ_TIMEOUT);
+ /* Must clear irqstatus for another TXCOMPLETE interrupt */
+ hdq_reset_irqstatus(hdq_data, OMAP_HDQ_INT_STATUS_TXCOMPLETE);
+
if (err == 0) {
dev_dbg(hdq_data->dev, "TX wait elapsed\n");
goto out;
@@ -418,7 +441,6 @@ static u8 omap_w1_triplet(void *_hdq, u8 bdir)
OMAP_HDQ_CTRL_STATUS_SINGLE);
out:
- hdq_reset_irqstatus(hdq_data);
mutex_unlock(&hdq_data->hdq_mutex);
rtn:
pm_runtime_mark_last_busy(hdq_data->dev);
--
2.26.2
The patch below does not apply to the 5.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 441fdee1eaf050ef0040bde0d7af075c1c6a6d8b Mon Sep 17 00:00:00 2001
From: David Howells <dhowells(a)redhat.com>
Date: Wed, 29 Apr 2020 23:48:43 +0100
Subject: [PATCH] rxrpc: Fix ack discard
The Rx protocol has a "previousPacket" field in it that is not handled in
the same way by all protocol implementations. Sometimes it contains the
serial number of the last DATA packet received, sometimes the sequence
number of the last DATA packet received and sometimes the highest sequence
number so far received.
AF_RXRPC is using this to weed out ACKs that are out of date (it's possible
for ACK packets to get reordered on the wire), but this does not work with
OpenAFS which will just stick the sequence number of the last packet seen
into previousPacket.
The issue being seen is that big AFS FS.StoreData RPC (eg. of ~256MiB) are
timing out when partly sent. A trace was captured, with an additional
tracepoint to show ACKs being discarded in rxrpc_input_ack(). Here's an
excerpt showing the problem.
52873.203230: rxrpc_tx_data: c=000004ae DATA ed1a3584:00000002 0002449c q=00024499 fl=09
A DATA packet with sequence number 00024499 has been transmitted (the "q="
field).
...
52873.243296: rxrpc_rx_ack: c=000004ae 00012a2b DLY r=00024499 f=00024497 p=00024496 n=0
52873.243376: rxrpc_rx_ack: c=000004ae 00012a2c IDL r=0002449b f=00024499 p=00024498 n=0
52873.243383: rxrpc_rx_ack: c=000004ae 00012a2d OOS r=0002449d f=00024499 p=0002449a n=2
The Out-Of-Sequence ACK indicates that the server didn't see DATA sequence
number 00024499, but did see seq 0002449a (previousPacket, shown as "p=",
skipped the number, but firstPacket, "f=", which shows the bottom of the
window is set at that point).
52873.252663: rxrpc_retransmit: c=000004ae q=24499 a=02 xp=14581537
52873.252664: rxrpc_tx_data: c=000004ae DATA ed1a3584:00000002 000244bc q=00024499 fl=0b *RETRANS*
The packet has been retransmitted. Retransmission recurs until the peer
says it got the packet.
52873.271013: rxrpc_rx_ack: c=000004ae 00012a31 OOS r=000244a1 f=00024499 p=0002449e n=6
More OOS ACKs indicate that the other packets that are already in the
transmission pipeline are being received. The specific-ACK list is up to 6
ACKs and NAKs.
...
52873.284792: rxrpc_rx_ack: c=000004ae 00012a49 OOS r=000244b9 f=00024499 p=000244b6 n=30
52873.284802: rxrpc_retransmit: c=000004ae q=24499 a=0a xp=63505500
52873.284804: rxrpc_tx_data: c=000004ae DATA ed1a3584:00000002 000244c2 q=00024499 fl=0b *RETRANS*
52873.287468: rxrpc_rx_ack: c=000004ae 00012a4a OOS r=000244ba f=00024499 p=000244b7 n=31
52873.287478: rxrpc_rx_ack: c=000004ae 00012a4b OOS r=000244bb f=00024499 p=000244b8 n=32
At this point, the server's receive window is full (n=32) with presumably 1
NAK'd packet and 31 ACK'd packets. We can't transmit any more packets.
52873.287488: rxrpc_retransmit: c=000004ae q=24499 a=0a xp=61327980
52873.287489: rxrpc_tx_data: c=000004ae DATA ed1a3584:00000002 000244c3 q=00024499 fl=0b *RETRANS*
52873.293850: rxrpc_rx_ack: c=000004ae 00012a4c DLY r=000244bc f=000244a0 p=00024499 n=25
And now we've received an ACK indicating that a DATA retransmission was
received. 7 packets have been processed (the occupied part of the window
moved, as indicated by f= and n=).
52873.293853: rxrpc_rx_discard_ack: c=000004ae r=00012a4c 000244a0<00024499 00024499<000244b8
However, the DLY ACK gets discarded because its previousPacket has gone
backwards (from p=000244b8, in the ACK at 52873.287478 to p=00024499 in the
ACK at 52873.293850).
We then end up in a continuous cycle of retransmit/discard. kafs fails to
update its window because it's discarding the ACKs and can't transmit an
extra packet that would clear the issue because the window is full.
OpenAFS doesn't change the previousPacket value in the ACKs because no new
DATA packets are received with a different previousPacket number.
Fix this by altering the discard check to only discard an ACK based on
previousPacket if there was no advance in the firstPacket. This allows us
to transmit a new packet which will cause previousPacket to advance in the
next ACK.
The check, however, needs to allow for the possibility that previousPacket
may actually have had the serial number placed in it instead - in which
case it will go outside the window and we should ignore it.
Fixes: 1a2391c30c0b ("rxrpc: Fix detection of out of order acks")
Reported-by: Dave Botsch <botsch(a)cnf.cornell.edu>
Signed-off-by: David Howells <dhowells(a)redhat.com>
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 2f22f082a66c..3be4177baf70 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -802,6 +802,30 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
}
}
+/*
+ * Return true if the ACK is valid - ie. it doesn't appear to have regressed
+ * with respect to the ack state conveyed by preceding ACKs.
+ */
+static bool rxrpc_is_ack_valid(struct rxrpc_call *call,
+ rxrpc_seq_t first_pkt, rxrpc_seq_t prev_pkt)
+{
+ rxrpc_seq_t base = READ_ONCE(call->ackr_first_seq);
+
+ if (after(first_pkt, base))
+ return true; /* The window advanced */
+
+ if (before(first_pkt, base))
+ return false; /* firstPacket regressed */
+
+ if (after_eq(prev_pkt, call->ackr_prev_seq))
+ return true; /* previousPacket hasn't regressed. */
+
+ /* Some rx implementations put a serial number in previousPacket. */
+ if (after_eq(prev_pkt, base + call->tx_winsize))
+ return false;
+ return true;
+}
+
/*
* Process an ACK packet.
*
@@ -865,8 +889,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
}
/* Discard any out-of-order or duplicate ACKs (outside lock). */
- if (before(first_soft_ack, call->ackr_first_seq) ||
- before(prev_pkt, call->ackr_prev_seq)) {
+ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
first_soft_ack, call->ackr_first_seq,
prev_pkt, call->ackr_prev_seq);
@@ -882,8 +905,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
spin_lock(&call->input_lock);
/* Discard any out-of-order or duplicate ACKs (inside lock). */
- if (before(first_soft_ack, call->ackr_first_seq) ||
- before(prev_pkt, call->ackr_prev_seq)) {
+ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
first_soft_ack, call->ackr_first_seq,
prev_pkt, call->ackr_prev_seq);
I'm announcing the release of the 4.9.225 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/networking/l2tp.txt | 8
Makefile | 2
arch/arm/include/asm/futex.h | 9
arch/arm64/kernel/machine_kexec.c | 3
drivers/base/component.c | 8
drivers/dma/tegra210-adma.c | 2
drivers/hid/hid-ids.h | 1
drivers/hid/hid-multitouch.c | 3
drivers/i2c/i2c-dev.c | 48 +--
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1
drivers/iio/dac/vf610_dac.c | 1
drivers/iommu/amd_iommu_init.c | 9
drivers/misc/mei/client.c | 2
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 13
drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6
drivers/net/ethernet/intel/igb/igb_main.c | 4
drivers/net/gtp.c | 9
drivers/nvdimm/btt.c | 8
drivers/platform/x86/alienware-wmi.c | 17 -
drivers/platform/x86/asus-nb-wmi.c | 24 +
drivers/rapidio/devices/rio_mport_cdev.c | 5
drivers/staging/greybus/uart.c | 4
drivers/staging/iio/accel/sca3000_ring.c | 2
drivers/staging/iio/resolver/ad2s1210.c | 17 -
drivers/usb/core/message.c | 4
drivers/watchdog/watchdog_dev.c | 67 +---
fs/ceph/caps.c | 1
fs/configfs/dir.c | 1
fs/file.c | 2
fs/gfs2/glock.c | 3
include/linux/net.h | 3
include/linux/padata.h | 13
include/uapi/linux/if_pppol2tp.h | 13
include/uapi/linux/l2tp.h | 17 +
kernel/padata.c | 88 ++---
lib/Makefile | 2
net/l2tp/l2tp_core.c | 174 +++--------
net/l2tp/l2tp_core.h | 46 +-
net/l2tp/l2tp_eth.c | 216 ++++++++-----
net/l2tp/l2tp_netlink.c | 79 ++---
net/l2tp/l2tp_ppp.c | 309 +++++++++++---------
net/socket.c | 46 ++
scripts/gcc-plugins/Makefile | 1
scripts/gcc-plugins/gcc-common.h | 4
security/integrity/evm/evm_crypto.c | 2
security/integrity/ima/ima_fs.c | 3
sound/core/pcm_lib.c | 1
47 files changed, 733 insertions(+), 568 deletions(-)
Al Viro (1):
fix multiplication overflow in copy_fdtable()
Alan Stern (1):
USB: core: Fix misleading driver bug report
Alexander Monakov (1):
iommu/amd: Fix over-read of ACPI UID from IVRS table
Alexander Usyskin (1):
mei: release me_cl object reference
Arjun Vynipadath (2):
cxgb4: free mac_hlist properly
cxgb4/cxgb4vf: Fix mac_hlist initialization and free
Arnd Bergmann (1):
ubsan: build ubsan.c more conservatively
Asbjørn Sloth Tønnesen (3):
net: l2tp: export debug flags to UAPI
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Bob Peterson (1):
Revert "gfs2: Don't demote a glock until its revokes are written"
Brent Lu (1):
ALSA: pcm: fix incorrect hw_base increase
Cao jin (1):
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
Christoph Hellwig (1):
arm64: fix the flush_icache_range arguments in machine_kexec
Christophe JAILLET (4):
i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
iio: sca3000: Remove an erroneous 'get_device()'
Colin Ian King (1):
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Daniel Jordan (2):
padata: initialize pd->cpu with effective cpumask
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Dragos Bogdan (1):
staging: iio: ad2s1210: Fix SPI reading
Frédéric Pierret (fepitre) (1):
gcc-common.h: Update for GCC 10
Greg Kroah-Hartman (1):
Linux 4.9.225
Guillaume Nault (17):
l2tp: remove useless duplicate session detection in l2tp_netlink
l2tp: remove l2tp_session_find()
l2tp: define parameters of l2tp_session_get*() as "const"
l2tp: define parameters of l2tp_tunnel_find*() as "const"
l2tp: initialise session's refcount before making it reachable
l2tp: hold tunnel while looking up sessions in l2tp_netlink
l2tp: hold tunnel while processing genl delete command
l2tp: hold tunnel while handling genl tunnel updates
l2tp: hold tunnel while handling genl TUNNEL_GET commands
l2tp: hold tunnel used while creating sessions with netlink
l2tp: prevent creation of sessions on terminated tunnels
l2tp: pass tunnel pointer to ->session_create()
l2tp: fix l2tp_eth module loading
l2tp: don't register sessions in l2tp_session_create()
l2tp: initialise l2tp_eth sessions before registering them
l2tp: protect sock pointer of struct pppol2tp_session with RCU
l2tp: initialise PPP sessions before registering them
Hans de Goede (1):
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Herbert Xu (1):
padata: Replace delayed timer with immediate workqueue in padata_reorder
James Hilliard (1):
component: Silence bind error on -EPROBE_DEFER
Jason A. Donenfeld (1):
padata: get_next is never NULL
John Hubbard (1):
rapidio: fix an error in get_user_pages_fast() error handling
Kevin Hao (2):
i2c: dev: Fix the race between the release of i2c_dev and cdev
watchdog: Fix the race between the release of watchdog_core_data and cdev
Mathias Krause (3):
padata: ensure the reorder timer callback runs on the correct CPU
padata: ensure padata_do_serial() runs on the correct CPU
padata: set cpu_index of unused CPUs to -1
Oscar Carter (1):
staging: greybus: Fix uninitialized scalar variable
Peter Zijlstra (1):
x86/uaccess, ubsan: Fix UBSAN vs. SMAP
R. Parameswaran (3):
New kernel function to get IP overhead on a socket.
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
l2tp: device MTU setup, tunnel socket needs a lock
Roberto Sassu (2):
evm: Check also if *tfm is an error pointer in init_desc()
ima: Fix return value of ima_write_policy()
Sebastian Reichel (1):
HID: multitouch: add eGalaxTouch P80H84 support
Thomas Gleixner (1):
ARM: futex: Address build warning
Tobias Klauser (1):
padata: Remove unused but set variables
Vishal Verma (1):
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Wu Bo (1):
ceph: fix double unlock in handle_cap_export()
Xiyu Yang (1):
configfs: fix config_item refcnt leak in configfs_rmdir()
Yoshiyuki Kurauchi (1):
gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
I'm announcing the release of the 4.4.225 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/networking/l2tp.txt | 8
Makefile | 2
arch/arm/include/asm/futex.h | 9
drivers/hid/hid-ids.h | 1
drivers/hid/hid-multitouch.c | 3
drivers/i2c/i2c-dev.c | 60 +++--
drivers/media/media-device.c | 43 +++-
drivers/media/media-devnode.c | 168 +++++++++-------
drivers/media/usb/uvc/uvc_driver.c | 2
drivers/misc/mei/client.c | 2
drivers/net/ethernet/intel/igb/igb_main.c | 4
drivers/nvdimm/btt.c | 8
drivers/platform/x86/alienware-wmi.c | 17 -
drivers/platform/x86/asus-nb-wmi.c | 24 ++
drivers/staging/iio/accel/sca3000_ring.c | 2
drivers/staging/iio/resolver/ad2s1210.c | 17 +
drivers/usb/core/message.c | 4
fs/ceph/caps.c | 1
fs/ext4/xattr.c | 66 +++---
fs/file.c | 2
fs/gfs2/glock.c | 3
include/linux/cpumask.h | 19 +
include/linux/net.h | 3
include/linux/padata.h | 13 -
include/media/media-device.h | 5
include/media/media-devnode.h | 32 ++-
include/net/ipv6.h | 2
include/uapi/linux/if_pppol2tp.h | 13 -
include/uapi/linux/l2tp.h | 17 +
kernel/padata.c | 88 +++-----
lib/cpumask.c | 32 +++
net/ipv6/datagram.c | 4
net/l2tp/l2tp_core.c | 181 +++++------------
net/l2tp/l2tp_core.h | 47 ++--
net/l2tp/l2tp_eth.c | 216 ++++++++++++--------
net/l2tp/l2tp_ip.c | 68 +++---
net/l2tp/l2tp_ip6.c | 82 +++----
net/l2tp/l2tp_netlink.c | 124 +++++++-----
net/l2tp/l2tp_ppp.c | 309 +++++++++++++++++-------------
net/socket.c | 46 ++++
security/integrity/evm/evm_crypto.c | 2
sound/core/pcm_lib.c | 1
42 files changed, 1015 insertions(+), 735 deletions(-)
Al Viro (1):
fix multiplication overflow in copy_fdtable()
Alan Stern (1):
USB: core: Fix misleading driver bug report
Alexander Usyskin (1):
mei: release me_cl object reference
Asbjørn Sloth Tønnesen (3):
net: l2tp: export debug flags to UAPI
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Bob Peterson (1):
Revert "gfs2: Don't demote a glock until its revokes are written"
Brent Lu (1):
ALSA: pcm: fix incorrect hw_base increase
Cao jin (1):
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
Christophe JAILLET (1):
iio: sca3000: Remove an erroneous 'get_device()'
Colin Ian King (1):
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Dan Carpenter (1):
i2c: dev: use after free in detach
Daniel Jordan (2):
padata: initialize pd->cpu with effective cpumask
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Dragos Bogdan (1):
staging: iio: ad2s1210: Fix SPI reading
Erico Nunes (1):
i2c: dev: switch from register_chrdev to cdev API
Greg Kroah-Hartman (1):
Linux 4.4.225
Guillaume Nault (22):
l2tp: lock socket before checking flags in connect()
l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
l2tp: hold session while sending creation notifications
l2tp: take a reference on sessions used in genetlink handlers
l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
l2tp: remove useless duplicate session detection in l2tp_netlink
l2tp: remove l2tp_session_find()
l2tp: define parameters of l2tp_session_get*() as "const"
l2tp: define parameters of l2tp_tunnel_find*() as "const"
l2tp: initialise session's refcount before making it reachable
l2tp: hold tunnel while looking up sessions in l2tp_netlink
l2tp: hold tunnel while processing genl delete command
l2tp: hold tunnel while handling genl tunnel updates
l2tp: hold tunnel while handling genl TUNNEL_GET commands
l2tp: hold tunnel used while creating sessions with netlink
l2tp: prevent creation of sessions on terminated tunnels
l2tp: pass tunnel pointer to ->session_create()
l2tp: fix l2tp_eth module loading
l2tp: don't register sessions in l2tp_session_create()
l2tp: initialise l2tp_eth sessions before registering them
l2tp: protect sock pointer of struct pppol2tp_session with RCU
l2tp: initialise PPP sessions before registering them
Hans de Goede (1):
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Herbert Xu (1):
padata: Replace delayed timer with immediate workqueue in padata_reorder
Jason A. Donenfeld (1):
padata: get_next is never NULL
Kevin Hao (1):
i2c: dev: Fix the race between the release of i2c_dev and cdev
Mathias Krause (3):
padata: ensure the reorder timer callback runs on the correct CPU
padata: ensure padata_do_serial() runs on the correct CPU
padata: set cpu_index of unused CPUs to -1
Mauro Carvalho Chehab (2):
media-devnode: fix namespace mess
media-device: dynamically allocate struct media_devnode
Max Kellermann (2):
drivers/media/media-devnode: clear private_data before put_device()
media-devnode: add missing mutex lock in error handler
Michael Kelley (1):
cpumask: Make for_each_cpu_wrap() available on UP as well
Peter Zijlstra (1):
sched/fair, cpumask: Export for_each_cpu_wrap()
R. Parameswaran (3):
New kernel function to get IP overhead on a socket.
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
l2tp: device MTU setup, tunnel socket needs a lock
Roberto Sassu (1):
evm: Check also if *tfm is an error pointer in init_desc()
Sebastian Reichel (1):
HID: multitouch: add eGalaxTouch P80H84 support
Shuah Khan (3):
media: Fix media_open() to clear filp->private_data in error leg
media: fix use-after-free in cdev_put() when app exits after driver unbind
media: fix media devnode ioctl/syscall and unregister race
Theodore Ts'o (1):
ext4: lock the xattr block before checksuming it
Thomas Gleixner (1):
ARM: futex: Address build warning
Tobias Klauser (1):
padata: Remove unused but set variables
Vishal Verma (1):
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Wolfram Sang (1):
i2c: dev: don't start function name with 'return'
Wu Bo (1):
ceph: fix double unlock in handle_cap_export()
viresh kumar (1):
i2c-dev: don't get i2c adapter via i2c_dev
I'm announcing the release of the 4.9.225 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/networking/l2tp.txt | 8
Makefile | 2
arch/arm/include/asm/futex.h | 9
arch/arm64/kernel/machine_kexec.c | 3
drivers/base/component.c | 8
drivers/dma/tegra210-adma.c | 2
drivers/hid/hid-ids.h | 1
drivers/hid/hid-multitouch.c | 3
drivers/i2c/i2c-dev.c | 48 +--
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1
drivers/iio/dac/vf610_dac.c | 1
drivers/iommu/amd_iommu_init.c | 9
drivers/misc/mei/client.c | 2
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 13
drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6
drivers/net/ethernet/intel/igb/igb_main.c | 4
drivers/net/gtp.c | 9
drivers/nvdimm/btt.c | 8
drivers/platform/x86/alienware-wmi.c | 17 -
drivers/platform/x86/asus-nb-wmi.c | 24 +
drivers/rapidio/devices/rio_mport_cdev.c | 5
drivers/staging/greybus/uart.c | 4
drivers/staging/iio/accel/sca3000_ring.c | 2
drivers/staging/iio/resolver/ad2s1210.c | 17 -
drivers/usb/core/message.c | 4
drivers/watchdog/watchdog_dev.c | 67 +---
fs/ceph/caps.c | 1
fs/configfs/dir.c | 1
fs/file.c | 2
fs/gfs2/glock.c | 3
include/linux/net.h | 3
include/linux/padata.h | 13
include/uapi/linux/if_pppol2tp.h | 13
include/uapi/linux/l2tp.h | 17 +
kernel/padata.c | 88 ++---
lib/Makefile | 2
net/l2tp/l2tp_core.c | 174 +++--------
net/l2tp/l2tp_core.h | 46 +-
net/l2tp/l2tp_eth.c | 216 ++++++++-----
net/l2tp/l2tp_netlink.c | 79 ++---
net/l2tp/l2tp_ppp.c | 309 +++++++++++---------
net/socket.c | 46 ++
scripts/gcc-plugins/Makefile | 1
scripts/gcc-plugins/gcc-common.h | 4
security/integrity/evm/evm_crypto.c | 2
security/integrity/ima/ima_fs.c | 3
sound/core/pcm_lib.c | 1
47 files changed, 733 insertions(+), 568 deletions(-)
Al Viro (1):
fix multiplication overflow in copy_fdtable()
Alan Stern (1):
USB: core: Fix misleading driver bug report
Alexander Monakov (1):
iommu/amd: Fix over-read of ACPI UID from IVRS table
Alexander Usyskin (1):
mei: release me_cl object reference
Arjun Vynipadath (2):
cxgb4: free mac_hlist properly
cxgb4/cxgb4vf: Fix mac_hlist initialization and free
Arnd Bergmann (1):
ubsan: build ubsan.c more conservatively
Asbjørn Sloth Tønnesen (3):
net: l2tp: export debug flags to UAPI
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Bob Peterson (1):
Revert "gfs2: Don't demote a glock until its revokes are written"
Brent Lu (1):
ALSA: pcm: fix incorrect hw_base increase
Cao jin (1):
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
Christoph Hellwig (1):
arm64: fix the flush_icache_range arguments in machine_kexec
Christophe JAILLET (4):
i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
iio: sca3000: Remove an erroneous 'get_device()'
Colin Ian King (1):
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Daniel Jordan (2):
padata: initialize pd->cpu with effective cpumask
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Dragos Bogdan (1):
staging: iio: ad2s1210: Fix SPI reading
Frédéric Pierret (fepitre) (1):
gcc-common.h: Update for GCC 10
Greg Kroah-Hartman (1):
Linux 4.9.225
Guillaume Nault (17):
l2tp: remove useless duplicate session detection in l2tp_netlink
l2tp: remove l2tp_session_find()
l2tp: define parameters of l2tp_session_get*() as "const"
l2tp: define parameters of l2tp_tunnel_find*() as "const"
l2tp: initialise session's refcount before making it reachable
l2tp: hold tunnel while looking up sessions in l2tp_netlink
l2tp: hold tunnel while processing genl delete command
l2tp: hold tunnel while handling genl tunnel updates
l2tp: hold tunnel while handling genl TUNNEL_GET commands
l2tp: hold tunnel used while creating sessions with netlink
l2tp: prevent creation of sessions on terminated tunnels
l2tp: pass tunnel pointer to ->session_create()
l2tp: fix l2tp_eth module loading
l2tp: don't register sessions in l2tp_session_create()
l2tp: initialise l2tp_eth sessions before registering them
l2tp: protect sock pointer of struct pppol2tp_session with RCU
l2tp: initialise PPP sessions before registering them
Hans de Goede (1):
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Herbert Xu (1):
padata: Replace delayed timer with immediate workqueue in padata_reorder
James Hilliard (1):
component: Silence bind error on -EPROBE_DEFER
Jason A. Donenfeld (1):
padata: get_next is never NULL
John Hubbard (1):
rapidio: fix an error in get_user_pages_fast() error handling
Kevin Hao (2):
i2c: dev: Fix the race between the release of i2c_dev and cdev
watchdog: Fix the race between the release of watchdog_core_data and cdev
Mathias Krause (3):
padata: ensure the reorder timer callback runs on the correct CPU
padata: ensure padata_do_serial() runs on the correct CPU
padata: set cpu_index of unused CPUs to -1
Oscar Carter (1):
staging: greybus: Fix uninitialized scalar variable
Peter Zijlstra (1):
x86/uaccess, ubsan: Fix UBSAN vs. SMAP
R. Parameswaran (3):
New kernel function to get IP overhead on a socket.
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
l2tp: device MTU setup, tunnel socket needs a lock
Roberto Sassu (2):
evm: Check also if *tfm is an error pointer in init_desc()
ima: Fix return value of ima_write_policy()
Sebastian Reichel (1):
HID: multitouch: add eGalaxTouch P80H84 support
Thomas Gleixner (1):
ARM: futex: Address build warning
Tobias Klauser (1):
padata: Remove unused but set variables
Vishal Verma (1):
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Wu Bo (1):
ceph: fix double unlock in handle_cap_export()
Xiyu Yang (1):
configfs: fix config_item refcnt leak in configfs_rmdir()
Yoshiyuki Kurauchi (1):
gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
I'm announcing the release of the 4.4.225 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/networking/l2tp.txt | 8
Makefile | 2
arch/arm/include/asm/futex.h | 9
drivers/hid/hid-ids.h | 1
drivers/hid/hid-multitouch.c | 3
drivers/i2c/i2c-dev.c | 60 +++--
drivers/media/media-device.c | 43 +++-
drivers/media/media-devnode.c | 168 +++++++++-------
drivers/media/usb/uvc/uvc_driver.c | 2
drivers/misc/mei/client.c | 2
drivers/net/ethernet/intel/igb/igb_main.c | 4
drivers/nvdimm/btt.c | 8
drivers/platform/x86/alienware-wmi.c | 17 -
drivers/platform/x86/asus-nb-wmi.c | 24 ++
drivers/staging/iio/accel/sca3000_ring.c | 2
drivers/staging/iio/resolver/ad2s1210.c | 17 +
drivers/usb/core/message.c | 4
fs/ceph/caps.c | 1
fs/ext4/xattr.c | 66 +++---
fs/file.c | 2
fs/gfs2/glock.c | 3
include/linux/cpumask.h | 19 +
include/linux/net.h | 3
include/linux/padata.h | 13 -
include/media/media-device.h | 5
include/media/media-devnode.h | 32 ++-
include/net/ipv6.h | 2
include/uapi/linux/if_pppol2tp.h | 13 -
include/uapi/linux/l2tp.h | 17 +
kernel/padata.c | 88 +++-----
lib/cpumask.c | 32 +++
net/ipv6/datagram.c | 4
net/l2tp/l2tp_core.c | 181 +++++------------
net/l2tp/l2tp_core.h | 47 ++--
net/l2tp/l2tp_eth.c | 216 ++++++++++++--------
net/l2tp/l2tp_ip.c | 68 +++---
net/l2tp/l2tp_ip6.c | 82 +++----
net/l2tp/l2tp_netlink.c | 124 +++++++-----
net/l2tp/l2tp_ppp.c | 309 +++++++++++++++++-------------
net/socket.c | 46 ++++
security/integrity/evm/evm_crypto.c | 2
sound/core/pcm_lib.c | 1
42 files changed, 1015 insertions(+), 735 deletions(-)
Al Viro (1):
fix multiplication overflow in copy_fdtable()
Alan Stern (1):
USB: core: Fix misleading driver bug report
Alexander Usyskin (1):
mei: release me_cl object reference
Asbjørn Sloth Tønnesen (3):
net: l2tp: export debug flags to UAPI
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Bob Peterson (1):
Revert "gfs2: Don't demote a glock until its revokes are written"
Brent Lu (1):
ALSA: pcm: fix incorrect hw_base increase
Cao jin (1):
igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
Christophe JAILLET (1):
iio: sca3000: Remove an erroneous 'get_device()'
Colin Ian King (1):
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
Dan Carpenter (1):
i2c: dev: use after free in detach
Daniel Jordan (2):
padata: initialize pd->cpu with effective cpumask
padata: purge get_cpu and reorder_via_wq from padata_do_serial
Dragos Bogdan (1):
staging: iio: ad2s1210: Fix SPI reading
Erico Nunes (1):
i2c: dev: switch from register_chrdev to cdev API
Greg Kroah-Hartman (1):
Linux 4.4.225
Guillaume Nault (22):
l2tp: lock socket before checking flags in connect()
l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
l2tp: hold session while sending creation notifications
l2tp: take a reference on sessions used in genetlink handlers
l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
l2tp: remove useless duplicate session detection in l2tp_netlink
l2tp: remove l2tp_session_find()
l2tp: define parameters of l2tp_session_get*() as "const"
l2tp: define parameters of l2tp_tunnel_find*() as "const"
l2tp: initialise session's refcount before making it reachable
l2tp: hold tunnel while looking up sessions in l2tp_netlink
l2tp: hold tunnel while processing genl delete command
l2tp: hold tunnel while handling genl tunnel updates
l2tp: hold tunnel while handling genl TUNNEL_GET commands
l2tp: hold tunnel used while creating sessions with netlink
l2tp: prevent creation of sessions on terminated tunnels
l2tp: pass tunnel pointer to ->session_create()
l2tp: fix l2tp_eth module loading
l2tp: don't register sessions in l2tp_session_create()
l2tp: initialise l2tp_eth sessions before registering them
l2tp: protect sock pointer of struct pppol2tp_session with RCU
l2tp: initialise PPP sessions before registering them
Hans de Goede (1):
platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
Herbert Xu (1):
padata: Replace delayed timer with immediate workqueue in padata_reorder
Jason A. Donenfeld (1):
padata: get_next is never NULL
Kevin Hao (1):
i2c: dev: Fix the race between the release of i2c_dev and cdev
Mathias Krause (3):
padata: ensure the reorder timer callback runs on the correct CPU
padata: ensure padata_do_serial() runs on the correct CPU
padata: set cpu_index of unused CPUs to -1
Mauro Carvalho Chehab (2):
media-devnode: fix namespace mess
media-device: dynamically allocate struct media_devnode
Max Kellermann (2):
drivers/media/media-devnode: clear private_data before put_device()
media-devnode: add missing mutex lock in error handler
Michael Kelley (1):
cpumask: Make for_each_cpu_wrap() available on UP as well
Peter Zijlstra (1):
sched/fair, cpumask: Export for_each_cpu_wrap()
R. Parameswaran (3):
New kernel function to get IP overhead on a socket.
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
l2tp: device MTU setup, tunnel socket needs a lock
Roberto Sassu (1):
evm: Check also if *tfm is an error pointer in init_desc()
Sebastian Reichel (1):
HID: multitouch: add eGalaxTouch P80H84 support
Shuah Khan (3):
media: Fix media_open() to clear filp->private_data in error leg
media: fix use-after-free in cdev_put() when app exits after driver unbind
media: fix media devnode ioctl/syscall and unregister race
Theodore Ts'o (1):
ext4: lock the xattr block before checksuming it
Thomas Gleixner (1):
ARM: futex: Address build warning
Tobias Klauser (1):
padata: Remove unused but set variables
Vishal Verma (1):
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
Wolfram Sang (1):
i2c: dev: don't start function name with 'return'
Wu Bo (1):
ceph: fix double unlock in handle_cap_export()
viresh kumar (1):
i2c-dev: don't get i2c adapter via i2c_dev
From: Andi Kleen <ak(a)linux.intel.com>
Since there seem to be kernel modules floating around that set
FSGSBASE incorrectly, prevent this in the CR4 pinning. Currently
CR4 pinning just checks that bits are set, this also checks
that the FSGSBASE bit is not set, and if it is clears it again.
Note this patch will need to be undone when the full FSGSBASE
patches are merged. But it's a reasonable solution for v5.2+
stable at least. Sadly the older kernels don't have the necessary
infrastructure for this (although a simpler version of this
could be added there too)
Cc: stable(a)vger.kernel.org # v5.2+
Signed-off-by: Andi Kleen <ak(a)linux.intel.com>
---
arch/x86/kernel/cpu/common.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index bed0cb83fe24..1f5b7871ae9a 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -385,6 +385,11 @@ void native_write_cr4(unsigned long val)
/* Warn after we've set the missing bits. */
WARN_ONCE(bits_missing, "CR4 bits went missing: %lx!?\n",
bits_missing);
+ if (val & X86_CR4_FSGSBASE) {
+ WARN_ONCE(1, "CR4 unexpectedly set FSGSBASE!?\n");
+ val &= ~X86_CR4_FSGSBASE;
+ goto set_register;
+ }
}
}
EXPORT_SYMBOL(native_write_cr4);
--
2.25.4
This is a note to let you know that I've just added the patch titled
vt: keyboard: avoid signed integer overflow in k_ascii
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From b86dab054059b970111b5516ae548efaae5b3aae Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Date: Mon, 25 May 2020 16:27:40 -0700
Subject: vt: keyboard: avoid signed integer overflow in k_ascii
When k_ascii is invoked several times in a row there is a potential for
signed integer overflow:
UBSAN: Undefined behaviour in drivers/tty/vt/keyboard.c:888:19 signed integer overflow:
10 * 1111111111 cannot be represented in type 'int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.11 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xce/0x128 lib/dump_stack.c:118
ubsan_epilogue+0xe/0x30 lib/ubsan.c:154
handle_overflow+0xdc/0xf0 lib/ubsan.c:184
__ubsan_handle_mul_overflow+0x2a/0x40 lib/ubsan.c:205
k_ascii+0xbf/0xd0 drivers/tty/vt/keyboard.c:888
kbd_keycode drivers/tty/vt/keyboard.c:1477 [inline]
kbd_event+0x888/0x3be0 drivers/tty/vt/keyboard.c:1495
While it can be worked around by using check_mul_overflow()/
check_add_overflow(), it is better to introduce a separate flag to
signal that number pad is being used to compose a symbol, and
change type of the accumulator from signed to unsigned, thus
avoiding undefined behavior when it overflows.
Reported-by: Kyungtae Kim <kt0755(a)gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200525232740.GA262061@dtor-ws
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/vt/keyboard.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 15d33fa0c925..568b2171f335 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -127,7 +127,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */
static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */
static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */
static bool dead_key_next;
-static int npadch = -1; /* -1 or number assembled on pad */
+
+/* Handles a number being assembled on the number pad */
+static bool npadch_active;
+static unsigned int npadch_value;
+
static unsigned int diacr;
static char rep; /* flag telling character repeat */
@@ -845,12 +849,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag)
shift_state &= ~(1 << value);
/* kludge */
- if (up_flag && shift_state != old_state && npadch != -1) {
+ if (up_flag && shift_state != old_state && npadch_active) {
if (kbd->kbdmode == VC_UNICODE)
- to_utf8(vc, npadch);
+ to_utf8(vc, npadch_value);
else
- put_queue(vc, npadch & 0xff);
- npadch = -1;
+ put_queue(vc, npadch_value & 0xff);
+ npadch_active = false;
}
}
@@ -868,7 +872,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
{
- int base;
+ unsigned int base;
if (up_flag)
return;
@@ -882,10 +886,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
base = 16;
}
- if (npadch == -1)
- npadch = value;
- else
- npadch = npadch * base + value;
+ if (!npadch_active) {
+ npadch_value = 0;
+ npadch_active = true;
+ }
+
+ npadch_value = npadch_value * base + value;
}
static void k_lock(struct vc_data *vc, unsigned char value, char up_flag)
--
2.26.2
This is a note to let you know that I've just added the patch titled
nvmem: qfprom: remove incorrect write support
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 8d9eb0d6d59a5d7028c80a30831143d3e75515a7 Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Date: Fri, 22 May 2020 12:33:41 +0100
Subject: nvmem: qfprom: remove incorrect write support
qfprom has different address spaces for read and write. Reads are
always done from corrected address space, where as writes are done
on raw address space.
Writing to corrected address space is invalid and ignored, so it
does not make sense to have this support in the driver which only
supports corrected address space regions at the moment.
Fixes: 4ab11996b489 ("nvmem: qfprom: Add Qualcomm QFPROM support.")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Reviewed-by: Douglas Anderson <dianders(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200522113341.7728-1-srinivas.kandagatla@linaro.…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/nvmem/qfprom.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
index d057f1bfb2e9..8a91717600be 100644
--- a/drivers/nvmem/qfprom.c
+++ b/drivers/nvmem/qfprom.c
@@ -27,25 +27,11 @@ static int qfprom_reg_read(void *context,
return 0;
}
-static int qfprom_reg_write(void *context,
- unsigned int reg, void *_val, size_t bytes)
-{
- struct qfprom_priv *priv = context;
- u8 *val = _val;
- int i = 0, words = bytes;
-
- while (words--)
- writeb(*val++, priv->base + reg + i++);
-
- return 0;
-}
-
static struct nvmem_config econfig = {
.name = "qfprom",
.stride = 1,
.word_size = 1,
.reg_read = qfprom_reg_read,
- .reg_write = qfprom_reg_write,
};
static int qfprom_probe(struct platform_device *pdev)
--
2.26.2
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.42-1…
-------------------------------------------------------------------------------
stable-rc/linux-5.4.y boot: 151 boots: 2 failed, 139 passed with 5 offline, 5 untried/unknown (v5.4.42-112-g00dd3347ad64)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-5.4.y/kernel/v5.4.42-112-…
Tree: stable-rc
Branch: linux-5.4.y
Git Describe: v5.4.42-112-g00dd3347ad64
Git Commit: 00dd3347ad64830e7d9a5a6bd3036b9537887208
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 94 unique boards, 25 SoC families, 19 builds out of 166
Boot Regressions Detected:
arm:
multi_v7_defconfig:
gcc-8:
omap3-beagle-xm:
lab-baylibre: new failure (last pass: v5.4.42-105-g3cb79944b65a)
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 108 days (last pass: v5.4.17-99-gbd0c6624a110 - first fail: v5.4.17-238-gbffcaa93483d)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 49 days (last pass: v5.4.30-37-g40da5db79b55 - first fail: v5.4.30-39-g23c04177b89f)
Boot Failures Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
multi_v7_defconfig:
gcc-8:
omap3-beagle-xm: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
---
For more info write to <info(a)kernelci.org>
This is a note to let you know that I've just added the patch titled
serial: 8250: Enable 16550A variants by default on non-x86
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 15a3f03d5ec0118f1e5db3fc1018686e72744e37 Mon Sep 17 00:00:00 2001
From: Josh Triplett <josh(a)joshtriplett.org>
Date: Tue, 26 May 2020 09:13:57 -0700
Subject: serial: 8250: Enable 16550A variants by default on non-x86
Some embedded devices still use these serial ports; make sure they're
still enabled by default on architectures more likely to have them, to
avoid rendering someone's console unavailable.
Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com>
Reported-by: Maxim Kochetkov <fido_max(a)inbox.ru>
Fixes: dc56ecb81a0a ("serial: 8250: Support disabling mdelay-filled probes of 16550A variants")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Josh Triplett <josh(a)joshtriplett.org>
Link: https://lore.kernel.org/r/a20b5fb7dd295cfb48160eecf4bdebd76332d67d.15905094…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/8250/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index af0688156dd0..8195a31519ea 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -63,6 +63,7 @@ config SERIAL_8250_PNP
config SERIAL_8250_16550A_VARIANTS
bool "Support for variants of the 16550A serial port"
depends on SERIAL_8250
+ default !X86
help
The 8250 driver can probe for many variants of the venerable 16550A
serial port. Doing so takes additional time at boot.
--
2.26.2
This is a note to let you know that I've just added the patch titled
tty: hvc_console, fix crashes on parallel open/close
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 24eb2377f977fe06d84fca558f891f95bc28a449 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby(a)suse.cz>
Date: Tue, 26 May 2020 16:56:32 +0200
Subject: tty: hvc_console, fix crashes on parallel open/close
hvc_open sets tty->driver_data to NULL when open fails at some point.
Typically, the failure happens in hp->ops->notifier_add(). If there is
a racing process which tries to open such mangled tty, which was not
closed yet, the process will crash in hvc_open as tty->driver_data is
NULL.
All this happens because close wants to know whether open failed or not.
But ->open should not NULL this and other tty fields for ->close to be
happy. ->open should call tty_port_set_initialized(true) and close
should check by tty_port_initialized() instead. So do this properly in
this driver.
So this patch removes these from ->open:
* tty_port_tty_set(&hp->port, NULL). This happens on last close.
* tty->driver_data = NULL. Dtto.
* tty_port_put(&hp->port). This happens in shutdown and until now, this
must have been causing a reference underflow, if I am not missing
something.
Signed-off-by: Jiri Slaby <jslaby(a)suse.cz>
Cc: stable <stable(a)vger.kernel.org>
Reported-and-tested-by: Raghavendra <rananta(a)codeaurora.org>
Link: https://lore.kernel.org/r/20200526145632.13879-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/hvc/hvc_console.c | 23 ++++++++---------------
1 file changed, 8 insertions(+), 15 deletions(-)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 436cc51c92c3..cdcc64ea2554 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -371,15 +371,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
* tty fields and return the kref reference.
*/
if (rc) {
- tty_port_tty_set(&hp->port, NULL);
- tty->driver_data = NULL;
- tty_port_put(&hp->port);
printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc);
- } else
+ } else {
/* We are ready... raise DTR/RTS */
if (C_BAUD(tty))
if (hp->ops->dtr_rts)
hp->ops->dtr_rts(hp, 1);
+ tty_port_set_initialized(&hp->port, true);
+ }
/* Force wakeup of the polling thread */
hvc_kick();
@@ -389,22 +388,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
static void hvc_close(struct tty_struct *tty, struct file * filp)
{
- struct hvc_struct *hp;
+ struct hvc_struct *hp = tty->driver_data;
unsigned long flags;
if (tty_hung_up_p(filp))
return;
- /*
- * No driver_data means that this close was issued after a failed
- * hvc_open by the tty layer's release_dev() function and we can just
- * exit cleanly because the kref reference wasn't made.
- */
- if (!tty->driver_data)
- return;
-
- hp = tty->driver_data;
-
spin_lock_irqsave(&hp->port.lock, flags);
if (--hp->port.count == 0) {
@@ -412,6 +401,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
/* We are done with the tty pointer now. */
tty_port_tty_set(&hp->port, NULL);
+ if (!tty_port_initialized(&hp->port))
+ return;
+
if (C_HUPCL(tty))
if (hp->ops->dtr_rts)
hp->ops->dtr_rts(hp, 0);
@@ -428,6 +420,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
* waking periodically to check chars_in_buffer().
*/
tty_wait_until_sent(tty, HVC_CLOSE_WAIT);
+ tty_port_set_initialized(&hp->port, false);
} else {
if (hp->port.count < 0)
printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
--
2.26.2
This is a note to let you know that I've just added the patch titled
serial: imx: Initialize lock for non-registered console
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 8f065acec7573672dd15916e31d1e9b2e785566c Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Date: Mon, 25 May 2020 13:59:52 +0300
Subject: serial: imx: Initialize lock for non-registered console
The commit a3cb39d258ef
("serial: core: Allow detach and attach serial device for console")
changed a bit logic behind lock initialization since for most of the console
driver it's supposed to have lock already initialized even if console is not
enabled. However, it's not the case for Freescale IMX console.
Initialize lock explicitly in the ->probe().
Note, there is still an open question should or shouldn't not this driver
register console properly.
Fixes: a3cb39d258ef ("serial: core: Allow detach and attach serial device for console")
Reported-by: Guenter Roeck <linux(a)roeck-us.net>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Link: https://lore.kernel.org/r/20200525105952.13744-1-andriy.shevchenko@linux.in…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/imx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 986d902fb7fe..6b078e395931 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2404,6 +2404,9 @@ static int imx_uart_probe(struct platform_device *pdev)
}
}
+ /* We need to initialize lock even for non-registered console */
+ spin_lock_init(&sport->port.lock);
+
imx_uart_ports[sport->port.line] = sport;
platform_set_drvdata(pdev, sport);
--
2.26.2
This is a note to let you know that I've just added the patch titled
CDC-ACM: heed quirk also in error handling
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 97fe809934dd2b0b37dfef3a2fc70417f485d7af Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum(a)suse.com>
Date: Tue, 26 May 2020 14:44:20 +0200
Subject: CDC-ACM: heed quirk also in error handling
If buffers are iterated over in the error case, the lower limits
for quirky devices must be heeded.
Signed-off-by: Oliver Neukum <oneukum(a)suse.com>
Reported-by: Jean Rene Dawin <jdawin(a)math.uni-bielefeld.de>
Fixes: a4e7279cd1d19 ("cdc-acm: introduce a cool down")
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200526124420.22160-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ded8d93834ca..f67088bb8218 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -584,7 +584,7 @@ static void acm_softint(struct work_struct *work)
}
if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
- for (i = 0; i < ACM_NR; i++)
+ for (i = 0; i < acm->rx_buflimit; i++)
if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
acm_submit_read_urb(acm, i, GFP_NOIO);
}
--
2.26.2
This is a note to let you know that I've just added the patch titled
staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the staging-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 15ea976a1f12b5fd76b1bd6ff3eb5132fd28047f Mon Sep 17 00:00:00 2001
From: Pascal Terjan <pterjan(a)google.com>
Date: Sat, 23 May 2020 22:12:47 +0100
Subject: staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
The value in shared headers was fixed 9 years ago in commit 8d661f1e462d
("ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro") and
while looking at using shared headers for other duplicated constants
I noticed this driver uses the old value.
The macros are also defined twice in this file so I am deleting the
second definition.
Signed-off-by: Pascal Terjan <pterjan(a)google.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200523211247.23262-1-pterjan@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8712/wifi.h | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h
index be731f1a2209..91b65731fcaa 100644
--- a/drivers/staging/rtl8712/wifi.h
+++ b/drivers/staging/rtl8712/wifi.h
@@ -440,7 +440,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
/* block-ack parameters */
#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
@@ -532,13 +532,6 @@ struct ieee80211_ht_addt_info {
#define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004
#define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010
-/* block-ack parameters */
-#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
-#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
-#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
-#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
-
/*
* A-PMDU buffer sizes
* According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
--
2.26.2
When we push a virtual request onto the HW, we update the rq->engine to
point to the physical engine. A request that is then submitted by the
user that waits upon the virtual engine, but along the physical engine
in use, will then see that it is due to be submitted to the same engine
and take a shortcut (and be queued without waiting for the completion
fence). However, the virtual request may be preempted (either by higher
priority users, or by timeslicing) and removed from the physical engine
to be migrated over to one of its siblings. The dependent normal request
however is oblivious to the removal of the virtual request and remains
queued to execute on HW, believing that once it reaches the head of its
queue all of its predecessors will have completed executing!
v2: Beware restriction of signal->execution_mask prior to submission.
Fixes: 6d06779e8672 ("drm/i915: Load balancing across a virtual engine")
Testcase: igt/gem_exec_balancer/sliced
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v5.3+
---
drivers/gpu/drm/i915/i915_request.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index 33bbad623e02..0b07ccc7e9bc 100644
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -1237,6 +1237,25 @@ i915_request_await_execution(struct i915_request *rq,
return 0;
}
+static int
+await_request_submit(struct i915_request *to, struct i915_request *from)
+{
+ /*
+ * If we are waiting on a virtual engine, then it may be
+ * constrained to execute on a single engine *prior* to submission.
+ * When it is submitted, it will be first submitted to the virtual
+ * engine and then passed to the physical engine. We cannot allow
+ * the waiter to be submitted immediately to the physical engine
+ * as it may then bypass the virtual request.
+ */
+ if (to->engine == READ_ONCE(from->engine))
+ return i915_sw_fence_await_sw_fence_gfp(&to->submit,
+ &from->submit,
+ I915_FENCE_GFP);
+ else
+ return __i915_request_await_execution(to, from, NULL);
+}
+
static int
i915_request_await_request(struct i915_request *to, struct i915_request *from)
{
@@ -1258,10 +1277,8 @@ i915_request_await_request(struct i915_request *to, struct i915_request *from)
return ret;
}
- if (to->engine == READ_ONCE(from->engine))
- ret = i915_sw_fence_await_sw_fence_gfp(&to->submit,
- &from->submit,
- I915_FENCE_GFP);
+ if (is_power_of_2(to->execution_mask | READ_ONCE(from->execution_mask)))
+ ret = await_request_submit(to, from);
else
ret = emit_semaphore_wait(to, from, I915_FENCE_GFP);
if (ret < 0)
--
2.20.1
This is a note to let you know that I've just added the patch titled
software node: implement software_node_unregister()
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 46d26819a5056f4831649c5887ad5c71a16d86f7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Date: Sun, 24 May 2020 17:30:40 +0200
Subject: software node: implement software_node_unregister()
Sometimes it is better to unregister individual nodes instead of trying
to do them all at once with software_node_unregister_nodes(), so create
software_node_unregister() so that you can unregister them one at a
time.
This is especially important when creating nodes in a hierarchy, with
parent -> children representations. Children always need to be removed
before a parent is, as the swnode logic assumes this is going to be the
case.
Fix up the lib/test_printf.c fwnode_pointer() test which to use this new
function as it had the problem of tearing things down in the backwards
order.
Fixes: f1ce39df508d ("lib/test_printf: Add tests for %pfw printk modifier")
Cc: stable <stable(a)vger.kernel.org>
Cc: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: Brendan Higgins <brendanhiggins(a)google.com>
Cc: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Cc: Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
Cc: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com>
Cc: Steven Rostedt <rostedt(a)goodmis.org>
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Reported-by: kernel test robot <rong.a.chen(a)intel.com>
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Tested-by: Petr Mladek <pmladek(a)suse.com>
Tested-by: Randy Dunlap <rdunlap(a)infradead.org>
Tested-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Acked-by: Randy Dunlap <rdunlap(a)infradead.org>
Link: https://lore.kernel.org/r/20200524153041.2361-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/base/swnode.c | 27 +++++++++++++++++++++------
include/linux/property.h | 1 +
lib/test_printf.c | 4 +++-
3 files changed, 25 insertions(+), 7 deletions(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index de8d3543e8fe..770b1f47a625 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -712,17 +712,18 @@ EXPORT_SYMBOL_GPL(software_node_register_nodes);
* @nodes: Zero terminated array of software nodes to be unregistered
*
* Unregister multiple software nodes at once.
+ *
+ * NOTE: Be careful using this call if the nodes had parent pointers set up in
+ * them before registering. If so, it is wiser to remove the nodes
+ * individually, in the correct order (child before parent) instead of relying
+ * on the sequential order of the list of nodes in the array.
*/
void software_node_unregister_nodes(const struct software_node *nodes)
{
- struct swnode *swnode;
int i;
- for (i = 0; nodes[i].name; i++) {
- swnode = software_node_to_swnode(&nodes[i]);
- if (swnode)
- fwnode_remove_software_node(&swnode->fwnode);
- }
+ for (i = 0; nodes[i].name; i++)
+ software_node_unregister(&nodes[i]);
}
EXPORT_SYMBOL_GPL(software_node_unregister_nodes);
@@ -741,6 +742,20 @@ int software_node_register(const struct software_node *node)
}
EXPORT_SYMBOL_GPL(software_node_register);
+/**
+ * software_node_unregister - Unregister static software node
+ * @node: The software node to be unregistered
+ */
+void software_node_unregister(const struct software_node *node)
+{
+ struct swnode *swnode;
+
+ swnode = software_node_to_swnode(node);
+ if (swnode)
+ fwnode_remove_software_node(&swnode->fwnode);
+}
+EXPORT_SYMBOL_GPL(software_node_unregister);
+
struct fwnode_handle *
fwnode_create_software_node(const struct property_entry *properties,
const struct fwnode_handle *parent)
diff --git a/include/linux/property.h b/include/linux/property.h
index d86de017c689..0d4099b4ce1f 100644
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -441,6 +441,7 @@ int software_node_register_nodes(const struct software_node *nodes);
void software_node_unregister_nodes(const struct software_node *nodes);
int software_node_register(const struct software_node *node);
+void software_node_unregister(const struct software_node *node);
int software_node_notify(struct device *dev, unsigned long action);
diff --git a/lib/test_printf.c b/lib/test_printf.c
index 6b1622f4d7c2..fc63b8959d42 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -637,7 +637,9 @@ static void __init fwnode_pointer(void)
test(second_name, "%pfwP", software_node_fwnode(&softnodes[1]));
test(third_name, "%pfwP", software_node_fwnode(&softnodes[2]));
- software_node_unregister_nodes(softnodes);
+ software_node_unregister(&softnodes[2]);
+ software_node_unregister(&softnodes[1]);
+ software_node_unregister(&softnodes[0]);
}
static void __init
--
2.26.2
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.18…
-------------------------------------------------------------------------------
stable-rc/linux-4.14.y boot: 91 boots: 4 failed, 81 passed with 5 offline, 1 untried/unknown (v4.14.181-60-gce8b534d70e2)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.1…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.181-6…
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.181-60-gce8b534d70e2
Git Commit: ce8b534d70e21cb589da3731a1f61fabda583756
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 58 unique boards, 18 SoC families, 13 builds out of 165
Boot Regressions Detected:
arm:
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 13 days (last pass: v4.14.180 - first fail: v4.14.180-37-gad4fc99d1989)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 96 days (last pass: v4.14.170-141-g00a0113414f7 - first fail: v4.14.171-29-g9cfe30e85240)
arm64:
defconfig:
gcc-8:
meson-gxl-s905x-khadas-vim:
lab-baylibre: new failure (last pass: v4.14.181-59-g2c9e54b6ad6a)
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64:
lab-baylibre: new failure (last pass: v4.14.181-59-g2c9e54b6ad6a)
Boot Failures Detected:
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64: 1 failed lab
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
arm64:
defconfig:
gcc-8:
meson-gxbb-p200: 1 failed lab
meson-gxm-q200: 1 failed lab
Offline Platforms:
arm:
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
---
For more info write to <info(a)kernelci.org>
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.224-…
-------------------------------------------------------------------------------
stable-rc/linux-4.4.y boot: 60 boots: 3 failed, 52 passed with 3 offline, 2 untried/unknown (v4.4.224-66-g147ece171c0d)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.224-66-…
Tree: stable-rc
Branch: linux-4.4.y
Git Describe: v4.4.224-66-g147ece171c0d
Git Commit: 147ece171c0dc02b417f35088182a61e6dac368a
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 42 unique boards, 16 SoC families, 12 builds out of 159
Boot Regressions Detected:
arm:
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 13 days (last pass: v4.4.223 - first fail: v4.4.223-36-g32f5ec9b096d)
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64:
lab-baylibre: new failure (last pass: v4.4.224-38-g1f47601a4296)
Boot Failures Detected:
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64: 1 failed lab
arm:
imx_v4_v5_defconfig:
gcc-8:
imx27-phytec-phycard-s-rdk: 1 failed lab
multi_v5_defconfig:
gcc-8:
imx27-phytec-phycard-s-rdk: 1 failed lab
Offline Platforms:
arm:
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
---
For more info write to <info(a)kernelci.org>
From: Can Guo <cang(a)codeaurora.org>
commit 17c7d35f141ef6158076adf3338f115f64fcf760 upstream.
[Please apply to 5.4-stable and earlier.]
In queuecommand path, if DMA map fails, it bails out with clock held. In
this case, release the clock to keep its usage paired.
[mkp: applied by hand]
Link: https://lore.kernel.org/r/0101016ed3d66395-1b7e7fce-b74d-42ca-a88a-4db78b79…
Reviewed-by: Bean Huo <beanhuo(a)micron.com>
Signed-off-by: Can Guo <cang(a)codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
[EB: resolved cherry-pick conflict caused by newer kernels not having
the clear_bit_unlock() line]
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
drivers/scsi/ufs/ufshcd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 13ab1494c384..bc73181b0405 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -2480,6 +2480,7 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
err = ufshcd_map_sg(hba, lrbp);
if (err) {
+ ufshcd_release(hba);
lrbp->cmd = NULL;
clear_bit_unlock(tag, &hba->lrb_in_use);
goto out;
--
2.27.0.rc0.183.gde8f92d652-goog
This is a note to let you know that I've just added the patch titled
software node: implement software_node_unregister()
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the driver-core-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 46d26819a5056f4831649c5887ad5c71a16d86f7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Date: Sun, 24 May 2020 17:30:40 +0200
Subject: software node: implement software_node_unregister()
Sometimes it is better to unregister individual nodes instead of trying
to do them all at once with software_node_unregister_nodes(), so create
software_node_unregister() so that you can unregister them one at a
time.
This is especially important when creating nodes in a hierarchy, with
parent -> children representations. Children always need to be removed
before a parent is, as the swnode logic assumes this is going to be the
case.
Fix up the lib/test_printf.c fwnode_pointer() test which to use this new
function as it had the problem of tearing things down in the backwards
order.
Fixes: f1ce39df508d ("lib/test_printf: Add tests for %pfw printk modifier")
Cc: stable <stable(a)vger.kernel.org>
Cc: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: Brendan Higgins <brendanhiggins(a)google.com>
Cc: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Cc: Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
Cc: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com>
Cc: Steven Rostedt <rostedt(a)goodmis.org>
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Reported-by: kernel test robot <rong.a.chen(a)intel.com>
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Tested-by: Petr Mladek <pmladek(a)suse.com>
Tested-by: Randy Dunlap <rdunlap(a)infradead.org>
Tested-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Acked-by: Randy Dunlap <rdunlap(a)infradead.org>
Link: https://lore.kernel.org/r/20200524153041.2361-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/base/swnode.c | 27 +++++++++++++++++++++------
include/linux/property.h | 1 +
lib/test_printf.c | 4 +++-
3 files changed, 25 insertions(+), 7 deletions(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index de8d3543e8fe..770b1f47a625 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -712,17 +712,18 @@ EXPORT_SYMBOL_GPL(software_node_register_nodes);
* @nodes: Zero terminated array of software nodes to be unregistered
*
* Unregister multiple software nodes at once.
+ *
+ * NOTE: Be careful using this call if the nodes had parent pointers set up in
+ * them before registering. If so, it is wiser to remove the nodes
+ * individually, in the correct order (child before parent) instead of relying
+ * on the sequential order of the list of nodes in the array.
*/
void software_node_unregister_nodes(const struct software_node *nodes)
{
- struct swnode *swnode;
int i;
- for (i = 0; nodes[i].name; i++) {
- swnode = software_node_to_swnode(&nodes[i]);
- if (swnode)
- fwnode_remove_software_node(&swnode->fwnode);
- }
+ for (i = 0; nodes[i].name; i++)
+ software_node_unregister(&nodes[i]);
}
EXPORT_SYMBOL_GPL(software_node_unregister_nodes);
@@ -741,6 +742,20 @@ int software_node_register(const struct software_node *node)
}
EXPORT_SYMBOL_GPL(software_node_register);
+/**
+ * software_node_unregister - Unregister static software node
+ * @node: The software node to be unregistered
+ */
+void software_node_unregister(const struct software_node *node)
+{
+ struct swnode *swnode;
+
+ swnode = software_node_to_swnode(node);
+ if (swnode)
+ fwnode_remove_software_node(&swnode->fwnode);
+}
+EXPORT_SYMBOL_GPL(software_node_unregister);
+
struct fwnode_handle *
fwnode_create_software_node(const struct property_entry *properties,
const struct fwnode_handle *parent)
diff --git a/include/linux/property.h b/include/linux/property.h
index d86de017c689..0d4099b4ce1f 100644
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -441,6 +441,7 @@ int software_node_register_nodes(const struct software_node *nodes);
void software_node_unregister_nodes(const struct software_node *nodes);
int software_node_register(const struct software_node *node);
+void software_node_unregister(const struct software_node *node);
int software_node_notify(struct device *dev, unsigned long action);
diff --git a/lib/test_printf.c b/lib/test_printf.c
index 6b1622f4d7c2..fc63b8959d42 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -637,7 +637,9 @@ static void __init fwnode_pointer(void)
test(second_name, "%pfwP", software_node_fwnode(&softnodes[1]));
test(third_name, "%pfwP", software_node_fwnode(&softnodes[2]));
- software_node_unregister_nodes(softnodes);
+ software_node_unregister(&softnodes[2]);
+ software_node_unregister(&softnodes[1]);
+ software_node_unregister(&softnodes[0]);
}
static void __init
--
2.26.2
The following commit has been merged into the ras/core branch of tip:
Commit-ID: be69f6c5cd38c457c22f6e718077f6524437369d
Gitweb: https://git.kernel.org/tip/be69f6c5cd38c457c22f6e718077f6524437369d
Author: Tony Luck <tony.luck(a)intel.com>
AuthorDate: Wed, 20 May 2020 09:35:46 -07:00
Committer: Borislav Petkov <bp(a)suse.de>
CommitterDate: Mon, 25 May 2020 22:37:41 +02:00
x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned
An interesting thing happened when a guest Linux instance took a machine
check. The VMM unmapped the bad page from guest physical space and
passed the machine check to the guest.
Linux took all the normal actions to offline the page from the process
that was using it. But then guest Linux crashed because it said there
was a second machine check inside the kernel with this stack trace:
do_memory_failure
set_mce_nospec
set_memory_uc
_set_memory_uc
change_page_attr_set_clr
cpa_flush
clflush_cache_range_opt
This was odd, because a CLFLUSH instruction shouldn't raise a machine
check (it isn't consuming the data). Further investigation showed that
the VMM had passed in another machine check because is appeared that the
guest was accessing the bad page.
Fix is to check the scope of the poison by checking the MCi_MISC register.
If the entire page is affected, then unmap the page. If only part of the
page is affected, then mark the page as uncacheable.
This assumes that VMMs will do the logical thing and pass in the "whole
page scope" via the MCi_MISC register (since they unmapped the entire
page).
[ bp: Adjust to x86/entry changes. ]
Fixes: 284ce4011ba6 ("x86/memory_failure: Introduce {set, clear}_mce_nospec()")
Reported-by: Jue Wang <juew(a)google.com>
Signed-off-by: Tony Luck <tony.luck(a)intel.com>
Signed-off-by: Borislav Petkov <bp(a)suse.de>
Tested-by: Jue Wang <juew(a)google.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lkml.kernel.org/r/20200520163546.GA7977@agluck-desk2.amr.corp.intel…
---
arch/x86/include/asm/set_memory.h | 19 +++++++++++++------
arch/x86/kernel/cpu/mce/core.c | 18 ++++++++++++++----
include/linux/sched.h | 4 +++-
include/linux/set_memory.h | 2 +-
4 files changed, 31 insertions(+), 12 deletions(-)
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index ec2c0a0..5948218 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -86,28 +86,35 @@ int set_direct_map_default_noflush(struct page *page);
extern int kernel_set_to_readonly;
#ifdef CONFIG_X86_64
-static inline int set_mce_nospec(unsigned long pfn)
+/*
+ * Prevent speculative access to the page by either unmapping
+ * it (if we do not require access to any part of the page) or
+ * marking it uncacheable (if we want to try to retrieve data
+ * from non-poisoned lines in the page).
+ */
+static inline int set_mce_nospec(unsigned long pfn, bool unmap)
{
unsigned long decoy_addr;
int rc;
/*
- * Mark the linear address as UC to make sure we don't log more
- * errors because of speculative access to the page.
* We would like to just call:
- * set_memory_uc((unsigned long)pfn_to_kaddr(pfn), 1);
+ * set_memory_XX((unsigned long)pfn_to_kaddr(pfn), 1);
* but doing that would radically increase the odds of a
* speculative access to the poison page because we'd have
* the virtual address of the kernel 1:1 mapping sitting
* around in registers.
* Instead we get tricky. We create a non-canonical address
* that looks just like the one we want, but has bit 63 flipped.
- * This relies on set_memory_uc() properly sanitizing any __pa()
+ * This relies on set_memory_XX() properly sanitizing any __pa()
* results with __PHYSICAL_MASK or PTE_PFN_MASK.
*/
decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63));
- rc = set_memory_uc(decoy_addr, 1);
+ if (unmap)
+ rc = set_memory_np(decoy_addr, 1);
+ else
+ rc = set_memory_uc(decoy_addr, 1);
if (rc)
pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
return rc;
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index ffee8a2..753bc77 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -520,6 +520,14 @@ bool mce_is_memory_error(struct mce *m)
}
EXPORT_SYMBOL_GPL(mce_is_memory_error);
+static bool whole_page(struct mce *m)
+{
+ if (!mca_cfg.ser || !(m->status & MCI_STATUS_MISCV))
+ return true;
+
+ return MCI_MISC_ADDR_LSB(m->misc) >= PAGE_SHIFT;
+}
+
bool mce_is_correctable(struct mce *m)
{
if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
@@ -573,7 +581,7 @@ static int uc_decode_notifier(struct notifier_block *nb, unsigned long val,
pfn = mce->addr >> PAGE_SHIFT;
if (!memory_failure(pfn, 0)) {
- set_mce_nospec(pfn);
+ set_mce_nospec(pfn, whole_page(mce));
mce->kflags |= MCE_HANDLED_UC;
}
@@ -1173,11 +1181,12 @@ static void kill_me_maybe(struct callback_head *cb)
int flags = MF_ACTION_REQUIRED;
pr_err("Uncorrected hardware memory error in user-access at %llx", p->mce_addr);
- if (!(p->mce_status & MCG_STATUS_RIPV))
+
+ if (!p->mce_ripv)
flags |= MF_MUST_KILL;
if (!memory_failure(p->mce_addr >> PAGE_SHIFT, flags)) {
- set_mce_nospec(p->mce_addr >> PAGE_SHIFT);
+ set_mce_nospec(p->mce_addr >> PAGE_SHIFT, p->mce_whole_page);
return;
}
@@ -1331,7 +1340,8 @@ void noinstr do_machine_check(struct pt_regs *regs)
BUG_ON(!on_thread_stack() || !user_mode(regs));
current->mce_addr = m.addr;
- current->mce_status = m.mcgstatus;
+ current->mce_ripv = !!(m.mcgstatus & MCG_STATUS_RIPV);
+ current->mce_whole_page = whole_page(&m);
current->mce_kill_me.func = kill_me_maybe;
if (kill_it)
current->mce_kill_me.func = kill_me_now;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 1d68ee3..6293fc2 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1304,7 +1304,9 @@ struct task_struct {
#ifdef CONFIG_X86_MCE
u64 mce_addr;
- u64 mce_status;
+ __u64 mce_ripv : 1,
+ mce_whole_page : 1,
+ __mce_reserved : 62;
struct callback_head mce_kill_me;
#endif
diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h
index 86281ac..860e0f8 100644
--- a/include/linux/set_memory.h
+++ b/include/linux/set_memory.h
@@ -26,7 +26,7 @@ static inline int set_direct_map_default_noflush(struct page *page)
#endif
#ifndef set_mce_nospec
-static inline int set_mce_nospec(unsigned long pfn)
+static inline int set_mce_nospec(unsigned long pfn, bool unmap)
{
return 0;
}
On Tue, May 26, 2020 at 11:44:18AM -0700, Jue Wang wrote:
> On Tue, May 26, 2020 at 11:03 AM Jue Wang <juew(a)google.com> wrote:
>
> > I tried to test this but my guest image build setup was not able to build
> > from kernel/git/bp/bp.git tip-ras-core branch. It appeared there was some
> > bindeb-pkg issue.
> >
> The bindeb-pkg issue is resolved and I tested the following branch in KVM
> guest and the injected MCE is recovered.
> https://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git/log/?h=tip-ras-co…
Thanks to both of you!
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
On Sun, May 24, 2020 at 09:52:54AM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> ppp: mppe: Revert "ppp: mppe: Add softdep to arc4"
>
> to the 4.4-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> ppp-mppe-revert-ppp-mppe-add-softdep-to-arc4.patch
> and it can be found in the queue-4.4 subdirectory.
I already explained last time that this shouldn't be backported:
https://lore.kernel.org/stable/20190905161642.GA5659@google.com/
The commit message explains it too.
Is there something I could have done last time around to properly prevent this
from being backported, or do I have to continue to be ready to respond to these
emails which can come at arbitrary times forever?
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
Hard for "anyone else" to object to it when you didn't Cc any real mailing lists
(stable-commits doesn't count) and just sent this to me. Lucky I saw this.
- Eric
On Tue, May 26, 2020 at 12:05 AM Saravana Kannan <saravanak(a)google.com> wrote:
>
> When SYNC_STATE_ONLY support was added in commit 05ef983e0d65 ("driver
> core: Add device link support for SYNC_STATE_ONLY flag"),
> SYNC_STATE_ONLY links were treated similar to STATELESS links in terms
> of not blocking consumer probe if the supplier hasn't probed yet.
>
> That caused a SYNC_STATE_ONLY device link's status to not get updated.
> Since SYNC_STATE_ONLY device link is no longer useful once the
> consumer probes, commit 21c27f06587d ("driver core: Fix
> SYNC_STATE_ONLY device link implementation") addresses the status
> update issue by deleting the SYNC_STATE_ONLY device link instead of
> complicating the status update code.
>
> However, there are still some cases where we need to update the status
> of a SYNC_STATE_ONLY device link. A SYNC_STATE_ONLY device link can
> later get converted into a normal MANAGED device link when a normal
> MANAGED device link is created between a supplier and consumer that
> already have a SYNC_STATE_ONLY device link between them. If a
> SYNC_STATE_ONLY device link's status isn't maintained correctly till
> it's converted to a normal MANAGED device link, then the normal
> MANAGED device link will end up with a wrong link status. This can
> cause a warning stack trace[1] when the consumer device probes.
>
> This commit fixes the SYNC_STATE_ONLY device link status update issue
> where it wouldn't transition correctly from DL_STATE_AVAILABLE to
> DL_STATE_CONSUMER_PROBE.
>
> [1] - https://lore.kernel.org/lkml/20200522204120.3b3c9ed6@apollo/
> Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag")
> Fixes: 21c27f06587d ("driver core: Fix SYNC_STATE_ONLY device link implementation")
> Reported-by: Michael Walle <michael(a)walle.cc>
> Signed-off-by: Saravana Kannan <saravanak(a)google.com>
> ---
> Greg,
>
> I think this is the issue Michael ran into. I'd like him to test the fix
> before it's pulled in.
>
> Michael,
>
> If you can test this on the branch you saw the issue in and give a
> Tested-by if it works, that'd be great.
>
> Thanks,
> Saravana
>
> drivers/base/core.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 791b7530599f..9511be3f9a32 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -687,11 +687,11 @@ int device_links_check_suppliers(struct device *dev)
> device_links_write_lock();
>
> list_for_each_entry(link, &dev->links.suppliers, c_node) {
> - if (!(link->flags & DL_FLAG_MANAGED) ||
> - link->flags & DL_FLAG_SYNC_STATE_ONLY)
> + if (!(link->flags & DL_FLAG_MANAGED))
> continue;
>
> - if (link->status != DL_STATE_AVAILABLE) {
> + if (link->status != DL_STATE_AVAILABLE &&
> + !(link->flags & DL_FLAG_SYNC_STATE_ONLY)) {
> device_links_missing_supplier(dev);
> ret = -EPROBE_DEFER;
> break;
> --
> 2.27.0.rc0.183.gde8f92d652-goog
>
Adding stable@ that I forgot to add earlier.
-Saravana
The following commit has been merged into the ras/core branch of tip:
Commit-ID: 3cb1ada80fe29e2fa022b5f20370b65718e0a744
Gitweb: https://git.kernel.org/tip/3cb1ada80fe29e2fa022b5f20370b65718e0a744
Author: Tony Luck <tony.luck(a)intel.com>
AuthorDate: Wed, 20 May 2020 09:35:46 -07:00
Committer: Borislav Petkov <bp(a)suse.de>
CommitterDate: Mon, 25 May 2020 12:46:40 +02:00
x86/{mce,mm}: Change so poison pages are either unmapped or marked uncacheable
An interesting thing happened when a guest Linux instance took a machine
check. The VMM unmapped the bad page from guest physical space and
passed the machine check to the guest.
Linux took all the normal actions to offline the page from the process
that was using it. But then guest Linux crashed because it said there
was a second machine check inside the kernel with this stack trace:
do_memory_failure
set_mce_nospec
set_memory_uc
_set_memory_uc
change_page_attr_set_clr
cpa_flush
clflush_cache_range_opt
This was odd, because a CLFLUSH instruction shouldn't raise a machine
check (it isn't consuming the data). Further investigation showed that
the VMM had passed in another machine check because is appeared that the
guest was accessing the bad page.
Fix is to check the scope of the poison by checking the MCi_MISC register.
If the entire page is affected, then unmap the page. If only part of the
page is affected, then mark the page as uncacheable.
This assumes that VMMs will do the logical thing and pass in the "whole
page scope" via the MCi_MISC register (since they unmapped the entire
page).
Fixes: 284ce4011ba6 ("x86/memory_failure: Introduce {set, clear}_mce_nospec()")
Reported-by: Jue Wang <juew(a)google.com>
Signed-off-by: Tony Luck <tony.luck(a)intel.com>
Signed-off-by: Borislav Petkov <bp(a)suse.de>
Tested-by: Jue Wang <juew(a)google.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lkml.kernel.org/r/20200520163546.GA7977@agluck-desk2.amr.corp.intel…
---
arch/x86/include/asm/set_memory.h | 19 +++++++++++++------
arch/x86/kernel/cpu/mce/core.c | 11 +++++++++--
include/linux/set_memory.h | 2 +-
3 files changed, 23 insertions(+), 9 deletions(-)
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index ec2c0a0..5948218 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -86,28 +86,35 @@ int set_direct_map_default_noflush(struct page *page);
extern int kernel_set_to_readonly;
#ifdef CONFIG_X86_64
-static inline int set_mce_nospec(unsigned long pfn)
+/*
+ * Prevent speculative access to the page by either unmapping
+ * it (if we do not require access to any part of the page) or
+ * marking it uncacheable (if we want to try to retrieve data
+ * from non-poisoned lines in the page).
+ */
+static inline int set_mce_nospec(unsigned long pfn, bool unmap)
{
unsigned long decoy_addr;
int rc;
/*
- * Mark the linear address as UC to make sure we don't log more
- * errors because of speculative access to the page.
* We would like to just call:
- * set_memory_uc((unsigned long)pfn_to_kaddr(pfn), 1);
+ * set_memory_XX((unsigned long)pfn_to_kaddr(pfn), 1);
* but doing that would radically increase the odds of a
* speculative access to the poison page because we'd have
* the virtual address of the kernel 1:1 mapping sitting
* around in registers.
* Instead we get tricky. We create a non-canonical address
* that looks just like the one we want, but has bit 63 flipped.
- * This relies on set_memory_uc() properly sanitizing any __pa()
+ * This relies on set_memory_XX() properly sanitizing any __pa()
* results with __PHYSICAL_MASK or PTE_PFN_MASK.
*/
decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63));
- rc = set_memory_uc(decoy_addr, 1);
+ if (unmap)
+ rc = set_memory_np(decoy_addr, 1);
+ else
+ rc = set_memory_uc(decoy_addr, 1);
if (rc)
pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
return rc;
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 02e1f16..e35aece 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -518,6 +518,13 @@ bool mce_is_memory_error(struct mce *m)
}
EXPORT_SYMBOL_GPL(mce_is_memory_error);
+static bool whole_page(struct mce *m)
+{
+ if (!mca_cfg.ser || !(m->status & MCI_STATUS_MISCV))
+ return true;
+ return MCI_MISC_ADDR_LSB(m->misc) >= PAGE_SHIFT;
+}
+
bool mce_is_correctable(struct mce *m)
{
if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
@@ -571,7 +578,7 @@ static int uc_decode_notifier(struct notifier_block *nb, unsigned long val,
pfn = mce->addr >> PAGE_SHIFT;
if (!memory_failure(pfn, 0)) {
- set_mce_nospec(pfn);
+ set_mce_nospec(pfn, whole_page(mce));
mce->kflags |= MCE_HANDLED_UC;
}
@@ -1069,7 +1076,7 @@ static int do_memory_failure(struct mce *m)
if (ret)
pr_err("Memory error not recovered");
else
- set_mce_nospec(m->addr >> PAGE_SHIFT);
+ set_mce_nospec(m->addr >> PAGE_SHIFT, whole_page(m));
return ret;
}
diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h
index 86281ac..860e0f8 100644
--- a/include/linux/set_memory.h
+++ b/include/linux/set_memory.h
@@ -26,7 +26,7 @@ static inline int set_direct_map_default_noflush(struct page *page)
#endif
#ifndef set_mce_nospec
-static inline int set_mce_nospec(unsigned long pfn)
+static inline int set_mce_nospec(unsigned long pfn, bool unmap)
{
return 0;
}
Hi Greg.
This is for 4.4.
This is a follow-up to "l2tp locking and ordering fixes" for 4.9.
Compared with that series, this pulls in 5 more patches (the first 5
Guillaume Nault ones below) containing more of the same as well as
making later changes apply more cleanly.
As before, every commit compiles with make allmodconfig, but I have no
hardware to test this with.
9dd79945b0f8 (use IS_ENABLED) would have made one patch or so cleaner
but I didn't add it.
There are also bunch of fixes that aren't l2tp locking or ordering
fixes and I didn't add them either. For the record...
Between 4.4 and 4.9:
018f82585823 net: l2tp: fix reversed udp6 checksum flags
56cff471d0c6 l2tp: Fix the connect status check in pppol2tp_getname
286c72deabaa udp: must lock the socket in udp_disconnect()
df90e6886146 l2tp: fix lookup for sockets not bound to a device in l2tp_ip
31e2f21fb35b l2tp: fix address test in __l2tp_ip6_bind_lookup()
Between 4.9 and 4.9.latest:
000224c1106c l2tp: consider '::' as wildcard address in l2tp_ip6 socket lookup
d2d74d0e58b2 l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups
65b05d03a578 l2tp: remove configurable payload offset
b437ed583592 l2tp: Fix possible NULL pointer dereference
Regards,
Giuliano.
Asbjørn Sloth Tønnesen (3):
net: l2tp: export debug flags to UAPI
net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
Guillaume Nault (22):
l2tp: lock socket before checking flags in connect()
l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
l2tp: hold session while sending creation notifications
l2tp: take a reference on sessions used in genetlink handlers
l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
l2tp: remove useless duplicate session detection in l2tp_netlink
l2tp: remove l2tp_session_find()
l2tp: define parameters of l2tp_session_get*() as "const"
l2tp: define parameters of l2tp_tunnel_find*() as "const"
l2tp: initialise session's refcount before making it reachable
l2tp: hold tunnel while looking up sessions in l2tp_netlink
l2tp: hold tunnel while processing genl delete command
l2tp: hold tunnel while handling genl tunnel updates
l2tp: hold tunnel while handling genl TUNNEL_GET commands
l2tp: hold tunnel used while creating sessions with netlink
l2tp: prevent creation of sessions on terminated tunnels
l2tp: pass tunnel pointer to ->session_create()
l2tp: fix l2tp_eth module loading
l2tp: don't register sessions in l2tp_session_create()
l2tp: initialise l2tp_eth sessions before registering them
l2tp: protect sock pointer of struct pppol2tp_session with RCU
l2tp: initialise PPP sessions before registering them
R. Parameswaran (2):
New kernel function to get IP overhead on a socket.
L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
Documentation/networking/l2tp.txt | 8 +-
include/linux/net.h | 3 +
include/net/ipv6.h | 2 +
include/uapi/linux/if_pppol2tp.h | 13 +-
include/uapi/linux/l2tp.h | 17 +-
net/ipv6/datagram.c | 4 +-
net/l2tp/l2tp_core.c | 181 ++++++-----------
net/l2tp/l2tp_core.h | 47 +++--
net/l2tp/l2tp_eth.c | 214 +++++++++++++--------
net/l2tp/l2tp_ip.c | 68 ++++---
net/l2tp/l2tp_ip6.c | 82 ++++----
net/l2tp/l2tp_netlink.c | 124 +++++++-----
net/l2tp/l2tp_ppp.c | 309 ++++++++++++++++++------------
net/socket.c | 46 +++++
14 files changed, 629 insertions(+), 489 deletions(-)
--
2.27.0.rc0.183.gde8f92d652-goog
I hope you are doing great?
This is Felix from Toronto-Canada. I have a lucrative business
offer that will benefit us both immensely within a very short
period of time. However, I need your initial approval of interest
prior to further and complete details regarding the deal.
Thanks,
Felix.
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-5.6.y/kernel/v5.6.14-1…
-------------------------------------------------------------------------------
stable-rc/linux-5.6.y boot: 131 boots: 1 failed, 122 passed with 6 offline, 2 untried/unknown (v5.6.14-121-g8f40203f4915)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-5.6.y/kernel/v5.6.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-5.6.y/kernel/v5.6.14-121-…
Tree: stable-rc
Branch: linux-5.6.y
Git Describe: v5.6.14-121-g8f40203f4915
Git Commit: 8f40203f49158f3292f524ed280268758f8c9f30
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 88 unique boards, 23 SoC families, 20 builds out of 200
Boot Failure Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
davinci_all_defconfig:
gcc-8
da850-evm: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
---
For more info write to <info(a)kernelci.org>
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.19.y/kernel/v4.19.12…
-------------------------------------------------------------------------------
stable-rc/linux-4.19.y boot: 139 boots: 2 failed, 125 passed with 7 offline, 5 untried/unknown (v4.19.124-77-g0708fb235b9c)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.19.y/kernel/v4.1…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.19.y/kernel/v4.19.124-7…
Tree: stable-rc
Branch: linux-4.19.y
Git Describe: v4.19.124-77-g0708fb235b9c
Git Commit: 0708fb235b9c82f3d983e90bdc1a11227512055b
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 80 unique boards, 22 SoC families, 19 builds out of 206
Boot Regressions Detected:
arm:
davinci_all_defconfig:
gcc-8:
da850-evm:
lab-baylibre-seattle: failing since 1 day (last pass: v4.19.123-81-gff1170bc0ae9 - first fail: v4.19.124)
dm365evm,legacy:
lab-baylibre-seattle: failing since 1 day (last pass: v4.19.123-81-gff1170bc0ae9 - first fail: v4.19.124)
omap2plus_defconfig:
gcc-8:
omap3-beagle-xm:
lab-baylibre: new failure (last pass: v4.19.123-81-gff1170bc0ae9)
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 13 days (last pass: v4.19.122 - first fail: v4.19.122-48-g92ba0b6b33ad)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 74 days (last pass: v4.19.108-87-g624c124960e8 - first fail: v4.19.109)
Boot Failures Detected:
arm:
omap2plus_defconfig:
gcc-8:
omap3-beagle-xm: 1 failed lab
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
davinci_all_defconfig:
gcc-8
da850-evm: 1 offline lab
dm365evm,legacy: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
---
For more info write to <info(a)kernelci.org>
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.18…
-------------------------------------------------------------------------------
stable-rc/linux-4.14.y boot: 129 boots: 3 failed, 116 passed with 5 offline, 5 untried/unknown (v4.14.181-59-g2c9e54b6ad6a)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.1…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.181-5…
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.181-59-g2c9e54b6ad6a
Git Commit: 2c9e54b6ad6a1307ba4365dae90d882bc31ada04
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 74 unique boards, 21 SoC families, 17 builds out of 200
Boot Regressions Detected:
arm:
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 13 days (last pass: v4.14.180 - first fail: v4.14.180-37-gad4fc99d1989)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 96 days (last pass: v4.14.170-141-g00a0113414f7 - first fail: v4.14.171-29-g9cfe30e85240)
Boot Failures Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
arm64:
defconfig:
gcc-8:
meson-gxbb-p200: 1 failed lab
meson-gxm-q200: 1 failed lab
Offline Platforms:
arm:
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
---
For more info write to <info(a)kernelci.org>
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.224-…
-------------------------------------------------------------------------------
stable-rc/linux-4.4.y boot: 92 boots: 3 failed, 78 passed with 6 offline, 4 untried/unknown, 1 conflict (v4.4.224-38-g1f47601a4296)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.224-38-…
Tree: stable-rc
Branch: linux-4.4.y
Git Describe: v4.4.224-38-g1f47601a4296
Git Commit: 1f47601a4296940bac6cba8c55ab73ca2453f284
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 48 unique boards, 17 SoC families, 17 builds out of 190
Boot Regressions Detected:
arm:
davinci_all_defconfig:
gcc-8:
da850-evm:
lab-baylibre-seattle: new failure (last pass: v4.4.224)
dm365evm,legacy:
lab-baylibre-seattle: new failure (last pass: v4.4.224)
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 12 days (last pass: v4.4.223 - first fail: v4.4.223-36-g32f5ec9b096d)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 61 days (last pass: v4.4.216-127-g955137020949 - first fail: v4.4.217)
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64:
lab-baylibre: new failure (last pass: v4.4.224)
Boot Failures Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
imx_v4_v5_defconfig:
gcc-8:
imx27-phytec-phycard-s-rdk: 1 failed lab
multi_v5_defconfig:
gcc-8:
imx27-phytec-phycard-s-rdk: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
davinci_all_defconfig:
gcc-8
da850-evm: 1 offline lab
dm365evm,legacy: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
Conflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
x86_64:
x86_64_defconfig:
qemu_x86_64:
lab-baylibre: FAIL (gcc-8)
lab-collabora: PASS (gcc-8)
---
For more info write to <info(a)kernelci.org>
The TLB flush optimisation (a46cc7a90f: powerpc/mm/radix: Improve TLB/PWC
flushes) may result in random memory corruption. Any concurrent page-table walk
could end up with a Use-after-Free. Even on UP this might give issues, since
mmu_gather is preemptible these days. An interrupt or preempted task accessing
user pages might stumble into the free page if the hardware caches page
directories.
The series is a backport of the fix sent by Peter [1].
The first three patches are dependencies for the last patch (avoid potential
double flush). If the performance impact due to double flush is considered
trivial then the first three patches and last patch may be dropped.
This is only for v4.19 stable.
--
Changelog:
v2: Send the patches with the correct format (commit sha1 upstream) for stable
v3: Fix compilation for ppc44x_defconfig and mpc885_ads_defconfig
v4: No change, Resend.
--
Aneesh Kumar K.V (1):
powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case
Peter Zijlstra (4):
asm-generic/tlb: Track freeing of page-table directories in struct
mmu_gather
asm-generic/tlb, arch: Invert CONFIG_HAVE_RCU_TABLE_INVALIDATE
mm/mmu_gather: invalidate TLB correctly on batch allocation failure
and flush
asm-generic/tlb: avoid potential double flush
Will Deacon (1):
asm-generic/tlb: Track which levels of the page tables have been
cleared
arch/Kconfig | 3 -
arch/powerpc/Kconfig | 2 +-
arch/powerpc/include/asm/book3s/32/pgalloc.h | 8 --
arch/powerpc/include/asm/book3s/64/pgalloc.h | 2 -
arch/powerpc/include/asm/nohash/32/pgalloc.h | 8 --
arch/powerpc/include/asm/tlb.h | 11 ++
arch/powerpc/mm/pgtable-book3s64.c | 7 --
arch/sparc/include/asm/tlb_64.h | 9 ++
arch/x86/Kconfig | 1 -
include/asm-generic/tlb.h | 103 ++++++++++++++++---
mm/memory.c | 20 ++--
11 files changed, 122 insertions(+), 52 deletions(-)
--
2.25.4
Build reference: v5.4.42-105-g3cb79944b65a
gcc version: sh4-linux-gcc (GCC) 9.3.0
Building sh:defconfig ... failed
net/socket.c: In function 'sock_ioctl':
arch/sh/include/uapi/asm/sockios.h:16:41: error: invalid application of 'sizeof' to incomplete type 'struct __kernel_old_timespec'
and various other similar errors.
Guenter
Building x86_64:allyesconfig ... failed
--------------
Error log:
drivers/edac/ghes_edac.c: In function 'get_dimm_smbios_index':
drivers/edac/ghes_edac.c:79:29: error: 'ghes_pvt' undeclared (first use in this function)
79 | struct mem_ctl_info *mci = ghes_pvt->mci;
| ^~~~~~~~
drivers/edac/ghes_edac.c:79:29: note: each undeclared identifier is reported only once for each function it appears in
Guenter
When we push a virtual request onto the HW, we update the rq->engine to
point to the physical engine. A request that is then submitted by the
user that waits upon the virtual engine, but along the physical engine
in use, will then see that it is due to be submitted to the same engine
and take a shortcut (and be queued without waiting for the completion
fence). However, the virtual request may be preempted (either by higher
priority users, or by timeslicing) and removed from the physical engine
to be migrated over to one of its siblings. The dependent normal request
however is oblivious to the removal of the virtual request and remains
queued to execute on HW, believing that once it reaches the head of its
queue all of its predecessors will have completed executing!
Fixes: 6d06779e8672 ("drm/i915: Load balancing across a virtual engine")
Testcase: igt/gem_exec_balancer/sliced
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v5.3+
---
drivers/gpu/drm/i915/i915_request.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index c282719ad3ac..51588209bddd 100644
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -1074,7 +1074,7 @@ i915_request_await_request(struct i915_request *to, struct i915_request *from)
return ret;
}
- if (to->engine == from->engine)
+ if (is_power_of_2(to->execution_mask | READ_ONCE(from->execution_mask)))
ret = i915_sw_fence_await_sw_fence_gfp(&to->submit,
&from->submit,
I915_FENCE_GFP);
--
2.20.1
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 52cd91c27f3908b88e8b25aed4a4d20660abcc45 Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier(a)st.com>
Date: Thu, 30 Apr 2020 11:28:45 +0200
Subject: [PATCH] iio: adc: stm32-adc: fix device used to request dma
DMA channel request should use device struct from platform device struct.
Currently it's using iio device struct. But at this stage when probing,
device struct isn't yet registered (e.g. device_register is done in
iio_device_register). Since commit 71723a96b8b1 ("dmaengine: Create
symlinks between DMA channels and slaves"), a warning message is printed
as the links in sysfs can't be created, due to device isn't yet registered:
- Cannot create DMA slave symlink
- Cannot create DMA dma:rx symlink
Fix this by using device struct from platform device to request dma chan.
Fixes: 2763ea0585c99 ("iio: adc: stm32: add optional dma support")
Signed-off-by: Fabrice Gasnier <fabrice.gasnier(a)st.com>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index ae622ee6d08c..dfc3a306c667 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1812,18 +1812,18 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
return 0;
}
-static int stm32_adc_dma_request(struct iio_dev *indio_dev)
+static int stm32_adc_dma_request(struct device *dev, struct iio_dev *indio_dev)
{
struct stm32_adc *adc = iio_priv(indio_dev);
struct dma_slave_config config;
int ret;
- adc->dma_chan = dma_request_chan(&indio_dev->dev, "rx");
+ adc->dma_chan = dma_request_chan(dev, "rx");
if (IS_ERR(adc->dma_chan)) {
ret = PTR_ERR(adc->dma_chan);
if (ret != -ENODEV) {
if (ret != -EPROBE_DEFER)
- dev_err(&indio_dev->dev,
+ dev_err(dev,
"DMA channel request failed with %d\n",
ret);
return ret;
@@ -1930,7 +1930,7 @@ static int stm32_adc_probe(struct platform_device *pdev)
if (ret < 0)
return ret;
- ret = stm32_adc_dma_request(indio_dev);
+ ret = stm32_adc_dma_request(dev, indio_dev);
if (ret < 0)
return ret;
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.42-1…
-------------------------------------------------------------------------------
stable-rc/linux-5.4.y boot: 161 boots: 1 failed, 145 passed with 7 offline, 8 untried/unknown (v5.4.42-105-g3cb79944b65a)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-5.4.y/kernel/v5.4.42-105-…
Tree: stable-rc
Branch: linux-5.4.y
Git Describe: v5.4.42-105-g3cb79944b65a
Git Commit: 3cb79944b65a695eeefe570faadb81f64ecad390
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 97 unique boards, 26 SoC families, 21 builds out of 200
Boot Regressions Detected:
arc:
hsdk_defconfig:
gcc-8:
hsdk:
lab-baylibre: new failure (last pass: v5.4.42)
arm:
davinci_all_defconfig:
gcc-8:
da850-evm:
lab-baylibre-seattle: failing since 1 day (last pass: v5.4.41-148-gcac6eb2794c8 - first fail: v5.4.42)
dm365evm,legacy:
lab-baylibre-seattle: failing since 1 day (last pass: v5.4.41-148-gcac6eb2794c8 - first fail: v5.4.42)
multi_v7_defconfig:
gcc-8:
sun8i-a83t-bananapi-m3:
lab-clabbe: new failure (last pass: v5.4.42)
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 107 days (last pass: v5.4.17-99-gbd0c6624a110 - first fail: v5.4.17-238-gbffcaa93483d)
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained:
lab-baylibre: failing since 48 days (last pass: v5.4.30-37-g40da5db79b55 - first fail: v5.4.30-39-g23c04177b89f)
versatile_defconfig:
gcc-8:
versatile-pb:
lab-collabora: new failure (last pass: v5.4.42)
arm64:
defconfig:
gcc-8:
meson-gxl-s905x-khadas-vim:
lab-baylibre: new failure (last pass: v5.4.42)
Boot Failure Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
davinci_all_defconfig:
gcc-8
da850-evm: 1 offline lab
dm365evm,legacy: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
---
For more info write to <info(a)kernelci.org>
******************************************
* WARNING: Boot tests are now deprecated *
******************************************
As kernelci.org is expanding its functional testing capabilities, the concept
of boot testing is now deprecated. Boot results are scheduled to be dropped on
*5th June 2020*. The full schedule for boot tests deprecation is available on
this GitHub issue: https://github.com/kernelci/kernelci-backend/issues/238
The new equivalent is the *baseline* test suite which also runs sanity checks
using dmesg and bootrr: https://github.com/kernelci/bootrr
See the *baseline results for this kernel revision* on this page:
https://kernelci.org/test/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.224-…
-------------------------------------------------------------------------------
stable-rc/linux-4.9.y boot: 110 boots: 1 failed, 95 passed with 7 offline, 6 untried/unknown, 1 conflict (v4.9.224-65-g7b44b8e27432)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.…
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.224-65-…
Tree: stable-rc
Branch: linux-4.9.y
Git Describe: v4.9.224-65-g7b44b8e27432
Git Commit: 7b44b8e27432c38eb9fd9e98eb66b781ed4944ae
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 58 unique boards, 18 SoC families, 19 builds out of 197
Boot Regressions Detected:
arm:
davinci_all_defconfig:
gcc-8:
da850-evm:
lab-baylibre-seattle: new failure (last pass: v4.9.224)
dm365evm,legacy:
lab-baylibre-seattle: new failure (last pass: v4.9.224)
qcom_defconfig:
gcc-8:
qcom-apq8064-cm-qs600:
lab-baylibre-seattle: failing since 13 days (last pass: v4.9.223 - first fail: v4.9.223-25-g6dfb25040a46)
sunxi_defconfig:
gcc-8:
sun4i-a10-olinuxino-lime:
lab-baylibre: new failure (last pass: v4.9.224)
x86_64:
x86_64_defconfig:
gcc-8:
qemu_x86_64:
lab-baylibre: new failure (last pass: v4.9.224)
Boot Failure Detected:
arm:
sama5_defconfig:
gcc-8:
at91-sama5d4_xplained: 1 failed lab
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
stih410-b2120: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
davinci_all_defconfig:
gcc-8
da850-evm: 1 offline lab
dm365evm,legacy: 1 offline lab
exynos_defconfig:
gcc-8
exynos5800-peach-pi: 1 offline lab
Conflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
x86_64:
x86_64_defconfig:
qemu_x86_64:
lab-baylibre: FAIL (gcc-8)
lab-collabora: PASS (gcc-8)
---
For more info write to <info(a)kernelci.org>
Hi
[This is an automated email]
This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: 2.6.12+
The bot has tested the following trees: v5.6.14, v5.4.42, v4.19.124, v4.14.181, v4.9.224, v4.4.224.
v5.6.14: Build OK!
v5.4.42: Build OK!
v4.19.124: Build OK!
v4.14.181: Build OK!
v4.9.224: Build OK!
v4.4.224: Failed to apply! Possible dependencies:
302d3deb2068 ("xprtrdma: Prevent inline overflow")
65b80179f9b8 ("xprtrdma: No direct data placement with krb5i and krb5p")
94f58c58c0b4 ("xprtrdma: Allow Read list and Reply chunk simultaneously")
cce6deeb56aa ("xprtrdma: Avoid using Write list for small NFS READ requests")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
Async page faults have to be trapped in the host (L1 in this case),
since the APF reason was passed from L0 to L1 and stored in the L1 APF
data page. This was completely reversed: the page faults were passed
to the guest, a L2 hypervisor.
Cc: stable(a)vger.kernel.org
Reviewed-by: Sean Christopherson <sean.j.christopherson(a)intel.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
---
arch/x86/kvm/svm/nested.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index a89a166d1cb8..f4cd2d0cc360 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -880,8 +880,8 @@ int nested_svm_exit_special(struct vcpu_svm *svm)
return NESTED_EXIT_HOST;
break;
case SVM_EXIT_EXCP_BASE + PF_VECTOR:
- /* When we're shadowing, trap PFs, but not async PF */
- if (!npt_enabled && svm->vcpu.arch.apf.host_apf_reason == 0)
+ /* Trap async PF even if not shadowing */
+ if (!npt_enabled || svm->vcpu.arch.apf.host_apf_reason)
return NESTED_EXIT_HOST;
break;
default:
--
2.18.2
From: Eric Joyner <eric.joyner(a)intel.com>
Memory allocated in the ice_add_prof_id_vsig() function wasn't being
properly freed if an error occurred inside the for-loop in the function.
In particular, 'p' wasn't being freed if an error occurred before it was
added to the resource list at the end of the for-loop.
CC: stable <stable(a)vger.kernel.org>
Signed-off-by: Eric Joyner <eric.joyner(a)intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
Tested-by: Andrew Bowers <andrewx.bowers(a)intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher(a)intel.com>
---
drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
index 4dc72aef5381..38c37f506257 100644
--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
@@ -4228,8 +4228,10 @@ ice_add_prof_id_vsig(struct ice_hw *hw, enum ice_block blk, u16 vsig, u64 hdl,
t->tcam[i].prof_id,
t->tcam[i].ptg, vsig, 0, 0,
vl_msk, dc_msk, nm_msk);
- if (status)
+ if (status) {
+ devm_kfree(ice_hw_to_dev(hw), p);
goto err_ice_add_prof_id_vsig;
+ }
/* log change */
list_add(&p->list_entry, chg);
--
2.26.2
Restoring the ASID from the hsave area on VMEXIT is wrong, because its
value depends on the handling of TLB flushes. Just skipping the field in
copy_vmcb_control_area will do.
Cc: stable(a)vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
---
arch/x86/kvm/svm/nested.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index f4cd2d0cc360..d544cce4f964 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -150,7 +150,7 @@ static void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *from_vmcb
dst->iopm_base_pa = from->iopm_base_pa;
dst->msrpm_base_pa = from->msrpm_base_pa;
dst->tsc_offset = from->tsc_offset;
- dst->asid = from->asid;
+ /* asid not copied, it is handled manually for svm->vmcb. */
dst->tlb_ctl = from->tlb_ctl;
dst->int_ctl = from->int_ctl;
dst->int_vector = from->int_vector;
--
2.18.2
When SYNC_STATE_ONLY support was added in commit 05ef983e0d65 ("driver
core: Add device link support for SYNC_STATE_ONLY flag"),
device_link_add() incorrectly skipped adding the new SYNC_STATE_ONLY
device link to the supplier's and consumer's "device link" list. So the
"device link" is lost forever from driver core if the caller didn't keep
track of it (typically isn't expected to).
If the same SYNC_STATE_ONLY device link is created again using
device_link_add(), instead of returning the pointer to the previously
created device link, a new device link is created and returned. This can
cause memory leaks in conjunction with fw_devlinks.
Cc: stable(a)vger.kernel.org
Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag")
Signed-off-by: Saravana Kannan <saravanak(a)google.com>
---
drivers/base/core.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 84c569726d75..d36e9289b2df 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -436,12 +436,16 @@ struct device_link *device_link_add(struct device *consumer,
flags & DL_FLAG_PM_RUNTIME)
pm_runtime_resume(supplier);
+ list_add_tail_rcu(&link->s_node, &supplier->links.consumers);
+ list_add_tail_rcu(&link->c_node, &consumer->links.suppliers);
+
if (flags & DL_FLAG_SYNC_STATE_ONLY) {
dev_dbg(consumer,
"Linked as a sync state only consumer to %s\n",
dev_name(supplier));
goto out;
}
+
reorder:
/*
* Move the consumer and all of the devices depending on it to the end
@@ -452,12 +456,9 @@ struct device_link *device_link_add(struct device *consumer,
*/
device_reorder_to_tail(consumer, NULL);
- list_add_tail_rcu(&link->s_node, &supplier->links.consumers);
- list_add_tail_rcu(&link->c_node, &consumer->links.suppliers);
-
dev_dbg(consumer, "Linked as a consumer to %s\n", dev_name(supplier));
- out:
+out:
device_pm_unlock();
device_links_write_unlock();
--
2.26.2.761.g0e0b3e54be-goog
The patch below does not apply to the 5.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b34cb07dde7c2346dec73d053ce926aeaa087303 Mon Sep 17 00:00:00 2001
From: Phil Auld <pauld(a)redhat.com>
Date: Tue, 12 May 2020 09:52:22 -0400
Subject: [PATCH] sched/fair: Fix enqueue_task_fair() warning some more
sched/fair: Fix enqueue_task_fair warning some more
The recent patch, fe61468b2cb (sched/fair: Fix enqueue_task_fair warning)
did not fully resolve the issues with the rq->tmp_alone_branch !=
&rq->leaf_cfs_rq_list warning in enqueue_task_fair. There is a case where
the first for_each_sched_entity loop exits due to on_rq, having incompletely
updated the list. In this case the second for_each_sched_entity loop can
further modify se. The later code to fix up the list management fails to do
what is needed because se does not point to the sched_entity which broke out
of the first loop. The list is not fixed up because the throttled parent was
already added back to the list by a task enqueue in a parallel child hierarchy.
Address this by calling list_add_leaf_cfs_rq if there are throttled parents
while doing the second for_each_sched_entity loop.
Fixes: fe61468b2cb ("sched/fair: Fix enqueue_task_fair warning")
Suggested-by: Vincent Guittot <vincent.guittot(a)linaro.org>
Signed-off-by: Phil Auld <pauld(a)redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com>
Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org>
Link: https://lkml.kernel.org/r/20200512135222.GC2201@lorien.usersys.redhat.com
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 02f323b85b6d..c6d57c334d51 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5479,6 +5479,13 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
/* end evaluation on encountering a throttled cfs_rq */
if (cfs_rq_throttled(cfs_rq))
goto enqueue_throttle;
+
+ /*
+ * One parent has been throttled and cfs_rq removed from the
+ * list. Add it back to not break the leaf list.
+ */
+ if (throttled_hierarchy(cfs_rq))
+ list_add_leaf_cfs_rq(cfs_rq);
}
enqueue_throttle:
The patch below does not apply to the 5.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From dfeb376dd4cb2c5004aeb625e2475f58a5ff2ea7 Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andriin(a)fb.com>
Date: Mon, 18 May 2020 22:38:24 -0700
Subject: [PATCH] bpf: Prevent mmap()'ing read-only maps as writable
As discussed in [0], it's dangerous to allow mapping BPF map, that's meant to
be frozen and is read-only on BPF program side, because that allows user-space
to actually store a writable view to the page even after it is frozen. This is
exacerbated by BPF verifier making a strong assumption that contents of such
frozen map will remain unchanged. To prevent this, disallow mapping
BPF_F_RDONLY_PROG mmap()'able BPF maps as writable, ever.
[0] https://lore.kernel.org/bpf/CAEf4BzYGWYhXdp6BJ7_=9OQPJxQpgug080MMjdSB72i9R+…
Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY")
Suggested-by: Jann Horn <jannh(a)google.com>
Signed-off-by: Andrii Nakryiko <andriin(a)fb.com>
Signed-off-by: Alexei Starovoitov <ast(a)kernel.org>
Reviewed-by: Jann Horn <jannh(a)google.com>
Link: https://lore.kernel.org/bpf/20200519053824.1089415-1-andriin@fb.com
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 2843bbba9ca1..4e6dee19a668 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -623,9 +623,20 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
mutex_lock(&map->freeze_mutex);
- if ((vma->vm_flags & VM_WRITE) && map->frozen) {
- err = -EPERM;
- goto out;
+ if (vma->vm_flags & VM_WRITE) {
+ if (map->frozen) {
+ err = -EPERM;
+ goto out;
+ }
+ /* map is meant to be read-only, so do not allow mapping as
+ * writable, because it's possible to leak a writable page
+ * reference and allows user-space to still modify it after
+ * freezing, while verifier will assume contents do not change
+ */
+ if (map->map_flags & BPF_F_RDONLY_PROG) {
+ err = -EACCES;
+ goto out;
+ }
}
/* set default open/close callbacks */
diff --git a/tools/testing/selftests/bpf/prog_tests/mmap.c b/tools/testing/selftests/bpf/prog_tests/mmap.c
index 6b9dce431d41..43d0b5578f46 100644
--- a/tools/testing/selftests/bpf/prog_tests/mmap.c
+++ b/tools/testing/selftests/bpf/prog_tests/mmap.c
@@ -19,7 +19,7 @@ void test_mmap(void)
const size_t map_sz = roundup_page(sizeof(struct map_data));
const int zero = 0, one = 1, two = 2, far = 1500;
const long page_size = sysconf(_SC_PAGE_SIZE);
- int err, duration = 0, i, data_map_fd, data_map_id, tmp_fd;
+ int err, duration = 0, i, data_map_fd, data_map_id, tmp_fd, rdmap_fd;
struct bpf_map *data_map, *bss_map;
void *bss_mmaped = NULL, *map_mmaped = NULL, *tmp1, *tmp2;
struct test_mmap__bss *bss_data;
@@ -37,6 +37,17 @@ void test_mmap(void)
data_map = skel->maps.data_map;
data_map_fd = bpf_map__fd(data_map);
+ rdmap_fd = bpf_map__fd(skel->maps.rdonly_map);
+ tmp1 = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, rdmap_fd, 0);
+ if (CHECK(tmp1 != MAP_FAILED, "rdonly_write_mmap", "unexpected success\n")) {
+ munmap(tmp1, 4096);
+ goto cleanup;
+ }
+ /* now double-check if it's mmap()'able at all */
+ tmp1 = mmap(NULL, 4096, PROT_READ, MAP_SHARED, rdmap_fd, 0);
+ if (CHECK(tmp1 == MAP_FAILED, "rdonly_read_mmap", "failed: %d\n", errno))
+ goto cleanup;
+
/* get map's ID */
memset(&map_info, 0, map_info_sz);
err = bpf_obj_get_info_by_fd(data_map_fd, &map_info, &map_info_sz);
diff --git a/tools/testing/selftests/bpf/progs/test_mmap.c b/tools/testing/selftests/bpf/progs/test_mmap.c
index 6239596cd14e..4eb42cff5fe9 100644
--- a/tools/testing/selftests/bpf/progs/test_mmap.c
+++ b/tools/testing/selftests/bpf/progs/test_mmap.c
@@ -7,6 +7,14 @@
char _license[] SEC("license") = "GPL";
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 4096);
+ __uint(map_flags, BPF_F_MMAPABLE | BPF_F_RDONLY_PROG);
+ __type(key, __u32);
+ __type(value, char);
+} rdonly_map SEC(".maps");
+
struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 512 * 4); /* at least 4 pages of data */
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 928edefbc18cd8433f7df235c6e09a9306e7d580 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
Date: Wed, 6 May 2020 05:52:06 +0200
Subject: [PATCH] iio: sca3000: Remove an erroneous 'get_device()'
This looks really unusual to have a 'get_device()' hidden in a 'dev_err()'
call.
Remove it.
While at it add a missing \n at the end of the message.
Fixes: 574fb258d636 ("Staging: IIO: VTI sca3000 series accelerometer driver (spi)")
Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c
index 66d768d971e1..6e429072e44a 100644
--- a/drivers/iio/accel/sca3000.c
+++ b/drivers/iio/accel/sca3000.c
@@ -980,7 +980,7 @@ static int sca3000_read_data(struct sca3000_state *st,
st->tx[0] = SCA3000_READ_REG(reg_address_high);
ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer));
if (ret) {
- dev_err(get_device(&st->us->dev), "problem reading register");
+ dev_err(&st->us->dev, "problem reading register\n");
return ret;
}