From: Simon Gander <simon(a)tuxera.com>
Subject: hfsplus: fix crash and filesystem corruption when deleting files
When removing files containing extended attributes, the hfsplus driver may
remove the wrong entries from the attributes b-tree, causing major
filesystem damage and in some cases even kernel crashes.
To remove a file, all its extended attributes have to be removed as well.
The driver does this by looking up all keys in the attributes b-tree with
the cnid of the file. Each of these entries then gets deleted using the
key used for searching, which doesn't contain the attribute's name when it
should. Since the key doesn't contain the name, the deletion routine will
not find the correct entry and instead remove the one in front of it. If
parent nodes have to be modified, these become corrupt as well. This
causes invalid links and unsorted entries that not even macOS's fsck_hfs
is able to fix.
To fix this, modify the search key before an entry is deleted from the
attributes b-tree by copying the found entry's key into the search key,
therefore ensuring that the correct entry gets removed from the tree.
Link: http://lkml.kernel.org/r/20200327155541.1521-1-simon@tuxera.com
Signed-off-by: Simon Gander <simon(a)tuxera.com>
Reviewed-by: Anton Altaparmakov <anton(a)tuxera.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/hfsplus/attributes.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/hfsplus/attributes.c~hfsplus-fix-crash-and-filesystem-corruption-when-deleting-files
+++ a/fs/hfsplus/attributes.c
@@ -292,6 +292,10 @@ static int __hfsplus_delete_attr(struct
return -ENOENT;
}
+ /* Avoid btree corruption */
+ hfs_bnode_read(fd->bnode, fd->search_key,
+ fd->keyoffset, fd->keylength);
+
err = hfs_brec_remove(fd);
if (err)
return err;
_
Hi!
Please pick the backports for the following upstream commits:
4fbc0c711b24 "ceph: remove the extra slashes in the server path"
b27a939e8376 "ceph: canonicalize server path in place"
They fix an ancient bug that can be reproduced in kernels as old as 4.9 (I
couldn't reproduced it with 4.4).
Cheers,
--
Luis Henriques
Ilya Dryomov (1):
ceph: canonicalize server path in place
Xiubo Li (1):
ceph: remove the extra slashes in the server path
subject of the patch:
ARM: imx: Enable ARM_ERRATA_814220 for i.MX6UL and i.MX7D
the commit ID:
4562fa4c86c92a2df635fe0697c9e06379738741
why you think it should be applied:
ARM_ERRATA_814220 is already available in v5.4.x, but not yet automatically selected for i.MX6UL(L)
and what kernel version you wish it to be applied to.
linux-5.4.y
subject of the patch:
ARM: imx: only select ARM_ERRATA_814220 for ARMv7-A
the commit ID:
c74067a0f776c1d695a713a4388c3b6a094ee40a
why you think it should be applied:
This is a follow up for the previous patch.
and what kernel version you wish it to be applied to.
linux-5.4.y
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1ad53d9fa3f6168ebcf48a50e08b170432da2257 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook(a)chromium.org>
Date: Wed, 1 Apr 2020 21:04:23 -0700
Subject: [PATCH] slub: improve bit diffusion for freelist ptr obfuscation
Under CONFIG_SLAB_FREELIST_HARDENED=y, the obfuscation was relatively weak
in that the ptr and ptr address were usually so close that the first XOR
would result in an almost entirely 0-byte value[1], leaving most of the
"secret" number ultimately being stored after the third XOR. A single
blind memory content exposure of the freelist was generally sufficient to
learn the secret.
Add a swab() call to mix bits a little more. This is a cheap way (1
cycle) to make attacks need more than a single exposure to learn the
secret (or to know _where_ the exposure is in memory).
kmalloc-32 freelist walk, before:
ptr ptr_addr stored value secret
ffff90c22e019020@ffff90c22e019000 is 86528eb656b3b5bd (86528eb656b3b59d)
ffff90c22e019040@ffff90c22e019020 is 86528eb656b3b5fd (86528eb656b3b59d)
ffff90c22e019060@ffff90c22e019040 is 86528eb656b3b5bd (86528eb656b3b59d)
ffff90c22e019080@ffff90c22e019060 is 86528eb656b3b57d (86528eb656b3b59d)
ffff90c22e0190a0@ffff90c22e019080 is 86528eb656b3b5bd (86528eb656b3b59d)
...
after:
ptr ptr_addr stored value secret
ffff9eed6e019020@ffff9eed6e019000 is 793d1135d52cda42 (86528eb656b3b59d)
ffff9eed6e019040@ffff9eed6e019020 is 593d1135d52cda22 (86528eb656b3b59d)
ffff9eed6e019060@ffff9eed6e019040 is 393d1135d52cda02 (86528eb656b3b59d)
ffff9eed6e019080@ffff9eed6e019060 is 193d1135d52cdae2 (86528eb656b3b59d)
ffff9eed6e0190a0@ffff9eed6e019080 is f93d1135d52cdac2 (86528eb656b3b59d)
[1] https://blog.infosectcbr.com.au/2020/03/weaknesses-in-linux-kernel-heap.html
Fixes: 2482ddec670f ("mm: add SLUB free list pointer obfuscation")
Reported-by: Silvio Cesare <silvio.cesare(a)gmail.com>
Signed-off-by: Kees Cook <keescook(a)chromium.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Link: http://lkml.kernel.org/r/202003051623.AF4F8CB@keescook
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/slub.c b/mm/slub.c
index fc911c222b11..bc949e3428c9 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -259,7 +259,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
* freepointer to be restored incorrectly.
*/
return (void *)((unsigned long)ptr ^ s->random ^
- (unsigned long)kasan_reset_tag((void *)ptr_addr));
+ swab((unsigned long)kasan_reset_tag((void *)ptr_addr)));
#else
return ptr;
#endif
From: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
[ Upstream commit 36eb7dc1bd42fe5f850329c893768ff89b696fba ]
imx6ul_opp_check_speed_grading is called for both i.MX6UL and i.MX6ULL.
Since the i.MX6ULL was introduced to a separate ocotp compatible node
later, it is possible that the i.MX6ULL has also dtbs with
"fsl,imx6ull-ocotp". On a system without nvmem-cell speed grade a
missing check on this node causes a driver fail without considering
the cpu speed grade.
This patch prevents unwanted cpu overclocking on i.MX6ULL with compatible
node "fsl,imx6ull-ocotp" in old dtbs without nvmem-cell speed grade.
Fixes: 2733fb0d0699 ("cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull")
Signed-off-by: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/cpufreq/imx6q-cpufreq.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index d8c3595e90236..a0cbbdfc77359 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -310,6 +310,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
void __iomem *base;
np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
+ if (!np)
+ np = of_find_compatible_node(NULL, NULL,
+ "fsl,imx6ull-ocotp");
if (!np)
return -ENOENT;
--
2.20.1
From: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
[ Upstream commit 36eb7dc1bd42fe5f850329c893768ff89b696fba ]
imx6ul_opp_check_speed_grading is called for both i.MX6UL and i.MX6ULL.
Since the i.MX6ULL was introduced to a separate ocotp compatible node
later, it is possible that the i.MX6ULL has also dtbs with
"fsl,imx6ull-ocotp". On a system without nvmem-cell speed grade a
missing check on this node causes a driver fail without considering
the cpu speed grade.
This patch prevents unwanted cpu overclocking on i.MX6ULL with compatible
node "fsl,imx6ull-ocotp" in old dtbs without nvmem-cell speed grade.
Fixes: 2733fb0d0699 ("cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull")
Signed-off-by: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/cpufreq/imx6q-cpufreq.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 648a09a1778a3..1fcbbd53a48a2 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -280,6 +280,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
void __iomem *base;
np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
+ if (!np)
+ np = of_find_compatible_node(NULL, NULL,
+ "fsl,imx6ull-ocotp");
if (!np)
return -ENOENT;
--
2.20.1
From: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
[ Upstream commit 36eb7dc1bd42fe5f850329c893768ff89b696fba ]
imx6ul_opp_check_speed_grading is called for both i.MX6UL and i.MX6ULL.
Since the i.MX6ULL was introduced to a separate ocotp compatible node
later, it is possible that the i.MX6ULL has also dtbs with
"fsl,imx6ull-ocotp". On a system without nvmem-cell speed grade a
missing check on this node causes a driver fail without considering
the cpu speed grade.
This patch prevents unwanted cpu overclocking on i.MX6ULL with compatible
node "fsl,imx6ull-ocotp" in old dtbs without nvmem-cell speed grade.
Fixes: 2733fb0d0699 ("cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull")
Signed-off-by: Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/cpufreq/imx6q-cpufreq.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 648a09a1778a3..1fcbbd53a48a2 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -280,6 +280,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
void __iomem *base;
np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
+ if (!np)
+ np = of_find_compatible_node(NULL, NULL,
+ "fsl,imx6ull-ocotp");
if (!np)
return -ENOENT;
--
2.20.1
We already set DPM_FLAG_SMART_PREPARE, so we completely skip all
callbacks (other then prepare) where possible, quoting from
dw_i2c_plat_prepare():
/*
* If the ACPI companion device object is present for this device, it
* may be accessed during suspend and resume of other devices via I2C
* operation regions, so tell the PM core and middle layers to avoid
* skipping system suspend/resume callbacks for it in that case.
*/
return !has_acpi_companion(dev);
Also setting the DPM_FLAG_SMART_SUSPEND will cause acpi_subsys_suspend()
to leave the controller runtime-suspended even if dw_i2c_plat_prepare()
returned 0.
Leaving the controller runtime-suspended normally, when the I2C controller
is suspended during the suspend_late phase, is not an issue because
the pm_runtime_get_sync() done by i2c_dw_xfer() will (runtime-)resume it.
But for dw I2C controllers on Bay- and Cherry-Trail devices acpi_lpss.c
leaves the controller alive until the suspend_noirq phase, because it may
be used by the _PS3 ACPI methods of PCI devices and PCI devices are left
powered on until the suspend_noirq phase.
Between the suspend_late and resume_early phases runtime-pm is disabled.
So for any ACPI I2C OPRegion accesses done after the suspend_late phase,
the pm_runtime_get_sync() done by i2c_dw_xfer() is a no-op and the
controller is left runtime-suspended.
i2c_dw_xfer() has a check to catch this condition (rather then waiting
for the I2C transfer to timeout because the controller is suspended).
acpi_subsys_suspend() leaving the controller runtime-suspended in
combination with an ACPI I2C OPRegion access done after the suspend_late
phase triggers this check, leading to the following error being logged
on a Bay Trail based Lenovo Thinkpad 8 tablet:
[ 93.275882] i2c_designware 80860F41:00: Transfer while suspended
[ 93.275993] WARNING: CPU: 0 PID: 412 at drivers/i2c/busses/i2c-designware-master.c:429 i2c_dw_xfer+0x239/0x280
...
[ 93.276252] Workqueue: kacpi_notify acpi_os_execute_deferred
[ 93.276267] RIP: 0010:i2c_dw_xfer+0x239/0x280
...
[ 93.276340] Call Trace:
[ 93.276366] __i2c_transfer+0x121/0x520
[ 93.276379] i2c_transfer+0x4c/0x100
[ 93.276392] i2c_acpi_space_handler+0x219/0x510
[ 93.276408] ? up+0x40/0x60
[ 93.276419] ? i2c_acpi_notify+0x130/0x130
[ 93.276433] acpi_ev_address_space_dispatch+0x1e1/0x252
...
So since on BYT and CHT platforms we want ACPI I2c OPRegion accesses
to work until the suspend_noirq phase, we need the controller to be
runtime-resumed during the suspend phase if it is runtime-suspended
suspended at that time. This means that we must not set the
DPM_FLAG_SMART_SUSPEND on these platforms.
On BYT and CHT we already have a special ACCESS_NO_IRQ_SUSPEND flag
to make sure the controller stays functional until the suspend_noirq
phase. This commit makes the driver not set the DPM_FLAG_SMART_SUSPEND
flag when that flag is set.
Cc: stable(a)vger.kernel.org
Fixes: b30f2f65568f ("i2c: designware: Set IRQF_NO_SUSPEND flag for all BYT and CHT controllers")
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/i2c/busses/i2c-designware-platdrv.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 3b7d58c2fe85..15b4b965b443 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -371,10 +371,16 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
adap->dev.of_node = pdev->dev.of_node;
adap->nr = -1;
- dev_pm_set_driver_flags(&pdev->dev,
- DPM_FLAG_SMART_PREPARE |
- DPM_FLAG_SMART_SUSPEND |
- DPM_FLAG_LEAVE_SUSPENDED);
+ if (dev->flags & ACCESS_NO_IRQ_SUSPEND) {
+ dev_pm_set_driver_flags(&pdev->dev,
+ DPM_FLAG_SMART_PREPARE |
+ DPM_FLAG_LEAVE_SUSPENDED);
+ } else {
+ dev_pm_set_driver_flags(&pdev->dev,
+ DPM_FLAG_SMART_PREPARE |
+ DPM_FLAG_SMART_SUSPEND |
+ DPM_FLAG_LEAVE_SUSPENDED);
+ }
/* The code below assumes runtime PM to be disabled. */
WARN_ON(pm_runtime_enabled(&pdev->dev));
--
2.26.0
Please queue up the following networking bug fixes for v5.5 and v5.6
-stable, respectively.
Also, there is a Realtek PHY patch attached which should be queued up
for v5.4.
Thank you.
From: Ross Lagerwall <ross.lagerwall(a)citrix.com>
commit 45c8184c1bed1ca8a7f02918552063a00b909bf5 upstream.
Update the features after calling register_netdev() otherwise the
device features are not set up correctly and it not possible to change
the MTU of the device. After this change, the features reported by
ethtool match the device's features before the commit which introduced
the issue and it is possible to change the device's MTU.
Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open")
Reported-by: Liam Shepherd <liam(a)dancer.es>
Signed-off-by: Ross Lagerwall <ross.lagerwall(a)citrix.com>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu(a)toshiba.co.jp>
---
drivers/net/xen-netfront.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 744b111cff6a3..e99a07d5fda71 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1982,10 +1982,6 @@ static int xennet_connect(struct net_device *dev)
/* talk_to_netback() sets the correct number of queues */
num_queues = dev->real_num_tx_queues;
- rtnl_lock();
- netdev_update_features(dev);
- rtnl_unlock();
-
if (dev->reg_state == NETREG_UNINITIALIZED) {
err = register_netdev(dev);
if (err) {
@@ -1995,6 +1991,10 @@ static int xennet_connect(struct net_device *dev)
}
}
+ rtnl_lock();
+ netdev_update_features(dev);
+ rtnl_unlock();
+
/*
* All public and private state should now be sane. Get
* ready to start sending and receiving packets and give the driver
--
2.26.0
The patch titled
Subject: ocfs2: no need try to truncate file beyond i_size
has been added to the -mm tree. Its filename is
ocfs2-no-need-try-to-truncate-file-beyond-i_size.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/ocfs2-no-need-try-to-truncate-file…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/ocfs2-no-need-try-to-truncate-file…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Changwei Ge <chge(a)linux.alibaba.com>
Subject: ocfs2: no need try to truncate file beyond i_size
Linux fallocate(2) with FALLOC_FL_PUNCH_HOLE mode set, its offset can
exceed inode size. Ocfs2 now does't allow that offset beyond inode size.
This restriction is not necessary and voilates fallocate(2) semantics.
If fallocate(2) offset is beyond inode size, just return success and do
nothing further.
Otherwise, ocfs2 will crash the kernel.
kernel BUG at fs/ocfs2//alloc.c:7264!
ocfs2_truncate_inline+0x20f/0x360 [ocfs2]
? ocfs2_read_blocks+0x2f3/0x5f0 [ocfs2]
ocfs2_remove_inode_range+0x23c/0xcb0 [ocfs2]
? ocfs2_read_inode_block+0x10/0x20 [ocfs2]
? ocfs2_allocate_extend_trans+0x1a0/0x1a0 [ocfs2]
__ocfs2_change_file_space+0x4a5/0x650 [ocfs2]
ocfs2_fallocate+0x83/0xa0 [ocfs2]
? __audit_syscall_entry+0xb8/0x100
? __sb_start_write+0x3b/0x70
vfs_fallocate+0x148/0x230
SyS_fallocate+0x48/0x80
do_syscall_64+0x79/0x170
Link: http://lkml.kernel.org/r/20200407082754.17565-1-chge@linux.alibaba.com
Signed-off-by: Changwei Ge <chge(a)linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/ocfs2/alloc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ocfs2/alloc.c~ocfs2-no-need-try-to-truncate-file-beyond-i_size
+++ a/fs/ocfs2/alloc.c
@@ -7402,6 +7402,10 @@ int ocfs2_truncate_inline(struct inode *
struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
struct ocfs2_inline_data *idata = &di->id2.i_data;
+ /* No need to punch hole beyond i_size. */
+ if (start >= i_size_read(inode))
+ return 0;
+
if (end > i_size_read(inode))
end = i_size_read(inode);
_
Patches currently in -mm which might be from chge(a)linux.alibaba.com are
ocfs2-no-need-try-to-truncate-file-beyond-i_size.patch
The patch titled
Subject: lib/list: prevent compiler reloads inside 'safe' list iteration
has been removed from the -mm tree. Its filename was
list-prevent-compiler-reloads-inside-safe-list-iteration.patch
This patch was dropped because it was nacked
------------------------------------------------------
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Subject: lib/list: prevent compiler reloads inside 'safe' list iteration
Instruct the compiler to read the next element in the list iteration
once, and that it is not allowed to reload the value from the stale
element later. This is important as during the course of the safe
iteration, the stale element may be poisoned (unbeknownst to the
compiler).
This helps prevent kcsan warnings over 'unsafe' conduct in releasing the
list elements during list_for_each_entry_safe() and friends.
Link: http://lkml.kernel.org/r/20200310092119.14965-1-chris@chris-wilson.co.uk
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Reviewed-by: Paul E. McKenney <paulmck(a)kernel.org>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: David Laight <David.Laight(a)ACULAB.COM>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Marco Elver <elver(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/list.h | 50 +++++++++++++++++++++++++++++------------
1 file changed, 36 insertions(+), 14 deletions(-)
--- a/include/linux/list.h~list-prevent-compiler-reloads-inside-safe-list-iteration
+++ a/include/linux/list.h
@@ -537,6 +537,17 @@ static inline void list_splice_tail_init
list_entry((pos)->member.next, typeof(*(pos)), member)
/**
+ * list_next_entry_safe - get the next element in list [once]
+ * @pos: the type * to cursor
+ * @member: the name of the list_head within the struct.
+ *
+ * Like list_next_entry() but prevents the compiler from reloading the
+ * next element.
+ */
+#define list_next_entry_safe(pos, member) \
+ list_entry(READ_ONCE((pos)->member.next), typeof(*(pos)), member)
+
+/**
* list_prev_entry - get the prev element in list
* @pos: the type * to cursor
* @member: the name of the list_head within the struct.
@@ -545,6 +556,17 @@ static inline void list_splice_tail_init
list_entry((pos)->member.prev, typeof(*(pos)), member)
/**
+ * list_prev_entry_safe - get the prev element in list [once]
+ * @pos: the type * to cursor
+ * @member: the name of the list_head within the struct.
+ *
+ * Like list_prev_entry() but prevents the compiler from reloading the
+ * previous element.
+ */
+#define list_prev_entry_safe(pos, member) \
+ list_entry(READ_ONCE((pos)->member.prev), typeof(*(pos)), member)
+
+/**
* list_for_each - iterate over a list
* @pos: the &struct list_head to use as a loop cursor.
* @head: the head for your list.
@@ -686,9 +708,9 @@ static inline void list_splice_tail_init
*/
#define list_for_each_entry_safe(pos, n, head, member) \
for (pos = list_first_entry(head, typeof(*pos), member), \
- n = list_next_entry(pos, member); \
+ n = list_next_entry_safe(pos, member); \
&pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_continue - continue list iteration safe against removal
@@ -700,11 +722,11 @@ static inline void list_splice_tail_init
* Iterate over list of given type, continuing after current point,
* safe against removal of list entry.
*/
-#define list_for_each_entry_safe_continue(pos, n, head, member) \
- for (pos = list_next_entry(pos, member), \
- n = list_next_entry(pos, member); \
- &pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+#define list_for_each_entry_safe_continue(pos, n, head, member) \
+ for (pos = list_next_entry(pos, member), \
+ n = list_next_entry_safe(pos, member); \
+ &pos->member != (head); \
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_from - iterate over list from current point safe against removal
@@ -716,10 +738,10 @@ static inline void list_splice_tail_init
* Iterate over list of given type from current point, safe against
* removal of list entry.
*/
-#define list_for_each_entry_safe_from(pos, n, head, member) \
- for (n = list_next_entry(pos, member); \
- &pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+#define list_for_each_entry_safe_from(pos, n, head, member) \
+ for (n = list_next_entry_safe(pos, member); \
+ &pos->member != (head); \
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_reverse - iterate backwards over list safe against removal
@@ -733,9 +755,9 @@ static inline void list_splice_tail_init
*/
#define list_for_each_entry_safe_reverse(pos, n, head, member) \
for (pos = list_last_entry(head, typeof(*pos), member), \
- n = list_prev_entry(pos, member); \
+ n = list_prev_entry_safe(pos, member); \
&pos->member != (head); \
- pos = n, n = list_prev_entry(n, member))
+ pos = n, n = list_prev_entry_safe(n, member))
/**
* list_safe_reset_next - reset a stale list_for_each_entry_safe loop
@@ -750,7 +772,7 @@ static inline void list_splice_tail_init
* completing the current iteration of the loop body.
*/
#define list_safe_reset_next(pos, n, member) \
- n = list_next_entry(pos, member)
+ n = list_next_entry_safe(pos, member)
/*
* Double linked lists with a single pointer list head.
_
Patches currently in -mm which might be from chris(a)chris-wilson.co.uk are
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Subject: lib/list: prevent compiler reloads inside 'safe' list iteration
Instruct the compiler to read the next element in the list iteration
once, and that it is not allowed to reload the value from the stale
element later. This is important as during the course of the safe
iteration, the stale element may be poisoned (unbeknownst to the
compiler).
This helps prevent kcsan warnings over 'unsafe' conduct in releasing the
list elements during list_for_each_entry_safe() and friends.
Link: http://lkml.kernel.org/r/20200310092119.14965-1-chris@chris-wilson.co.uk
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Reviewed-by: Paul E. McKenney <paulmck(a)kernel.org>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: David Laight <David.Laight(a)ACULAB.COM>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Marco Elver <elver(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/list.h | 50 +++++++++++++++++++++++++++++------------
1 file changed, 36 insertions(+), 14 deletions(-)
--- a/include/linux/list.h~list-prevent-compiler-reloads-inside-safe-list-iteration
+++ a/include/linux/list.h
@@ -537,6 +537,17 @@ static inline void list_splice_tail_init
list_entry((pos)->member.next, typeof(*(pos)), member)
/**
+ * list_next_entry_safe - get the next element in list [once]
+ * @pos: the type * to cursor
+ * @member: the name of the list_head within the struct.
+ *
+ * Like list_next_entry() but prevents the compiler from reloading the
+ * next element.
+ */
+#define list_next_entry_safe(pos, member) \
+ list_entry(READ_ONCE((pos)->member.next), typeof(*(pos)), member)
+
+/**
* list_prev_entry - get the prev element in list
* @pos: the type * to cursor
* @member: the name of the list_head within the struct.
@@ -545,6 +556,17 @@ static inline void list_splice_tail_init
list_entry((pos)->member.prev, typeof(*(pos)), member)
/**
+ * list_prev_entry_safe - get the prev element in list [once]
+ * @pos: the type * to cursor
+ * @member: the name of the list_head within the struct.
+ *
+ * Like list_prev_entry() but prevents the compiler from reloading the
+ * previous element.
+ */
+#define list_prev_entry_safe(pos, member) \
+ list_entry(READ_ONCE((pos)->member.prev), typeof(*(pos)), member)
+
+/**
* list_for_each - iterate over a list
* @pos: the &struct list_head to use as a loop cursor.
* @head: the head for your list.
@@ -686,9 +708,9 @@ static inline void list_splice_tail_init
*/
#define list_for_each_entry_safe(pos, n, head, member) \
for (pos = list_first_entry(head, typeof(*pos), member), \
- n = list_next_entry(pos, member); \
+ n = list_next_entry_safe(pos, member); \
&pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_continue - continue list iteration safe against removal
@@ -700,11 +722,11 @@ static inline void list_splice_tail_init
* Iterate over list of given type, continuing after current point,
* safe against removal of list entry.
*/
-#define list_for_each_entry_safe_continue(pos, n, head, member) \
- for (pos = list_next_entry(pos, member), \
- n = list_next_entry(pos, member); \
- &pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+#define list_for_each_entry_safe_continue(pos, n, head, member) \
+ for (pos = list_next_entry(pos, member), \
+ n = list_next_entry_safe(pos, member); \
+ &pos->member != (head); \
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_from - iterate over list from current point safe against removal
@@ -716,10 +738,10 @@ static inline void list_splice_tail_init
* Iterate over list of given type from current point, safe against
* removal of list entry.
*/
-#define list_for_each_entry_safe_from(pos, n, head, member) \
- for (n = list_next_entry(pos, member); \
- &pos->member != (head); \
- pos = n, n = list_next_entry(n, member))
+#define list_for_each_entry_safe_from(pos, n, head, member) \
+ for (n = list_next_entry_safe(pos, member); \
+ &pos->member != (head); \
+ pos = n, n = list_next_entry_safe(n, member))
/**
* list_for_each_entry_safe_reverse - iterate backwards over list safe against removal
@@ -733,9 +755,9 @@ static inline void list_splice_tail_init
*/
#define list_for_each_entry_safe_reverse(pos, n, head, member) \
for (pos = list_last_entry(head, typeof(*pos), member), \
- n = list_prev_entry(pos, member); \
+ n = list_prev_entry_safe(pos, member); \
&pos->member != (head); \
- pos = n, n = list_prev_entry(n, member))
+ pos = n, n = list_prev_entry_safe(n, member))
/**
* list_safe_reset_next - reset a stale list_for_each_entry_safe loop
@@ -750,7 +772,7 @@ static inline void list_splice_tail_init
* completing the current iteration of the loop body.
*/
#define list_safe_reset_next(pos, n, member) \
- n = list_next_entry(pos, member)
+ n = list_next_entry_safe(pos, member)
/*
* Double linked lists with a single pointer list head.
_
When doing an atomic modeset with ALLOW_MODESET drivers are allowed to
pull in arbitrary other resources, including CRTCs (e.g. when
reconfiguring global resources).
But in nonblocking mode userspace has then no idea this happened,
which can lead to spurious EBUSY calls, both:
- when that other CRTC is currently busy doing a page_flip the
ALLOW_MODESET commit can fail with an EBUSY
- on the other CRTC a normal atomic flip can fail with EBUSY because
of the additional commit inserted by the kernel without userspace's
knowledge
For blocking commits this isn't a problem, because everyone else will
just block until all the CRTC are reconfigured. Only thing userspace
can notice is the dropped frames without any reason for why frames got
dropped.
Consensus is that we need new uapi to handle this properly, but no one
has any idea what exactly the new uapi should look like. As a stop-gap
plug this problem by demoting nonblocking commits which might cause
issues by including CRTCs not in the original request to blocking
commits.
v2: Add comments and a WARN_ON to enforce this only when allowed - we
don't want to silently convert page flips into blocking plane updates
just because the driver is buggy.
v3: Fix inverted WARN_ON (Pekka).
References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html
Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568
Cc: Daniel Stone <daniel(a)fooishbar.org>
Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk>
Cc: stable(a)vger.kernel.org
Reviewed-by: Daniel Stone <daniels(a)collabora.com>
Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com>
---
drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++---
1 file changed, 31 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 9ccfbf213d72..4c035abf98b8 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1362,15 +1362,43 @@ EXPORT_SYMBOL(drm_atomic_commit);
int drm_atomic_nonblocking_commit(struct drm_atomic_state *state)
{
struct drm_mode_config *config = &state->dev->mode_config;
- int ret;
+ unsigned requested_crtc = 0;
+ unsigned affected_crtc = 0;
+ struct drm_crtc *crtc;
+ struct drm_crtc_state *crtc_state;
+ bool nonblocking = true;
+ int ret, i;
+
+ /*
+ * For commits that allow modesets drivers can add other CRTCs to the
+ * atomic commit, e.g. when they need to reallocate global resources.
+ *
+ * But when userspace also requests a nonblocking commit then userspace
+ * cannot know that the commit affects other CRTCs, which can result in
+ * spurious EBUSY failures. Until we have better uapi plug this by
+ * demoting such commits to blocking mode.
+ */
+ for_each_new_crtc_in_state(state, crtc, crtc_state, i)
+ requested_crtc |= drm_crtc_mask(crtc);
ret = drm_atomic_check_only(state);
if (ret)
return ret;
- DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state);
+ for_each_new_crtc_in_state(state, crtc, crtc_state, i)
+ affected_crtc |= drm_crtc_mask(crtc);
+
+ if (affected_crtc != requested_crtc) {
+ /* adding other CRTC is only allowed for modeset commits */
+ WARN_ON(!state->allow_modeset);
+
+ DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state);
+ nonblocking = false;
+ } else {
+ DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state);
+ }
- return config->funcs->atomic_commit(state->dev, state, true);
+ return config->funcs->atomic_commit(state->dev, state, nonblocking);
}
EXPORT_SYMBOL(drm_atomic_nonblocking_commit);
--
2.24.1
This is the start of the stable review cycle for the 5.6.3 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 15:46:32 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.3-rc2.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.6.3-rc2
Randy Dunlap <rdunlap(a)infradead.org>
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
Arnaldo Carvalho de Melo <acme(a)redhat.com>
perf python: Fix clang detection to strip out options passed in $CC
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Takashi Iwai <tiwai(a)suse.de>
Revert "ALSA: uapi: Drop asound.h inclusion from asoc.h"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Freeman Liu <freeman.liu(a)unisoc.com>
nvmem: sprd: Fix the block lock operation
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Khouloud Touil <ktouil(a)baylibre.com>
nvmem: release the write-protect pin
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Uma Shankar <uma.shankar(a)intel.com>
drm/i915/display: Fix mode private_flags comparison at atomic_check
Torsten Duwe <duwe(a)lst.de>
drm/bridge: analogix-anx6345: Avoid duplicate -supply suffix
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Xin Long <lucien.xin(a)gmail.com>
udp: initialize is_flist with 0 in udp_gro_receive
Florian Westphal <fw(a)strlen.de>
net: fix fraglist segmentation reference count leak
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: macb: Fix handling of fixed-link node
Qiujun Huang <hqjagain(a)gmail.com>
sctp: fix refcount bug in sctp_wfree
Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
sctp: fix possibly using a bad saddr with a given dst
William Dauchy <w.dauchy(a)criteo.com>
net, ip_tunnel: fix interface lookup with no key
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: dsa: ksz: Select KSZ protocol tag
Qian Cai <cai(a)lca.pw>
ipv4: fix a RCU-list lock in fib_triestat_seq_show
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++++++++
drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 4 +-
drivers/gpu/drm/i915/display/intel_display.c | 4 +-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 ++++--
drivers/net/dsa/microchip/Kconfig | 1 +
drivers/net/ethernet/cadence/macb_main.c | 3 ++
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/nvmem/core.c | 1 +
drivers/nvmem/nvmem-sysfs.c | 6 +++
drivers/nvmem/sprd-efuse.c | 2 +-
drivers/pci/pci-sysfs.c | 6 ++-
drivers/power/supply/axp288_charger.c | 57 +++++++++++++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
include/uapi/linux/coresight-stm.h | 6 ++-
include/uapi/sound/asoc.h | 1 +
kernel/padata.c | 2 +-
lib/test_xarray.c | 18 +++++++
lib/xarray.c | 3 +-
mm/mempolicy.c | 6 ++-
net/core/skbuff.c | 1 +
net/ipv4/fib_trie.c | 3 ++
net/ipv4/ip_tunnel.c | 6 +--
net/ipv4/udp_offload.c | 1 +
net/sctp/ipv6.c | 20 +++++---
net/sctp/protocol.c | 28 +++++++----
net/sctp/socket.c | 31 +++++++++---
sound/pci/hda/patch_ca0132.c | 1 +
tools/perf/util/setup.py | 2 +-
33 files changed, 226 insertions(+), 50 deletions(-)
From: Vasily Averin <vvs(a)virtuozzo.com>
[ Upstream commit db8dd9697238be70a6b4f9d0284cd89f59c0e070 ]
if seq_file .next fuction does not change position index,
read after some lseek can generate unexpected output.
# mount | grep cgroup
# dd if=/mnt/cgroup.procs bs=1 # normal output
...
1294
1295
1296
1304
1382
584+0 records in
584+0 records out
584 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset
83 <<< generates end of last line
1383 <<< ... and whole last line once again
0+1 records in
0+1 records out
8 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset
1386 <<< generates last line anyway
0+1 records in
0+1 records out
5 bytes copied
https://bugzilla.kernel.org/show_bug.cgi?id=206283
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Signed-off-by: Tejun Heo <tj(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/cgroup/cgroup-v1.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 7f83f4121d8d0..2db582706ec5c 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -473,6 +473,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
*/
p++;
if (p >= end) {
+ (*pos)++;
return NULL;
} else {
*pos = *p;
--
2.20.1
This is the start of the stable review cycle for the 5.5.16 release.
There are 48 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 15:46:32 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.16-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.5.16-rc2
Randy Dunlap <rdunlap(a)infradead.org>
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: always acquire cpu_hotplug_lock before pinst->lock
Ursula Braun <ubraun(a)linux.ibm.com>
net/smc: fix cleanup for linkgroup setup failures
Amritha Nambiar <amritha.nambiar(a)intel.com>
net: Fix Tx hash bound checking
Paolo Abeni <pabeni(a)redhat.com>
net: genetlink: return the error code when attribute parsing fails.
Mika Westerberg <mika.westerberg(a)linux.intel.com>
i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
Mika Westerberg <mika.westerberg(a)linux.intel.com>
watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional
Mika Westerberg <mika.westerberg(a)linux.intel.com>
watchdog: iTCO_wdt: Export vendorsupport
Neal Cardwell <ncardwell(a)google.com>
tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
Jiri Pirko <jiri(a)mellanox.com>
sched: act: count in the size of action flags bitfield
Mike Marciniszyn <mike.marciniszyn(a)intel.com>
IB/hfi1: Ensure pq is not left on waitlist
David Howells <dhowells(a)redhat.com>
rxrpc: Fix sendmsg(MSG_WAITALL) handling
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: yoyo: don't add TLV offset when reading FIFOs
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: consider HE capability when setting LDPC
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix wrong value in record tracker enum
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Freeman Liu <freeman.liu(a)unisoc.com>
nvmem: sprd: Fix the block lock operation
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix 32-bit capabilities warning
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix gcc build warnings
James Zhu <James.Zhu(a)amd.com>
drm/amdgpu: fix typo for vcn1 idle check
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
initramfs: restore default compression behavior
Gerd Hoffmann <kraxel(a)redhat.com>
drm/bochs: downgrade pci_request_region failure from error to warning
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
Evan Quan <evan.quan(a)amd.com>
drm/amdgpu: add fbdev suspend/resume on gpu reset
Jérôme Pouiller <jerome.pouiller(a)silabs.com>
staging: wfx: fix warning about freeing in-use mutex during device unregister
Prabhath Sajeepa <psajeepa(a)purestorage.com>
nvme-rdma: Avoid double freeing of async event data
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: macb: Fix handling of fixed-link node
Qiujun Huang <hqjagain(a)gmail.com>
sctp: fix refcount bug in sctp_wfree
Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
sctp: fix possibly using a bad saddr with a given dst
William Dauchy <w.dauchy(a)criteo.com>
net, ip_tunnel: fix interface lookup with no key
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: dsa: ksz: Select KSZ protocol tag
Qian Cai <cai(a)lca.pw>
ipv4: fix a RCU-list lock in fib_triestat_seq_show
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++++++
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 ++++
drivers/gpu/drm/bochs/bochs_hw.c | 6 +-
drivers/i2c/busses/i2c-i801.c | 45 ++++---------
drivers/infiniband/hw/hfi1/user_sdma.c | 25 +++++++-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 +++--
drivers/net/dsa/microchip/Kconfig | 1 +
drivers/net/ethernet/cadence/macb_main.c | 3 +
.../ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 25 +++-----
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +-
drivers/nvme/host/rdma.c | 8 ++-
drivers/nvmem/nvmem-sysfs.c | 6 ++
drivers/nvmem/sprd-efuse.c | 2 +-
drivers/pci/pci-sysfs.c | 6 +-
drivers/power/supply/axp288_charger.c | 57 ++++++++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
drivers/staging/wfx/hif_tx.c | 1 +
drivers/watchdog/iTCO_vendor.h | 2 +
drivers/watchdog/iTCO_vendor_support.c | 16 ++---
drivers/watchdog/iTCO_wdt.c | 28 +++++----
include/uapi/linux/coresight-stm.h | 6 +-
kernel/padata.c | 6 +-
lib/test_xarray.c | 18 ++++++
lib/xarray.c | 3 +-
mm/mempolicy.c | 6 +-
net/core/dev.c | 2 +
net/ipv4/fib_trie.c | 3 +
net/ipv4/ip_tunnel.c | 6 +-
net/ipv4/tcp_input.c | 6 +-
net/netlink/genetlink.c | 5 +-
net/rxrpc/sendmsg.c | 4 +-
net/sched/act_api.c | 1 +
net/sctp/ipv6.c | 20 ++++--
net/sctp/protocol.c | 28 ++++++---
net/sctp/socket.c | 31 ++++++---
net/smc/af_smc.c | 25 +++++---
net/smc/smc_core.c | 12 ++++
net/smc/smc_core.h | 2 +-
sound/pci/hda/patch_ca0132.c | 1 +
tools/power/x86/turbostat/Makefile | 2 +-
tools/power/x86/turbostat/turbostat.c | 73 ++++++++++++++--------
usr/Kconfig | 22 +++----
52 files changed, 421 insertions(+), 188 deletions(-)
This is the start of the stable review cycle for the 5.4.31 release.
There are 38 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 15:46:32 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.31-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.31-rc2
Randy Dunlap <rdunlap(a)infradead.org>
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: always acquire cpu_hotplug_lock before pinst->lock
Amritha Nambiar <amritha.nambiar(a)intel.com>
net: Fix Tx hash bound checking
Mika Westerberg <mika.westerberg(a)linux.intel.com>
i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
Mika Westerberg <mika.westerberg(a)linux.intel.com>
watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional
Mika Westerberg <mika.westerberg(a)linux.intel.com>
watchdog: iTCO_wdt: Export vendorsupport
Neal Cardwell <ncardwell(a)google.com>
tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
Mike Marciniszyn <mike.marciniszyn(a)intel.com>
IB/hfi1: Ensure pq is not left on waitlist
David Howells <dhowells(a)redhat.com>
rxrpc: Fix sendmsg(MSG_WAITALL) handling
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: yoyo: don't add TLV offset when reading FIFOs
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: consider HE capability when setting LDPC
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix wrong value in record tracker enum
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix 32-bit capabilities warning
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix gcc build warnings
James Zhu <James.Zhu(a)amd.com>
drm/amdgpu: fix typo for vcn1 idle check
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
initramfs: restore default compression behavior
Gerd Hoffmann <kraxel(a)redhat.com>
drm/bochs: downgrade pci_request_region failure from error to warning
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: introduce m32-flag and m64-flag
Prabhath Sajeepa <psajeepa(a)purestorage.com>
nvme-rdma: Avoid double freeing of async event data
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++++++
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 ++++
drivers/gpu/drm/bochs/bochs_hw.c | 6 +-
drivers/i2c/busses/i2c-i801.c | 45 ++++---------
drivers/infiniband/hw/hfi1/user_sdma.c | 25 +++++++-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 +++--
.../ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 +-
.../ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 25 +++-----
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +-
drivers/nvme/host/rdma.c | 8 ++-
drivers/nvmem/nvmem-sysfs.c | 6 ++
drivers/pci/pci-sysfs.c | 6 +-
drivers/power/supply/axp288_charger.c | 57 ++++++++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
drivers/watchdog/iTCO_vendor.h | 2 +
drivers/watchdog/iTCO_vendor_support.c | 16 ++---
drivers/watchdog/iTCO_wdt.c | 28 +++++----
include/uapi/linux/coresight-stm.h | 6 +-
kernel/padata.c | 6 +-
lib/test_xarray.c | 18 ++++++
lib/xarray.c | 3 +-
mm/mempolicy.c | 6 +-
net/core/dev.c | 2 +
net/ipv4/tcp_input.c | 6 +-
net/rxrpc/sendmsg.c | 4 +-
scripts/Kconfig.include | 7 +++
sound/pci/hda/patch_ca0132.c | 1 +
tools/power/x86/turbostat/Makefile | 2 +-
tools/power/x86/turbostat/turbostat.c | 73 ++++++++++++++--------
usr/Kconfig | 22 +++----
39 files changed, 327 insertions(+), 147 deletions(-)
From: "Gustavo A. R. Silva" <gustavo(a)embeddedor.com>
commit c3422ad5f84a66739ec6a37251ca27638c85b6be upstream.
Currently there is no check on platform_get_irq() return value
in case it fails, hence never actually reporting any errors and
causing unexpected behavior when using such value as argument
for function regmap_irq_get_virq().
Fix this by adding a proper check, a message reporting any errors
and returning *pirq*
Addresses-Coverity-ID: 1443940 ("Improper use of negative value")
Fixes: 843735b788a4 ("power: axp288_charger: axp288 charger driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com>
Reviewed-by: Hans de Goede <hdegoede(a)redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu(a)toshiba.co.jp>
---
drivers/power/axp288_charger.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/power/axp288_charger.c b/drivers/power/axp288_charger.c
index e4d569f57acc9..0c6fed79c363b 100644
--- a/drivers/power/axp288_charger.c
+++ b/drivers/power/axp288_charger.c
@@ -883,6 +883,10 @@ static int axp288_charger_probe(struct platform_device *pdev)
/* Register charger interrupts */
for (i = 0; i < CHRG_INTR_END; i++) {
pirq = platform_get_irq(info->pdev, i);
+ if (pirq < 0) {
+ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", pirq);
+ return pirq;
+ }
info->irq[i] = regmap_irq_get_virq(info->regmap_irqc, pirq);
if (info->irq[i] < 0) {
dev_warn(&info->pdev->dev,
--
2.26.0
Currently we only poll for an ACT up to 30 times, with a busy-wait delay
of 100µs between each attempt - giving us a timeout of 2900µs. While
this might seem sensible, it would appear that in certain scenarios it
can take dramatically longer then that for us to receive an ACT. On one
of the EVGA MST hubs that I have available, I observed said hub
sometimes taking longer then a second before signalling the ACT. These
delays mostly seem to occur when previous sideband messages we've sent
are NAKd by the hub, however it wouldn't be particularly surprising if
it's possible to reproduce times like this simply by introducing branch
devices with large LCTs since payload allocations have to take effect on
every downstream device up to the payload's target.
So, instead of just retrying 30 times we poll for the ACT for up to 3ms,
and additionally use usleep_range() to avoid a very long and rude
busy-wait. Note that the previous retry count of 30 appears to have been
arbitrarily chosen, as I can't find any mention of a recommended timeout
or retry count for ACTs in the DisplayPort 2.0 specification. This also
goes for the range we were previously using for udelay(), although I
suspect that was just copied from the recommended delay for link
training on SST devices.
Changes since v1:
* Use readx_poll_timeout() instead of open-coding timeout loop - Sean
Paul
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
Cc: Sean Paul <sean(a)poorly.run>
Cc: <stable(a)vger.kernel.org> # v3.17+
---
drivers/gpu/drm/drm_dp_mst_topology.c | 57 ++++++++++++++++-----------
1 file changed, 34 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index c83adbdfc1cd..ce61964baa7c 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -27,6 +27,7 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
+#include <linux/iopoll.h>
#if IS_ENABLED(CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS)
#include <linux/stacktrace.h>
@@ -4460,43 +4461,53 @@ static int drm_dp_dpcd_write_payload(struct drm_dp_mst_topology_mgr *mgr,
return ret;
}
+static int do_get_act_status(struct drm_dp_aux *aux)
+{
+ int ret;
+ u8 status;
+
+ ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
+ if (ret < 0)
+ return ret;
+
+ return status;
+}
/**
* drm_dp_check_act_status() - Polls for ACT handled status.
* @mgr: manager to use
*
* Tries waiting for the MST hub to finish updating it's payload table by
- * polling for the ACT handled bit.
+ * polling for the ACT handled bit for up to 3 seconds (yes-some hubs really
+ * take that long).
*
* Returns:
* 0 if the ACT was handled in time, negative error code on failure.
*/
int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr)
{
- int count = 0, ret;
- u8 status;
-
- do {
- ret = drm_dp_dpcd_readb(mgr->aux,
- DP_PAYLOAD_TABLE_UPDATE_STATUS,
- &status);
- if (ret < 0) {
- DRM_DEBUG_KMS("failed to read payload table status %d\n",
- ret);
- return ret;
- }
-
- if (status & DP_PAYLOAD_ACT_HANDLED)
- break;
- count++;
- udelay(100);
- } while (count < 30);
-
- if (!(status & DP_PAYLOAD_ACT_HANDLED)) {
- DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n",
- status, count);
+ /*
+ * There doesn't seem to be any recommended retry count or timeout in
+ * the MST specification. Since some hubs have been observed to take
+ * over 1 second to update their payload allocations under certain
+ * conditions, we use a rather large timeout value.
+ */
+ const int timeout_ms = 3000;
+ int ret, status;
+
+ ret = readx_poll_timeout(do_get_act_status, mgr->aux, status,
+ status & DP_PAYLOAD_ACT_HANDLED || status < 0,
+ 100, timeout_ms * USEC_PER_MSEC);
+ if (ret < 0 && status >= 0) {
+ DRM_DEBUG_KMS("Failed to get ACT bit %d after %dms\n",
+ status, timeout_ms);
return -EINVAL;
+ } else if (status < 0) {
+ DRM_DEBUG_KMS("Failed to read payload table status: %d\n",
+ status);
+ return status;
}
+
return 0;
}
EXPORT_SYMBOL(drm_dp_check_act_status);
--
2.25.1
Hi,
please consider commit aa9f7d5172fa ("mm: mempolicy: require at least one nodeid
for MPOL_PREFERRED") for stable releases. It does fix a real problem, even though
the CVE assigned to it (CVE-2020-11565) may be a bit bogus.
I verified that the patch applies cleanly all the way to v4.4.y.
Thanks,
Guenter
This is the start of the stable review cycle for the 5.6.3 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 10:13:38 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.3-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.6.3-rc1
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Takashi Iwai <tiwai(a)suse.de>
Revert "ALSA: uapi: Drop asound.h inclusion from asoc.h"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Freeman Liu <freeman.liu(a)unisoc.com>
nvmem: sprd: Fix the block lock operation
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Khouloud Touil <ktouil(a)baylibre.com>
nvmem: release the write-protect pin
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Uma Shankar <uma.shankar(a)intel.com>
drm/i915/display: Fix mode private_flags comparison at atomic_check
Torsten Duwe <duwe(a)lst.de>
drm/bridge: analogix-anx6345: Avoid duplicate -supply suffix
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Jann Horn <jannh(a)google.com>
bpf: Fix tnum constraints for 32-bit comparisons
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Xin Long <lucien.xin(a)gmail.com>
udp: initialize is_flist with 0 in udp_gro_receive
Florian Westphal <fw(a)strlen.de>
net: fix fraglist segmentation reference count leak
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: macb: Fix handling of fixed-link node
Qiujun Huang <hqjagain(a)gmail.com>
sctp: fix refcount bug in sctp_wfree
Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
sctp: fix possibly using a bad saddr with a given dst
William Dauchy <w.dauchy(a)criteo.com>
net, ip_tunnel: fix interface lookup with no key
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: dsa: ksz: Select KSZ protocol tag
Qian Cai <cai(a)lca.pw>
ipv4: fix a RCU-list lock in fib_triestat_seq_show
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++
drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 4 +-
drivers/gpu/drm/i915/display/intel_display.c | 4 +-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 ++-
drivers/net/dsa/microchip/Kconfig | 1 +
drivers/net/ethernet/cadence/macb_main.c | 3 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/nvmem/core.c | 1 +
drivers/nvmem/nvmem-sysfs.c | 6 ++
drivers/nvmem/sprd-efuse.c | 2 +-
drivers/pci/pci-sysfs.c | 6 +-
drivers/power/supply/axp288_charger.c | 57 ++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
include/uapi/linux/coresight-stm.h | 6 +-
include/uapi/sound/asoc.h | 1 +
kernel/bpf/verifier.c | 108 ++++++++++++++-------
kernel/padata.c | 2 +-
lib/test_xarray.c | 18 ++++
lib/xarray.c | 3 +-
net/core/skbuff.c | 1 +
net/ipv4/fib_trie.c | 3 +
net/ipv4/ip_tunnel.c | 6 +-
net/ipv4/udp_offload.c | 1 +
net/sctp/ipv6.c | 20 ++--
net/sctp/protocol.c | 28 ++++--
net/sctp/socket.c | 31 ++++--
sound/pci/hda/patch_ca0132.c | 1 +
32 files changed, 292 insertions(+), 84 deletions(-)
This is the start of the stable review cycle for the 5.5.16 release.
There are 46 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 10:13:38 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.16-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.5.16-rc1
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: always acquire cpu_hotplug_lock before pinst->lock
Ursula Braun <ubraun(a)linux.ibm.com>
net/smc: fix cleanup for linkgroup setup failures
Amritha Nambiar <amritha.nambiar(a)intel.com>
net: Fix Tx hash bound checking
Paolo Abeni <pabeni(a)redhat.com>
net: genetlink: return the error code when attribute parsing fails.
Mika Westerberg <mika.westerberg(a)linux.intel.com>
i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
Neal Cardwell <ncardwell(a)google.com>
tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
Jiri Pirko <jiri(a)mellanox.com>
sched: act: count in the size of action flags bitfield
Mike Marciniszyn <mike.marciniszyn(a)intel.com>
IB/hfi1: Ensure pq is not left on waitlist
David Howells <dhowells(a)redhat.com>
rxrpc: Fix sendmsg(MSG_WAITALL) handling
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: yoyo: don't add TLV offset when reading FIFOs
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: consider HE capability when setting LDPC
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix wrong value in record tracker enum
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Freeman Liu <freeman.liu(a)unisoc.com>
nvmem: sprd: Fix the block lock operation
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Jann Horn <jannh(a)google.com>
bpf: Fix tnum constraints for 32-bit comparisons
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix 32-bit capabilities warning
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix gcc build warnings
James Zhu <James.Zhu(a)amd.com>
drm/amdgpu: fix typo for vcn1 idle check
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
initramfs: restore default compression behavior
Gerd Hoffmann <kraxel(a)redhat.com>
drm/bochs: downgrade pci_request_region failure from error to warning
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
Evan Quan <evan.quan(a)amd.com>
drm/amdgpu: add fbdev suspend/resume on gpu reset
Jérôme Pouiller <jerome.pouiller(a)silabs.com>
staging: wfx: fix warning about freeing in-use mutex during device unregister
Prabhath Sajeepa <psajeepa(a)purestorage.com>
nvme-rdma: Avoid double freeing of async event data
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: macb: Fix handling of fixed-link node
Qiujun Huang <hqjagain(a)gmail.com>
sctp: fix refcount bug in sctp_wfree
Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
sctp: fix possibly using a bad saddr with a given dst
William Dauchy <w.dauchy(a)criteo.com>
net, ip_tunnel: fix interface lookup with no key
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
net: dsa: ksz: Select KSZ protocol tag
Qian Cai <cai(a)lca.pw>
ipv4: fix a RCU-list lock in fib_triestat_seq_show
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 +
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 +++
drivers/gpu/drm/bochs/bochs_hw.c | 6 +-
drivers/i2c/busses/i2c-i801.c | 45 +++------
drivers/infiniband/hw/hfi1/user_sdma.c | 25 ++++-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 ++-
drivers/net/dsa/microchip/Kconfig | 1 +
drivers/net/ethernet/cadence/macb_main.c | 3 +
.../ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 25 ++---
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +-
drivers/nvme/host/rdma.c | 8 +-
drivers/nvmem/nvmem-sysfs.c | 6 ++
drivers/nvmem/sprd-efuse.c | 2 +-
drivers/pci/pci-sysfs.c | 6 +-
drivers/power/supply/axp288_charger.c | 57 ++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
drivers/staging/wfx/hif_tx.c | 1 +
include/uapi/linux/coresight-stm.h | 6 +-
kernel/bpf/verifier.c | 108 ++++++++++++++-------
kernel/padata.c | 6 +-
lib/test_xarray.c | 18 ++++
lib/xarray.c | 3 +-
net/core/dev.c | 2 +
net/ipv4/fib_trie.c | 3 +
net/ipv4/ip_tunnel.c | 6 +-
net/ipv4/tcp_input.c | 6 +-
net/netlink/genetlink.c | 5 +-
net/rxrpc/sendmsg.c | 4 +-
net/sched/act_api.c | 1 +
net/sctp/ipv6.c | 20 ++--
net/sctp/protocol.c | 28 ++++--
net/sctp/socket.c | 31 ++++--
net/smc/af_smc.c | 25 +++--
net/smc/smc_core.c | 12 +++
net/smc/smc_core.h | 2 +-
sound/pci/hda/patch_ca0132.c | 1 +
tools/power/x86/turbostat/Makefile | 2 +-
tools/power/x86/turbostat/turbostat.c | 73 ++++++++------
usr/Kconfig | 22 ++---
49 files changed, 461 insertions(+), 204 deletions(-)
This is the start of the stable review cycle for the 5.4.31 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Apr 2020 10:13:38 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.31-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.31-rc1
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: always acquire cpu_hotplug_lock before pinst->lock
Amritha Nambiar <amritha.nambiar(a)intel.com>
net: Fix Tx hash bound checking
Mika Westerberg <mika.westerberg(a)linux.intel.com>
i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
Neal Cardwell <ncardwell(a)google.com>
tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
Mike Marciniszyn <mike.marciniszyn(a)intel.com>
IB/hfi1: Ensure pq is not left on waitlist
David Howells <dhowells(a)redhat.com>
rxrpc: Fix sendmsg(MSG_WAITALL) handling
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: yoyo: don't add TLV offset when reading FIFOs
Mordechay Goodstein <mordechay.goodstein(a)intel.com>
iwlwifi: consider HE capability when setting LDPC
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix wrong value in record tracker enum
Bibby Hsieh <bibby.hsieh(a)mediatek.com>
soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
Geoffrey Allott <geoffrey(a)allott.email>
ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
Mike Snitzer <snitzer(a)redhat.com>
Revert "dm: always call blk_queue_split() in dm_process_bio()"
Hans de Goede <hdegoede(a)redhat.com>
power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
Hans de Goede <hdegoede(a)redhat.com>
extcon: axp288: Add wakeup support
Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
nvmem: check for NULL reg_read and reg_write before dereferencing
Alexander Usyskin <alexander.usyskin(a)intel.com>
mei: me: add cedar fork device ids
Eugene Syromiatnikov <esyr(a)redhat.com>
coresight: do not use the BIT() macro in the UAPI header
Kelsey Skunberg <kelsey.skunberg(a)gmail.com>
PCI: sysfs: Revert "rescan" file renames
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
YueHaibing <yuehaibing(a)huawei.com>
misc: rtsx: set correct pcr_ops for rts522A
Guenter Roeck <linux(a)roeck-us.net>
brcmfmac: abort and release host after error
Daniel Jordan <daniel.m.jordan(a)oracle.com>
padata: fix uninitialized return value in padata_replace()
Matthew Wilcox (Oracle) <willy(a)infradead.org>
XArray: Fix xa_find_next for large multi-index entries
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow
Jann Horn <jannh(a)google.com>
bpf: Fix tnum constraints for 32-bit comparisons
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix 32-bit capabilities warning
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
Len Brown <len.brown(a)intel.com>
tools/power turbostat: Fix gcc build warnings
James Zhu <James.Zhu(a)amd.com>
drm/amdgpu: fix typo for vcn1 idle check
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
initramfs: restore default compression behavior
Gerd Hoffmann <kraxel(a)redhat.com>
drm/bochs: downgrade pci_request_region failure from error to warning
Mario Kleiner <mario.kleiner.de(a)gmail.com>
drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
Masahiro Yamada <masahiroy(a)kernel.org>
kconfig: introduce m32-flag and m64-flag
Prabhath Sajeepa <psajeepa(a)purestorage.com>
nvme-rdma: Avoid double freeing of async event data
-------------
Diffstat:
Makefile | 4 +-
drivers/extcon/extcon-axp288.c | 32 ++++++
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 +++
drivers/gpu/drm/bochs/bochs_hw.c | 6 +-
drivers/i2c/busses/i2c-i801.c | 45 +++------
drivers/infiniband/hw/hfi1/user_sdma.c | 25 ++++-
drivers/md/dm.c | 5 +-
drivers/misc/cardreader/rts5227.c | 1 +
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/pci_endpoint_test.c | 14 ++-
.../ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 +-
.../ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 25 ++---
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +-
drivers/nvme/host/rdma.c | 8 +-
drivers/nvmem/nvmem-sysfs.c | 6 ++
drivers/pci/pci-sysfs.c | 6 +-
drivers/power/supply/axp288_charger.c | 57 ++++++++++-
drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
include/uapi/linux/coresight-stm.h | 6 +-
kernel/bpf/verifier.c | 108 ++++++++++++++-------
kernel/padata.c | 6 +-
lib/test_xarray.c | 18 ++++
lib/xarray.c | 3 +-
net/core/dev.c | 2 +
net/ipv4/tcp_input.c | 6 +-
net/rxrpc/sendmsg.c | 4 +-
scripts/Kconfig.include | 7 ++
sound/pci/hda/patch_ca0132.c | 1 +
tools/power/x86/turbostat/Makefile | 2 +-
tools/power/x86/turbostat/turbostat.c | 73 ++++++++------
usr/Kconfig | 22 ++---
36 files changed, 367 insertions(+), 163 deletions(-)
The patch
ASoC: cs4270: pull reset GPIO low then high
has been applied to the asoc tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From ccfc531695f3a4aada042f6bdb33ac6be24e1aec Mon Sep 17 00:00:00 2001
From: Mike Willard <mwillard(a)izotope.com>
Date: Wed, 1 Apr 2020 20:54:54 +0000
Subject: [PATCH] ASoC: cs4270: pull reset GPIO low then high
Pull the RST line low then high when initializing the driver,
in order to force a reset of the chip.
Previously, the line was not pulled low, which could result in
the chip registers not resetting to their default values on boot.
Signed-off-by: Mike Willard <mwillard(a)izotope.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/20200401205454.79792-1-mwillard@izotope.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
---
sound/soc/codecs/cs4270.c | 40 ++++++++++++++++++++++++++++++++++-----
1 file changed, 35 insertions(+), 5 deletions(-)
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 5f25b9f872bd..8a02791e44ad 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -137,6 +137,9 @@ struct cs4270_private {
/* power domain regulators */
struct regulator_bulk_data supplies[ARRAY_SIZE(supply_names)];
+
+ /* reset gpio */
+ struct gpio_desc *reset_gpio;
};
static const struct snd_soc_dapm_widget cs4270_dapm_widgets[] = {
@@ -648,6 +651,22 @@ static const struct regmap_config cs4270_regmap = {
.volatile_reg = cs4270_reg_is_volatile,
};
+/**
+ * cs4270_i2c_remove - deinitialize the I2C interface of the CS4270
+ * @i2c_client: the I2C client object
+ *
+ * This function puts the chip into low power mode when the i2c device
+ * is removed.
+ */
+static int cs4270_i2c_remove(struct i2c_client *i2c_client)
+{
+ struct cs4270_private *cs4270 = i2c_get_clientdata(i2c_client);
+
+ gpiod_set_value_cansleep(cs4270->reset_gpio, 0);
+
+ return 0;
+}
+
/**
* cs4270_i2c_probe - initialize the I2C interface of the CS4270
* @i2c_client: the I2C client object
@@ -660,7 +679,6 @@ static int cs4270_i2c_probe(struct i2c_client *i2c_client,
const struct i2c_device_id *id)
{
struct cs4270_private *cs4270;
- struct gpio_desc *reset_gpiod;
unsigned int val;
int ret, i;
@@ -679,10 +697,21 @@ static int cs4270_i2c_probe(struct i2c_client *i2c_client,
if (ret < 0)
return ret;
- reset_gpiod = devm_gpiod_get_optional(&i2c_client->dev, "reset",
- GPIOD_OUT_HIGH);
- if (PTR_ERR(reset_gpiod) == -EPROBE_DEFER)
- return -EPROBE_DEFER;
+ /* reset the device */
+ cs4270->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(cs4270->reset_gpio)) {
+ dev_dbg(&i2c_client->dev, "Error getting CS4270 reset GPIO\n");
+ return PTR_ERR(cs4270->reset_gpio);
+ }
+
+ if (cs4270->reset_gpio) {
+ dev_dbg(&i2c_client->dev, "Found reset GPIO\n");
+ gpiod_set_value_cansleep(cs4270->reset_gpio, 1);
+ }
+
+ /* Sleep 500ns before i2c communications */
+ ndelay(500);
cs4270->regmap = devm_regmap_init_i2c(i2c_client, &cs4270_regmap);
if (IS_ERR(cs4270->regmap))
@@ -735,6 +764,7 @@ static struct i2c_driver cs4270_i2c_driver = {
},
.id_table = cs4270_id,
.probe = cs4270_i2c_probe,
+ .remove = cs4270_i2c_remove,
};
module_i2c_driver(cs4270_i2c_driver);
--
2.20.1
Hi Greg,
as announced i have backported the identified patches for CVE-2020-1749 from kernel 5.x into v4.14.
Applies to stable linux-v4.14.y (with y=175).
For 4.19, a different patch set is required, i will send this patchset in a few seconds.
Please find the patches for 4.14 appended.
Best regards
Carsten
-----------------
Mentor Graphics (Deutschland) GmbH, Arnulfstraße 201, 80634 München / Germany
Registergericht München HRB 106955, Geschäftsführer: Thomas Heurung, Alexander Walter
Whenever we get an -EFAULT, we failed to read in guest 2 physical
address space. Such addressing exceptions are reported via a program
intercept to the nested hypervisor.
We faked the intercept, we have to return to guest 2. Instead, right
now we would be returning -EFAULT from the intercept handler, eventually
crashing the VM.
Addressing exceptions can only happen if the g2->g3 page tables
reference invalid g2 addresses (say, either a table or the final page is
not accessible - so something that basically never happens in sane
environments.
Identified by manual code inspection.
Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc: <stable(a)vger.kernel.org> # v4.8+
Signed-off-by: David Hildenbrand <david(a)redhat.com>
---
arch/s390/kvm/vsie.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 076090f9e666..4f6c22d72072 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1202,6 +1202,7 @@ static int vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
scb_s->iprcc = PGM_ADDRESSING;
scb_s->pgmilc = 4;
scb_s->gpsw.addr = __rewind_psw(scb_s->gpsw, 4);
+ rc = 1;
}
return rc;
}
--
2.25.1
In case we have a region 1 ASCE, our shadow/g3 address can have any value.
Unfortunately, (-1UL << 64) is undefined and triggers sometimes,
rejecting valid shadow addresses when trying to walk our shadow table
hierarchy.
The result is that the prefix cannot get mapped and will loop basically
forever trying to map it (-EAGAIN loop).
After all, the broken check is only a sanity check, our table shadowing
code in kvm_s390_shadow_tables() already checks these conditions, injecting
proper translation exceptions. Turn it into a WARN_ON_ONCE().
Fixes: 4be130a08420 ("s390/mm: add shadow gmap support")
Tested-by: Janosch Frank <frankja(a)linux.ibm.com>
Reported-by: Janosch Frank <frankja(a)linux.ibm.com>
Cc: <stable(a)vger.kernel.org> # v4.8+
Signed-off-by: David Hildenbrand <david(a)redhat.com>
---
arch/s390/mm/gmap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 2fbece47ef6f..b93dd54b234a 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmap *gmap, unsigned long start,
static inline unsigned long *gmap_table_walk(struct gmap *gmap,
unsigned long gaddr, int level)
{
+ const int asce_type = gmap->asce & _ASCE_TYPE_MASK;
unsigned long *table;
if ((gmap->asce & _ASCE_TYPE_MASK) + 4 < (level * 4))
return NULL;
if (gmap_is_shadow(gmap) && gmap->removed)
return NULL;
- if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)))
+
+ if (WARN_ON_ONCE(asce_type != _ASCE_TYPE_REGION1 &&
+ gaddr & (-1UL << (31 + (asce_type >> 2) * 11))))
return NULL;
+
table = gmap->table;
switch (gmap->asce & _ASCE_TYPE_MASK) {
case _ASCE_TYPE_REGION1:
--
2.25.1
On 3/31/20 7:08 PM, David Miller wrote:
> From: Bruno Meneguele <bmeneg(a)redhat.com>
> Date: Tue, 31 Mar 2020 10:06:30 -0300
>
>> A testing message was brought by 13d0f7b814d9 ("net/bpfilter: fix dprintf
>> usage for /dev/kmsg") but should've been deleted before patch submission.
>> Although it doesn't cause any harm to the code or functionality itself, it's
>> totally unpleasant to have it displayed on every loop iteration with no real
>> use case. Thus remove it unconditionally.
>>
>> Fixes: 13d0f7b814d9 ("net/bpfilter: fix dprintf usage for /dev/kmsg")
>> Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
>
> Applied, thanks.
>
As the commit this fixes was included in a stable release (at least 5.4.29[0],
I did not checked others - sorry) it could make sense to backport this also
to the 5.4 stable tree?
Per documentation[1], I checked the netdev and Greg's queues, but did not found
it to be included anywhere yet.
I hope I handled this request somewhat correctly, please tell me if I should
propose the backported patch more directly to the respective stable list. As is,
the patch[2] applies fine here on top of 5.4.30.
cheers,
Thomas
[0]: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…
[1]: https://www.kernel.org/doc/html/latest/networking/netdev-FAQ.html#q-how-can…
[2]: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/patch/?id=41…