- Linux-stable-mirror - lists.linaro.org

[PATCH v2] ALSA: hda/realtek - a fake key event is triggered by running shutup

by Hui Wang

On the Lenovo X1C7 machines, after we plug the headset, the rt_resume() and rt_suspend() of the codec driver will be called periodically, the driver can't stay in the rt_suspend state even users doen't use the sound card. Through debugging, I found when running rt_suspend(), it will call alc225_shutup(), in this function, it will change 3k pull down control by alc_update_coef_idx(codec, 0x4a, 0, 3 << 10), this will trigger a fake key event and that event will resume the codec, when codec suspend agin, it will trigger the fake key event one more time, this process will repeat. If disable the key event before changing the pull down control, it will not trigger fake key event. It also needs to restore the pull down control and re-enable the key event, otherwise the system can't get key event when codec is in rt_suspend state. Also move some functions ahead of alc225_shutup(), this can save the function declaration. Fixes: 76f7dec08fd6 (ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1) Cc: Kailang Yang <kailang(a)realtek.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Hui Wang <hui.wang(a)canonical.com> --- sound/pci/hda/patch_realtek.c | 170 +++++++++++++++++++++------------- 1 file changed, 107 insertions(+), 63 deletions(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 1ad8c2e2d1af..0af33f00617a 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -107,6 +107,7 @@ struct alc_spec { unsigned int done_hp_init:1; unsigned int no_shutup_pins:1; unsigned int ultra_low_power:1; + unsigned int has_hs_key:1; /* for PLL fix */ hda_nid_t pll_nid; @@ -2982,6 +2983,107 @@ static int alc269_parse_auto_config(struct hda_codec *codec) return alc_parse_auto_config(codec, alc269_ignore, ssids); } +static const struct hda_jack_keymap alc_headset_btn_keymap[] = { + { SND_JACK_BTN_0, KEY_PLAYPAUSE }, + { SND_JACK_BTN_1, KEY_VOICECOMMAND }, + { SND_JACK_BTN_2, KEY_VOLUMEUP }, + { SND_JACK_BTN_3, KEY_VOLUMEDOWN }, + {} +}; + +static void alc_headset_btn_callback(struct hda_codec *codec, + struct hda_jack_callback *jack) +{ + int report = 0; + + if (jack->unsol_res & (7 << 13)) + report |= SND_JACK_BTN_0; + + if (jack->unsol_res & (1 << 16 | 3 << 8)) + report |= SND_JACK_BTN_1; + + /* Volume up key */ + if (jack->unsol_res & (7 << 23)) + report |= SND_JACK_BTN_2; + + /* Volume down key */ + if (jack->unsol_res & (7 << 10)) + report |= SND_JACK_BTN_3; + + jack->jack->button_state = report; +} + +static void alc_disable_headset_jack_key(struct hda_codec *codec) +{ + struct alc_spec *spec = codec->spec; + + if (!spec->has_hs_key) + return; + + switch (codec->core.vendor_id) { + case 0x10ec0215: + case 0x10ec0225: + case 0x10ec0285: + case 0x10ec0295: + case 0x10ec0289: + case 0x10ec0299: + alc_write_coef_idx(codec, 0x48, 0x0); + alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); + alc_update_coef_idx(codec, 0x44, 0x0045 << 8, 0x0); + break; + case 0x10ec0236: + case 0x10ec0256: + alc_write_coef_idx(codec, 0x48, 0x0); + alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); + break; + } +} + +static void alc_enable_headset_jack_key(struct hda_codec *codec) +{ + struct alc_spec *spec = codec->spec; + + if (!spec->has_hs_key) + return; + + switch (codec->core.vendor_id) { + case 0x10ec0215: + case 0x10ec0225: + case 0x10ec0285: + case 0x10ec0295: + case 0x10ec0289: + case 0x10ec0299: + alc_write_coef_idx(codec, 0x48, 0xd011); + alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); + alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8); + break; + case 0x10ec0236: + case 0x10ec0256: + alc_write_coef_idx(codec, 0x48, 0xd011); + alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); + break; + } +} + +static void alc_fixup_headset_jack(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +{ + struct alc_spec *spec = codec->spec; + + switch (action) { + case HDA_FIXUP_ACT_PRE_PROBE: + spec->has_hs_key = 1; + snd_hda_jack_detect_enable_callback(codec, 0x55, + alc_headset_btn_callback); + snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false, + SND_JACK_HEADSET, alc_headset_btn_keymap); + break; + case HDA_FIXUP_ACT_INIT: + alc_enable_headset_jack_key(codec); + break; + } +} + static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up) { alc_update_coef_idx(codec, 0x04, 1 << 11, power_up ? (1 << 11) : 0); @@ -3372,6 +3474,8 @@ static void alc225_shutup(struct hda_codec *codec) if (!hp_pin) hp_pin = 0x21; + + alc_disable_headset_jack_key(codec); /* 3k pull low control for Headset jack. */ alc_update_coef_idx(codec, 0x4a, 0, 3 << 10); @@ -3411,6 +3515,9 @@ static void alc225_shutup(struct hda_codec *codec) alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4); msleep(30); } + + alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); + alc_enable_headset_jack_key(codec); } static void alc_default_init(struct hda_codec *codec) @@ -5668,69 +5775,6 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec, snd_hda_override_wcaps(codec, 0x03, 0); } -static const struct hda_jack_keymap alc_headset_btn_keymap[] = { - { SND_JACK_BTN_0, KEY_PLAYPAUSE }, - { SND_JACK_BTN_1, KEY_VOICECOMMAND }, - { SND_JACK_BTN_2, KEY_VOLUMEUP }, - { SND_JACK_BTN_3, KEY_VOLUMEDOWN }, - {} -}; - -static void alc_headset_btn_callback(struct hda_codec *codec, - struct hda_jack_callback *jack) -{ - int report = 0; - - if (jack->unsol_res & (7 << 13)) - report |= SND_JACK_BTN_0; - - if (jack->unsol_res & (1 << 16 | 3 << 8)) - report |= SND_JACK_BTN_1; - - /* Volume up key */ - if (jack->unsol_res & (7 << 23)) - report |= SND_JACK_BTN_2; - - /* Volume down key */ - if (jack->unsol_res & (7 << 10)) - report |= SND_JACK_BTN_3; - - jack->jack->button_state = report; -} - -static void alc_fixup_headset_jack(struct hda_codec *codec, - const struct hda_fixup *fix, int action) -{ - - switch (action) { - case HDA_FIXUP_ACT_PRE_PROBE: - snd_hda_jack_detect_enable_callback(codec, 0x55, - alc_headset_btn_callback); - snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false, - SND_JACK_HEADSET, alc_headset_btn_keymap); - break; - case HDA_FIXUP_ACT_INIT: - switch (codec->core.vendor_id) { - case 0x10ec0215: - case 0x10ec0225: - case 0x10ec0285: - case 0x10ec0295: - case 0x10ec0289: - case 0x10ec0299: - alc_write_coef_idx(codec, 0x48, 0xd011); - alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); - alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8); - break; - case 0x10ec0236: - case 0x10ec0256: - alc_write_coef_idx(codec, 0x48, 0xd011); - alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); - break; - } - break; - } -} - static void alc295_fixup_chromebook(struct hda_codec *codec, const struct hda_fixup *fix, int action) { -- 2.17.1

5 years, 7 months

2
1
0 0

[patch 5/5] mm/sparse: fix kernel crash with pfn_section_valid check

by Andrew Morton

From: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com> Subject: mm/sparse: fix kernel crash with pfn_section_valid check Fix the below crash BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000c3447c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1 ... NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0 LR [c000000000088354] vmemmap_free+0x144/0x320 Call Trace: section_deactivate+0x220/0x240 __remove_pages+0x118/0x170 arch_remove_memory+0x3c/0x150 memunmap_pages+0x1cc/0x2f0 devm_action_release+0x30/0x50 release_nodes+0x2f8/0x3e0 device_release_driver_internal+0x168/0x270 unbind_store+0x130/0x170 drv_attr_store+0x44/0x60 sysfs_kf_write+0x68/0x80 kernfs_fop_write+0x100/0x290 __vfs_write+0x3c/0x70 vfs_write+0xcc/0x240 ksys_write+0x7c/0x140 system_call+0x5c/0x68 The crash is due to NULL dereference at test_bit(idx, ms->usage->subsection_map); due to ms->usage = NULL; in pfn_section_valid() With commit d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after depopulate_section_mem(). This was done so that pfn_page() can work correctly with kernel config that disables SPARSEMEM_VMEMMAP. With that config pfn_to_page does __section_mem_map_addr(__sec) + __pfn; where static inline struct page *__section_mem_map_addr(struct mem_section *section) { unsigned long map = section->section_mem_map; map &= SECTION_MAP_MASK; return (struct page *)map; } Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is used to check the pfn validity (pfn_valid()). Since section_deactivate release mem_section->usage if a section is fully deactivated, pfn_valid() check after a subsection_deactivate cause a kernel crash. static inline int pfn_valid(unsigned long pfn) { ... return early_section(ms) || pfn_section_valid(ms, pfn); } where static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); return test_bit(idx, ms->usage->subsection_map); } Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is freed. For architectures like ppc64 where large pages are used for vmmemap mapping (16MB), a specific vmemmap mapping can cover multiple sections. Hence before a vmemmap mapping page can be freed, the kernel needs to make sure there are no valid sections within that mapping. Clearing the section valid bit before depopulate_section_memap enables this. [aneesh.kumar(a)linux.ibm.com: add comment] Link: http://lkml.kernel.org/r/20200326133235.343616-1-aneesh.kumar@linux.ibm.com…: http://lkml.kernel.org/r/20200325031914.107660-1-aneesh.kumar@linux.ibm.com Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Reviewed-by: Baoquan He <bhe(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Reviewed-by: Wei Yang <richard.weiyang(a)gmail.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/mm/sparse.c~mm-sparse-fix-kernel-crash-with-pfn_section_valid-check +++ a/mm/sparse.c @@ -781,6 +781,12 @@ static void section_deactivate(unsigned ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } if (section_is_early && memmap) _

5 years, 7 months

1
0
0 0

[patch 1/5] mm/swapfile.c: move inode_lock out of claim_swapfile

by Andrew Morton

From: Naohiro Aota <naohiro.aota(a)wdc.com> Subject: mm/swapfile.c: move inode_lock out of claim_swapfile claim_swapfile() currently keeps the inode locked when it is successful, or the file is already swapfile (with -EBUSY). And, on the other error cases, it does not lock the inode. This inconsistency of the lock state and return value is quite confusing and actually causing a bad unlock balance as below in the "bad_swap" section of __do_sys_swapon(). This commit fixes this issue by moving the inode_lock() and IS_SWAPFILE check out of claim_swapfile(). The inode is unlocked in "bad_swap_unlock_inode" section, so that the inode is ensured to be unlocked at "bad_swap". Thus, error handling codes after the locking now jumps to "bad_swap_unlock_inode" instead of "bad_swap". ===================================== WARNING: bad unlock balance detected! 5.5.0-rc7+ #176 Not tainted ------------------------------------- swapon/4294 is trying to release lock (&sb->s_type->i_mutex_key) at: [<ffffffff8173a6eb>] __do_sys_swapon+0x94b/0x3550 but there are no more locks to release! other info that might help us debug this: no locks held by swapon/4294. stack backtrace: CPU: 5 PID: 4294 Comm: swapon Not tainted 5.5.0-rc7-BTRFS-ZNS+ #176 Hardware name: ASUS All Series/H87-PRO, BIOS 2102 07/29/2014 Call Trace: dump_stack+0xa1/0xea ? __do_sys_swapon+0x94b/0x3550 print_unlock_imbalance_bug.cold+0x114/0x123 ? __do_sys_swapon+0x94b/0x3550 lock_release+0x562/0xed0 ? kvfree+0x31/0x40 ? lock_downgrade+0x770/0x770 ? kvfree+0x31/0x40 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 up_write+0x2d/0x490 ? kfree+0x293/0x2f0 __do_sys_swapon+0x94b/0x3550 ? putname+0xb0/0xf0 ? kmem_cache_free+0x2e7/0x370 ? do_sys_open+0x184/0x3e0 ? generic_max_swapfile_size+0x40/0x40 ? do_syscall_64+0x27/0x4b0 ? entry_SYSCALL_64_after_hwframe+0x49/0xbe ? lockdep_hardirqs_on+0x38c/0x590 __x64_sys_swapon+0x54/0x80 do_syscall_64+0xa4/0x4b0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f15da0a0dc7 Link: http://lkml.kernel.org/r/20200206090132.154869-1-naohiro.aota@wdc.com Fixes: 1638045c3677 ("mm: set S_SWAPFILE on blockdev swap devices") Signed-off-by: Naohiro Aota <naohiro.aota(a)wdc.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Tested-by: Qais Youef <qais.yousef(a)arm.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/swapfile.c | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-) --- a/mm/swapfile.c~mm-swap-move-inode_lock-out-of-claim_swapfile +++ a/mm/swapfile.c @@ -2899,10 +2899,6 @@ static int claim_swapfile(struct swap_in p->bdev = inode->i_sb->s_bdev; } - inode_lock(inode); - if (IS_SWAPFILE(inode)) - return -EBUSY; - return 0; } @@ -3157,36 +3153,41 @@ SYSCALL_DEFINE2(swapon, const char __use mapping = swap_file->f_mapping; inode = mapping->host; - /* will take i_rwsem; */ error = claim_swapfile(p, inode); if (unlikely(error)) goto bad_swap; + inode_lock(inode); + if (IS_SWAPFILE(inode)) { + error = -EBUSY; + goto bad_swap_unlock_inode; + } + /* * Read the swap header. */ if (!mapping->a_ops->readpage) { error = -EINVAL; - goto bad_swap; + goto bad_swap_unlock_inode; } page = read_mapping_page(mapping, 0, swap_file); if (IS_ERR(page)) { error = PTR_ERR(page); - goto bad_swap; + goto bad_swap_unlock_inode; } swap_header = kmap(page); maxpages = read_swap_header(p, swap_header, inode); if (unlikely(!maxpages)) { error = -EINVAL; - goto bad_swap; + goto bad_swap_unlock_inode; } /* OK, set up the swap map and apply the bad block list */ swap_map = vzalloc(maxpages); if (!swap_map) { error = -ENOMEM; - goto bad_swap; + goto bad_swap_unlock_inode; } if (bdi_cap_stable_pages_required(inode_to_bdi(inode))) @@ -3211,7 +3212,7 @@ SYSCALL_DEFINE2(swapon, const char __use GFP_KERNEL); if (!cluster_info) { error = -ENOMEM; - goto bad_swap; + goto bad_swap_unlock_inode; } for (ci = 0; ci < nr_cluster; ci++) @@ -3220,7 +3221,7 @@ SYSCALL_DEFINE2(swapon, const char __use p->percpu_cluster = alloc_percpu(struct percpu_cluster); if (!p->percpu_cluster) { error = -ENOMEM; - goto bad_swap; + goto bad_swap_unlock_inode; } for_each_possible_cpu(cpu) { struct percpu_cluster *cluster; @@ -3234,13 +3235,13 @@ SYSCALL_DEFINE2(swapon, const char __use error = swap_cgroup_swapon(p->type, maxpages); if (error) - goto bad_swap; + goto bad_swap_unlock_inode; nr_extents = setup_swap_map_and_extents(p, swap_header, swap_map, cluster_info, maxpages, &span); if (unlikely(nr_extents < 0)) { error = nr_extents; - goto bad_swap; + goto bad_swap_unlock_inode; } /* frontswap enabled? set up bit-per-page map for frontswap */ if (IS_ENABLED(CONFIG_FRONTSWAP)) @@ -3280,7 +3281,7 @@ SYSCALL_DEFINE2(swapon, const char __use error = init_swap_address_space(p->type, maxpages); if (error) - goto bad_swap; + goto bad_swap_unlock_inode; /* * Flush any pending IO and dirty mappings before we start using this @@ -3290,7 +3291,7 @@ SYSCALL_DEFINE2(swapon, const char __use error = inode_drain_writes(inode); if (error) { inode->i_flags &= ~S_SWAPFILE; - goto bad_swap; + goto bad_swap_unlock_inode; } mutex_lock(&swapon_mutex); @@ -3315,6 +3316,8 @@ SYSCALL_DEFINE2(swapon, const char __use error = 0; goto out; +bad_swap_unlock_inode: + inode_unlock(inode); bad_swap: free_percpu(p->percpu_cluster); p->percpu_cluster = NULL; @@ -3322,6 +3325,7 @@ bad_swap: set_blocksize(p->bdev, p->old_block_size); blkdev_put(p->bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL); } + inode = NULL; destroy_swap_extents(p); swap_cgroup_swapoff(p->type); spin_lock(&swap_lock); @@ -3333,13 +3337,8 @@ bad_swap: kvfree(frontswap_map); if (inced_nr_rotate_swap) atomic_dec(&nr_rotate_swap); - if (swap_file) { - if (inode) { - inode_unlock(inode); - inode = NULL; - } + if (swap_file) filp_close(swap_file, NULL); - } out: if (page && !IS_ERR(page)) { kunmap(page); _

5 years, 7 months

1
0
0 0

[folded-merged] mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 has been removed from the -mm tree. Its filename was mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2.patch This patch was dropped because it was folded into mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch ------------------------------------------------------ From: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com> Subject: mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 add comment Link: http://lkml.kernel.org/r/20200326133235.343616-1-aneesh.kumar@linux.ibm.com Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Reviewed-by: Baoquan He <bhe(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/mm/sparse.c~mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 +++ a/mm/sparse.c @@ -781,7 +781,11 @@ static void section_deactivate(unsigned ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - /* Mark the section invalid */ + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } _ Patches currently in -mm which might be from aneesh.kumar(a)linux.ibm.com are mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch

5 years, 7 months

1
0
0 0

+ umh-fix-refcount-underflow-in-fork_usermode_blob.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: umh: fix refcount underflow in fork_usermode_blob(). has been added to the -mm tree. Its filename is umh-fix-refcount-underflow-in-fork_usermode_blob.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/umh-fix-refcount-underflow-in-fork… and later at http://ozlabs.org/~akpm/mmotm/broken-out/umh-fix-refcount-underflow-in-fork… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Subject: umh: fix refcount underflow in fork_usermode_blob(). Since free_bprm(bprm) always calls allow_write_access(bprm->file) and fput(bprm->file) if bprm->file is set to non-NULL, __do_execve_file() must call deny_write_access(file) and get_file(file) if called from do_execve_file() path. Otherwise, use-after-free access can happen at fput(file) in fork_usermode_blob(). general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 3 PID: 4131 Comm: insmod Tainted: G O 5.6.0-rc5+ #978 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 RIP: 0010:fork_usermode_blob+0xaa/0x190 Link: http://lkml.kernel.org/r/9b846b1f-a231-4f09-8c37-6bfb0d1e7b05@i-love.sakura… Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Fixes: 449325b52b7a6208 ("umh: introduce fork_usermode_blob() helper") Cc: <stable(a)vger.kernel.org> [4.18+] Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: David S. Miller <davem(a)davemloft.net> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/exec.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/fs/exec.c~umh-fix-refcount-underflow-in-fork_usermode_blob +++ a/fs/exec.c @@ -1761,11 +1761,17 @@ static int __do_execve_file(int fd, stru check_unsafe_exec(bprm); current->in_execve = 1; - if (!file) + if (!file) { file = do_open_execat(fd, filename, flags); - retval = PTR_ERR(file); - if (IS_ERR(file)) - goto out_unmark; + retval = PTR_ERR(file); + if (IS_ERR(file)) + goto out_unmark; + } else { + retval = deny_write_access(file); + if (retval) + goto out_unmark; + get_file(file); + } sched_exec(); _ Patches currently in -mm which might be from penguin-kernel(a)i-love.sakura.ne.jp are kernel-hung_taskc-monitor-killed-tasks.patch umh-fix-refcount-underflow-in-fork_usermode_blob.patch

5 years, 7 months

1
0
0 0

Patches for v4.4.y

by Guenter Roeck

Hi, Please consider applying the following patches to v4.4.y. The following patches were found to be missing in v4.4.y by the ChromeOS missing patches robot. The patches meet the following criteria. - The patch includes a Fixes: tag - The patch referenced in the Fixes: tag has been applied to v4.4.y - The patch itself has not been applied to v4.4.y All patches have been applied to v4.4.y and chromeos-4-4. Resulting images have been build- and runtime-tested on real hardware running chromeos-4.4 and with virtual hardware on kerneltests.org. Upstream commit 14fa91e0fef8 ("IB/ipoib: Do not warn if IPoIB debugfs doesn't exist") Fixes: 771a52584096 ("IB/IPoIB: ibX: failed to create mcg debug file") in v4.4.y: 771a52584096 Upstream commit efc45154828a ("uapi glibc compat: fix outer guard of net device flags enum") Fixes: 4a91cb61bb99 ("uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h") in v4.4.y: 1575c095e444 Upstream commit c4409905cd6e ("KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr") Fixes: d391f1207067 ("x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested") in v4.4.y: 0c53038267a9 Notes: This patch also applies to v4.9.y. This patch has already been applied to v4.14.y. This patch does not affect v4.19.y and later. Upstream commit b76ba4af4ddd ("drivers/hwspinlock: use correct radix tree API") Fixes: c6400ba7e13a ("drivers/hwspinlock: fix race between radix tree insertion and lookup") in v4.4.y: 077b6173a8c8 Upstream commit 28d35bcdd392 ("net: ipv4: don't let PMTU updates increase route MTU") Fixes: d52e5a7e7ca4 ("ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu") in v4.4.y: 119bbaa6795a Notes: This patch also applies to v4.9.y. This patch also applies to v4.14.y. This patch does not affect v4.19.y and later. Note: I generated this notification manually. I hope I'll have some automation soon; until then I'll send similar notifications for other kernel branches as I find the time. Thanks, Guenter

5 years, 7 months

2
1
0 0

Please apply commit 42d84c8490f9 ("vhost: Check docket sk_family instead of call getname") to v4.4.y

by Guenter Roeck

Commit 42d84c8490f9 ("vhost: Check docket sk_family instead of call getname") fixes CVE-2020-10942. It has been applied to v4.14.y and later, but not to v4.4.y. While it does not apply directly to v4.4.y, its backport to v4.14.y (commit ff8e12b0cfe2 in v4.14.y) does. Please apply the backport to v4.4.y as well. Thanks, Guenter

5 years, 7 months

2
1
0 0

[tip: smp/core] cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the smp/core branch of tip: Commit-ID: e98eac6ff1b45e4e73f2e6031b37c256ccb5d36b Gitweb: https://git.kernel.org/tip/e98eac6ff1b45e4e73f2e6031b37c256ccb5d36b Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Fri, 27 Mar 2020 12:06:44 +01:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Sat, 28 Mar 2020 11:42:55 +01:00 cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus() A recent change to freeze_secondary_cpus() which added an early abort if a wakeup is pending missed the fact that the function is also invoked for shutdown, reboot and kexec via disable_nonboot_cpus(). In case of disable_nonboot_cpus() the wakeup event needs to be ignored as the purpose is to terminate the currently running kernel. Add a 'suspend' argument which is only set when the freeze is in context of a suspend operation. If not set then an eventually pending wakeup event is ignored. Fixes: a66d955e910a ("cpu/hotplug: Abort disabling secondary CPUs if wakeup is pending") Reported-by: Boqun Feng <boqun.feng(a)gmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Pavankumar Kondeti <pkondeti(a)codeaurora.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/874kuaxdiz.fsf@nanos.tec.linutronix.de --- include/linux/cpu.h | 12 +++++++++--- kernel/cpu.c | 4 ++-- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/include/linux/cpu.h b/include/linux/cpu.h index 9ead281..beaed2d 100644 --- a/include/linux/cpu.h +++ b/include/linux/cpu.h @@ -144,12 +144,18 @@ static inline void get_online_cpus(void) { cpus_read_lock(); } static inline void put_online_cpus(void) { cpus_read_unlock(); } #ifdef CONFIG_PM_SLEEP_SMP -extern int freeze_secondary_cpus(int primary); +int __freeze_secondary_cpus(int primary, bool suspend); +static inline int freeze_secondary_cpus(int primary) +{ + return __freeze_secondary_cpus(primary, true); +} + static inline int disable_nonboot_cpus(void) { - return freeze_secondary_cpus(0); + return __freeze_secondary_cpus(0, false); } -extern void enable_nonboot_cpus(void); + +void enable_nonboot_cpus(void); static inline int suspend_disable_secondary_cpus(void) { diff --git a/kernel/cpu.c b/kernel/cpu.c index 3084849..12ae636 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1327,7 +1327,7 @@ void bringup_nonboot_cpus(unsigned int setup_max_cpus) #ifdef CONFIG_PM_SLEEP_SMP static cpumask_var_t frozen_cpus; -int freeze_secondary_cpus(int primary) +int __freeze_secondary_cpus(int primary, bool suspend) { int cpu, error = 0; @@ -1352,7 +1352,7 @@ int freeze_secondary_cpus(int primary) if (cpu == primary) continue; - if (pm_wakeup_pending()) { + if (suspend && pm_wakeup_pending()) { pr_info("Wakeup pending. Abort CPU freeze\n"); error = -EBUSY; break;

5 years, 7 months

1
0
0 0

[PATCHES] Networking

by David Miller

Please queue up the following networking bug fixes for v5.4 and v5.5 -stable, respectively. Thank you.

5 years, 7 months

2
1
0 0

patch "vt: vt_ioctl: fix use-after-free in vt_in_use()" added to tty-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vt: vt_ioctl: fix use-after-free in vt_in_use() to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 7cf64b18b0b96e751178b8d0505d8466ff5a448f Mon Sep 17 00:00:00 2001 From: Eric Biggers <ebiggers(a)google.com> Date: Sat, 21 Mar 2020 20:43:05 -0700 Subject: vt: vt_ioctl: fix use-after-free in vt_in_use() vt_in_use() dereferences console_driver->ttys[i] without proper locking. This is broken because the tty can be closed and freed concurrently. We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL' and skipping the check of tty_struct::count. But, looking at console_driver->ttys[i] isn't really appropriate anyway because even if it is NULL the tty can still be in the process of being closed. Instead, fix it by making vt_in_use() require console_lock() and check whether the vt is allocated and has port refcount > 1. This works since following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" the port refcount is incremented while the vt is open. Reproducer (very unreliable, but it worked for me after a few minutes): #include <fcntl.h> #include <linux/vt.h> int main() { int fd, nproc; struct vt_stat state; char ttyname[16]; fd = open("/dev/tty10", O_RDONLY); for (nproc = 1; nproc < 8; nproc *= 2) fork(); for (;;) { sprintf(ttyname, "/dev/tty%d", rand() % 8); close(open(ttyname, O_RDONLY)); ioctl(fd, VT_GETSTATE, &state); } } KASAN report: BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 Read of size 4 at addr ffff888065722468 by task syz-vt2/132 CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Allocated by task 136: [...] kzalloc include/linux/slab.h:669 [inline] alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 41: [...] kfree+0xbf/0x200 mm/slab.c:3757 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable(a)vger.kernel.org> # v3.4+ Acked-by: Jiri Slaby <jslaby(a)suse.cz> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/vt_ioctl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index f62f498f63c0..daf61c28ba76 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -43,9 +43,15 @@ bool vt_dont_switch; static inline bool vt_in_use(unsigned int i) { - extern struct tty_driver *console_driver; + const struct vc_data *vc = vc_cons[i].d; - return console_driver->ttys[i] && console_driver->ttys[i]->count; + /* + * console_lock must be held to prevent the vc from being deallocated + * while we're checking whether it's in-use. + */ + WARN_CONSOLE_UNLOCKED(); + + return vc && kref_read(&vc->port.kref) > 1; } static inline bool vt_busy(int i) @@ -643,15 +649,16 @@ int vt_ioctl(struct tty_struct *tty, struct vt_stat __user *vtstat = up; unsigned short state, mask; - /* Review: FIXME: Console lock ? */ if (put_user(fg_console + 1, &vtstat->v_active)) ret = -EFAULT; else { state = 1; /* /dev/tty0 is always open */ + console_lock(); /* required by vt_in_use() */ for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; ++i, mask <<= 1) if (vt_in_use(i)) state |= mask; + console_unlock(); ret = put_user(state, &vtstat->v_state); } break; @@ -661,10 +668,11 @@ int vt_ioctl(struct tty_struct *tty, * Returns the first available (non-opened) console. */ case VT_OPENQRY: - /* FIXME: locking ? - but then this is a stupid API */ + console_lock(); /* required by vt_in_use() */ for (i = 0; i < MAX_NR_CONSOLES; ++i) if (!vt_in_use(i)) break; + console_unlock(); uival = i < MAX_NR_CONSOLES ? (i+1) : -1; goto setint; -- 2.26.0

5 years, 7 months

1
0
0 0

patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" added to tty-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From ca4463bf8438b403596edd0ec961ca0d4fbe0220 Mon Sep 17 00:00:00 2001 From: Eric Biggers <ebiggers(a)google.com> Date: Sat, 21 Mar 2020 20:43:04 -0700 Subject: vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include <fcntl.h> #include <linux/vt.h> #include <sys/ioctl.h> #include <unistd.h> int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable(a)vger.kernel.org> # v3.4+ Reported-by: syzbot+522643ab5729b0421998(a)syzkaller.appspotmail.com Acked-by: Jiri Slaby <jslaby(a)suse.cz> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/vt.c | 23 ++++++++++++++++++++++- drivers/tty/vt/vt_ioctl.c | 12 ++++-------- 2 files changed, 26 insertions(+), 9 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index bbc26d73209a..309a39197be0 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1075,6 +1075,17 @@ static void visual_deinit(struct vc_data *vc) module_put(vc->vc_sw->owner); } +static void vc_port_destruct(struct tty_port *port) +{ + struct vc_data *vc = container_of(port, struct vc_data, port); + + kfree(vc); +} + +static const struct tty_port_operations vc_port_ops = { + .destruct = vc_port_destruct, +}; + int vc_allocate(unsigned int currcons) /* return 0 on success */ { struct vt_notifier_param param; @@ -1100,6 +1111,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ vc_cons[currcons].d = vc; tty_port_init(&vc->port); + vc->port.ops = &vc_port_ops; INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); visual_init(vc, currcons, 1); @@ -3250,6 +3262,7 @@ static int con_install(struct tty_driver *driver, struct tty_struct *tty) tty->driver_data = vc; vc->port.tty = tty; + tty_port_get(&vc->port); if (!tty->winsize.ws_row && !tty->winsize.ws_col) { tty->winsize.ws_row = vc_cons[currcons].d->vc_rows; @@ -3285,6 +3298,13 @@ static void con_shutdown(struct tty_struct *tty) console_unlock(); } +static void con_cleanup(struct tty_struct *tty) +{ + struct vc_data *vc = tty->driver_data; + + tty_port_put(&vc->port); +} + static int default_color = 7; /* white */ static int default_italic_color = 2; // green (ASCII) static int default_underline_color = 3; // cyan (ASCII) @@ -3410,7 +3430,8 @@ static const struct tty_operations con_ops = { .throttle = con_throttle, .unthrottle = con_unthrottle, .resize = vt_resize, - .shutdown = con_shutdown + .shutdown = con_shutdown, + .cleanup = con_cleanup, }; static struct cdev vc0_cdev; diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 7297997fcf04..f62f498f63c0 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -310,10 +310,8 @@ static int vt_disallocate(unsigned int vc_num) vc = vc_deallocate(vc_num); console_unlock(); - if (vc && vc_num >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc->port); - kfree(vc); - } + if (vc && vc_num >= MIN_NR_CONSOLES) + tty_port_put(&vc->port); return ret; } @@ -333,10 +331,8 @@ static void vt_disallocate_all(void) console_unlock(); for (i = 1; i < MAX_NR_CONSOLES; i++) { - if (vc[i] && i >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc[i]->port); - kfree(vc[i]); - } + if (vc[i] && i >= MIN_NR_CONSOLES) + tty_port_put(&vc[i]->port); } } -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: cdc-acm: restore capability check order" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: cdc-acm: restore capability check order to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 Mon Sep 17 00:00:00 2001 From: Matthias Reichl <hias(a)horus.com> Date: Fri, 27 Mar 2020 16:03:50 +0100 Subject: USB: cdc-acm: restore capability check order commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") introduced a regression by changing the order of capability and close settings change checks. When running with CAP_SYS_ADMIN setting the close settings to the values already set resulted in -EOPNOTSUPP. Fix this by changing the check order back to how it was before. Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") Cc: Anthony Mallet <anthony.mallet(a)laas.fr> Cc: stable <stable(a)vger.kernel.org> Cc: Oliver Neukum <oneukum(a)suse.com> Signed-off-by: Matthias Reichl <hias(a)horus.com> Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/cdc-acm.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 47f09a6ce7bd..84d6f7df09a4 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -923,16 +923,16 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss) mutex_lock(&acm->port.mutex); - if ((ss->close_delay != old_close_delay) || - (ss->closing_wait != old_closing_wait)) { - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN)) { + if ((ss->close_delay != old_close_delay) || + (ss->closing_wait != old_closing_wait)) retval = -EPERM; - else { - acm->port.close_delay = close_delay; - acm->port.closing_wait = closing_wait; - } - } else - retval = -EOPNOTSUPP; + else + retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; + } mutex_unlock(&acm->port.mutex); return retval; -- 2.26.0

5 years, 7 months

1
0
0 0

[PATCH] MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3

by Huacai Chen

LDDIR/LDPTE is Loongson-3's acceleration for Page Table Walking. If BD (Base Directory, the 4th page directory) is not enabled, then GDOffset is biased by BadVAddr[63:62]. So, if GDOffset (aka. BadVAddr[47:36] for Loongson-3) is big enough, "0b11(BadVAddr[63:62])|BadVAddr[47:36]|...." can far beyond pg_swapper_dir. This means the pg_swapper_dir may NOT be accessed by LDDIR correctly, so fix it by set PWDirExt in CP0_PWCtl. Cc: <stable(a)vger.kernel.org> Signed-off-by: Pei Huang <huangpei(a)loongson.cn> Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/mm/tlbex.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c index 344e6e9..da407cd 100644 --- a/arch/mips/mm/tlbex.c +++ b/arch/mips/mm/tlbex.c @@ -1480,6 +1480,7 @@ static void build_r4000_tlb_refill_handler(void) static void setup_pw(void) { + unsigned int pwctl; unsigned long pgd_i, pgd_w; #ifndef __PAGETABLE_PMD_FOLDED unsigned long pmd_i, pmd_w; @@ -1506,6 +1507,7 @@ static void setup_pw(void) pte_i = ilog2(_PAGE_GLOBAL); pte_w = 0; + pwctl = 1 << 30; /* Set PWDirExt */ #ifndef __PAGETABLE_PMD_FOLDED write_c0_pwfield(pgd_i << 24 | pmd_i << 12 | pt_i << 6 | pte_i); @@ -1516,8 +1518,9 @@ static void setup_pw(void) #endif #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT - write_c0_pwctl(1 << 6 | psn); + pwctl |= (1 << 6 | psn); #endif + write_c0_pwctl(pwctl); write_c0_kpgd((long)swapper_pg_dir); kscratch_used_mask |= (1 << 7); /* KScratch6 is used for KPGD */ } -- 2.7.0

5 years, 7 months

3
3
0 0

[PATCH v3] mm/hugetlb: fix a addressing exception caused by huge_pte_offset

by Longpeng(Mike)

From: Longpeng <longpeng2(a)huawei.com> Our machine encountered a panic(addressing exception) after run for a long time and the calltrace is: RIP: 0010:[<ffffffff9dff0587>] [<ffffffff9dff0587>] hugetlb_fault+0x307/0xbe0 RSP: 0018:ffff9567fc27f808 EFLAGS: 00010286 RAX: e800c03ff1258d48 RBX: ffffd3bb003b69c0 RCX: e800c03ff1258d48 RDX: 17ff3fc00eda72b7 RSI: 00003ffffffff000 RDI: e800c03ff1258d48 RBP: ffff9567fc27f8c8 R08: e800c03ff1258d48 R09: 0000000000000080 R10: ffffaba0704c22a8 R11: 0000000000000001 R12: ffff95c87b4b60d8 R13: 00005fff00000000 R14: 0000000000000000 R15: ffff9567face8074 FS: 00007fe2d9ffb700(0000) GS:ffff956900e40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffd3bb003b69c0 CR3: 000000be67374000 CR4: 00000000003627e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffff9df9b71b>] ? unlock_page+0x2b/0x30 [<ffffffff9dff04a2>] ? hugetlb_fault+0x222/0xbe0 [<ffffffff9dff1405>] follow_hugetlb_page+0x175/0x540 [<ffffffff9e15b825>] ? cpumask_next_and+0x35/0x50 [<ffffffff9dfc7230>] __get_user_pages+0x2a0/0x7e0 [<ffffffff9dfc648d>] __get_user_pages_unlocked+0x15d/0x210 [<ffffffffc068cfc5>] __gfn_to_pfn_memslot+0x3c5/0x460 [kvm] [<ffffffffc06b28be>] try_async_pf+0x6e/0x2a0 [kvm] [<ffffffffc06b4b41>] tdp_page_fault+0x151/0x2d0 [kvm] ... [<ffffffffc06a6f90>] kvm_arch_vcpu_ioctl_run+0x330/0x490 [kvm] [<ffffffffc068d919>] kvm_vcpu_ioctl+0x309/0x6d0 [kvm] [<ffffffff9deaa8c2>] ? dequeue_signal+0x32/0x180 [<ffffffff9deae34d>] ? do_sigtimedwait+0xcd/0x230 [<ffffffff9e03aed0>] do_vfs_ioctl+0x3f0/0x540 [<ffffffff9e03b0c1>] SyS_ioctl+0xa1/0xc0 [<ffffffff9e53879b>] system_call_fastpath+0x22/0x27 For 1G hugepages, huge_pte_offset() wants to return NULL or pudp, but it may return a wrong 'pmdp' if there is a race. Please look at the following code snippet: ... pud = pud_offset(p4d, addr); if (sz != PUD_SIZE && pud_none(*pud)) return NULL; /* hugepage or swap? */ if (pud_huge(*pud) || !pud_present(*pud)) return (pte_t *)pud; pmd = pmd_offset(pud, addr); if (sz != PMD_SIZE && pmd_none(*pmd)) return NULL; /* hugepage or swap? */ if (pmd_huge(*pmd) || !pmd_present(*pmd)) return (pte_t *)pmd; ... The following sequence would trigger this bug: 1. CPU0: sz = PUD_SIZE and *pud = 0 , continue 1. CPU0: "pud_huge(*pud)" is false 2. CPU1: calling hugetlb_no_page and set *pud to xxxx8e7(PRESENT) 3. CPU0: "!pud_present(*pud)" is false, continue 4. CPU0: pmd = pmd_offset(pud, addr) and maybe return a wrong pmdp However, we want CPU0 to return NULL or pudp in this case. Also, according to the section 'COMPILER BARRIER' of memory-barriers.txt: ''' (*) The compiler is within its rights to reorder loads and stores to the same variable, and in some cases, the CPU is within its rights to reorder loads to the same variable. This means that the following code: a[0] = x; a[1] = x; Might result in an older value of x stored in a[1] than in a[0]. ''' there're several other data races in huge_pte_offset, for example: ''' p4d = p4d_offset(pgd, addr) if (!p4d_present(*p4d)) return NULL; pud = pud_offset(p4d, addr) <-- will be unwinded as: pud = (pud_t *)p4d_page_vaddr(*p4d) + pud_index(address); ''' which is free for the compiler/CPU to execute as: ''' p4d = p4d_offset(pgd, addr) p4d_for_vaddr = *p4d; if (!p4d_present(*p4d)) return NULL; pud = (pud_t *)p4d_page_vaddr(p4d_for_vaddr) + pud_index(address); ''' so in the case where *p4g goes from '!present' to 'present': p4d_present(*p4d) and p4d_for_vaddr == none, meaning the p4d_page_vaddr() will crash. For these reasons, we must make sure there is exactly one dereference of p4g, pud and pmd. Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Sean Christopherson <sean.j.christopherson(a)intel.com> Cc: stable(a)vger.kernel.org Suggested-by: Jason Gunthorpe <jgg(a)ziepe.ca> Signed-off-by: Longpeng <longpeng2(a)huawei.com> --- v2 -> v3: make sure p4g/pud/pmd be dereferenced once. [Jason] --- mm/hugetlb.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index dd8737a..d4fab68 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4909,29 +4909,33 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz) { pgd_t *pgd; - p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; + p4d_t *p4g, p4d_entry; + pud_t *pud, pud_entry; + pmd_t *pmd, pmd_entry; pgd = pgd_offset(mm, addr); if (!pgd_present(*pgd)) return NULL; - p4d = p4d_offset(pgd, addr); - if (!p4d_present(*p4d)) + + p4g = p4d_offset(pgd, addr); + p4d_entry = READ_ONCE(*p4g); + if (!p4d_present(p4d_entry)) return NULL; - pud = pud_offset(p4d, addr); - if (sz != PUD_SIZE && pud_none(*pud)) + pud = pud_offset(&p4d_entry, addr); + pud_entry = READ_ONCE(*pud); + if (sz != PUD_SIZE && pud_none(pud_entry)) return NULL; /* hugepage or swap? */ - if (pud_huge(*pud) || !pud_present(*pud)) + if (pud_huge(pud_entry) || !pud_present(pud_entry)) return (pte_t *)pud; - pmd = pmd_offset(pud, addr); - if (sz != PMD_SIZE && pmd_none(*pmd)) + pmd = pmd_offset(&pud_entry, addr); + pmd_entry = READ_ONCE(*pmd); + if (sz != PMD_SIZE && pmd_none(pmd_entry)) return NULL; /* hugepage or swap? */ - if (pmd_huge(*pmd) || !pmd_present(*pmd)) + if (pmd_huge(pmd_entry) || !pmd_present(pmd_entry)) return (pte_t *)pmd; return NULL; -- 1.8.3.1

5 years, 7 months

4
3
0 0

[PATCH v2 2/3] platform/x86: intel-hid: fix: Update Tiger Lake ACPI device ID

by Gayatri Kammela

Tiger Lake's new unique ACPI device IDs for intel-hid driver is not valid because of missing 'C' in the ID. Fix the ID by updating it. After the update, the new ID should now look like INT1051 --> INTC1051 Fixes: bdd11b654035 ("platform/x86: intel-hid: Add Tiger Lake ACPI device ID") Cc: 5.6+ <stable(a)vger.kernel.org> # 5.6+ Cc: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Cc: Srinivas Pandruvada <srinivas.pandruvada(a)intel.com> Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Suggested-by: Srinivas Pandruvada <srinivas.pandruvada(a)intel.com> Signed-off-by: Gayatri Kammela <gayatri.kammela(a)intel.com> --- drivers/platform/x86/intel-hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c index 43d590250228..c0a4696803eb 100644 --- a/drivers/platform/x86/intel-hid.c +++ b/drivers/platform/x86/intel-hid.c @@ -19,7 +19,7 @@ MODULE_LICENSE("GPL"); MODULE_AUTHOR("Alex Hung"); static const struct acpi_device_id intel_hid_ids[] = { - {"INT1051", 0}, + {"INTC1051", 0}, {"INT33D5", 0}, {"", 0}, }; -- 2.17.1

5 years, 7 months

1
0
0 0

[PATCH] tools: gpio: Fix out-of-tree build regression

by Anssi Hannula

Commit 0161a94e2d1c7 ("tools: gpio: Correctly add make dependencies for gpio_utils") added a make rule for gpio-utils-in.o but used $(output) instead of the correct $(OUTPUT) for the output directory, breaking out-of-tree build (O=xx) with the following error: No rule to make target 'out/tools/gpio/gpio-utils-in.o', needed by 'out/tools/gpio/lsgpio-in.o'. Stop. Fix that. Fixes: 0161a94e2d1c ("tools: gpio: Correctly add make dependencies for gpio_utils") Cc: <stable(a)vger.kernel.org> Cc: Laura Abbott <labbott(a)redhat.com> Signed-off-by: Anssi Hannula <anssi.hannula(a)bitwise.fi> --- The 0161a94e2d1c was also applied to stable releases, which is where I got hit by the issue. tools/gpio/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile index 842287e42c83..440434027557 100644 --- a/tools/gpio/Makefile +++ b/tools/gpio/Makefile @@ -35,7 +35,7 @@ $(OUTPUT)include/linux/gpio.h: ../../include/uapi/linux/gpio.h prepare: $(OUTPUT)include/linux/gpio.h -GPIO_UTILS_IN := $(output)gpio-utils-in.o +GPIO_UTILS_IN := $(OUTPUT)gpio-utils-in.o $(GPIO_UTILS_IN): prepare FORCE $(Q)$(MAKE) $(build)=gpio-utils -- 2.21.1

5 years, 7 months

3
2
0 0

[PATCH 01/11] rtc: max8907: add missing select REGMAP_IRQ

by Jules Irenge

From: Corentin Labbe <clabbe(a)baylibre.com> I have hit the following build error: armv7a-hardfloat-linux-gnueabi-ld: drivers/rtc/rtc-max8907.o: in function `max8907_rtc_probe': rtc-max8907.c:(.text+0x400): undefined reference to `regmap_irq_get_virq' max8907 should select REGMAP_IRQ Fixes: 94c01ab6d7544 ("rtc: add MAX8907 RTC driver") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Corentin Labbe <clabbe(a)baylibre.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> --- drivers/rtc/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig index 34c8b6c7e095..8e503881d9d6 100644 --- a/drivers/rtc/Kconfig +++ b/drivers/rtc/Kconfig @@ -327,6 +327,7 @@ config RTC_DRV_MAX6900 config RTC_DRV_MAX8907 tristate "Maxim MAX8907" depends on MFD_MAX8907 || COMPILE_TEST + select REGMAP_IRQ help If you say yes here you will get support for the RTC of Maxim MAX8907 PMIC. -- 2.25.1

5 years, 7 months

1
1
0 0

patch "USB: cdc-acm: restore capability check order" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: cdc-acm: restore capability check order to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 Mon Sep 17 00:00:00 2001 From: Matthias Reichl <hias(a)horus.com> Date: Fri, 27 Mar 2020 16:03:50 +0100 Subject: USB: cdc-acm: restore capability check order commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") introduced a regression by changing the order of capability and close settings change checks. When running with CAP_SYS_ADMIN setting the close settings to the values already set resulted in -EOPNOTSUPP. Fix this by changing the check order back to how it was before. Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") Cc: Anthony Mallet <anthony.mallet(a)laas.fr> Cc: stable <stable(a)vger.kernel.org> Cc: Oliver Neukum <oneukum(a)suse.com> Signed-off-by: Matthias Reichl <hias(a)horus.com> Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/cdc-acm.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 47f09a6ce7bd..84d6f7df09a4 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -923,16 +923,16 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss) mutex_lock(&acm->port.mutex); - if ((ss->close_delay != old_close_delay) || - (ss->closing_wait != old_closing_wait)) { - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN)) { + if ((ss->close_delay != old_close_delay) || + (ss->closing_wait != old_closing_wait)) retval = -EPERM; - else { - acm->port.close_delay = close_delay; - acm->port.closing_wait = closing_wait; - } - } else - retval = -EOPNOTSUPP; + else + retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; + } mutex_unlock(&acm->port.mutex); return retval; -- 2.26.0

5 years, 7 months

1
0
0 0

[PATCH 1/2] mac80211: Check port authorization in the ieee80211_tx_dequeue() case

by Johannes Berg

From: Jouni Malinen <jouni(a)codeaurora.org> mac80211 used to check port authorization in the Data frame enqueue case when going through start_xmit(). However, that authorization status may change while the frame is waiting in a queue. Add a similar check in the dequeue case to avoid sending previously accepted frames after authorization change. This provides additional protection against potential leaking of frames after a station has been disconnected and the keys for it are being removed. Cc: stable(a)vger.kernel.org Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> --- net/mac80211/tx.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 7dbfb9e3cd84..455eb8e6a459 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3604,8 +3604,25 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); - if (txq->sta) + if (txq->sta) { tx.sta = container_of(txq->sta, struct sta_info, sta); + /* + * Drop unicast frames to unauthorised stations unless they are + * EAPOL frames from the local station. + */ + if (unlikely(!ieee80211_vif_is_mesh(&tx.sdata->vif) && + tx.sdata->vif.type != NL80211_IFTYPE_OCB && + !is_multicast_ether_addr(hdr->addr1) && + !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) && + (!(info->control.flags & + IEEE80211_TX_CTRL_PORT_CTRL_PROTO) || + !ether_addr_equal(tx.sdata->vif.addr, + hdr->addr2)))) { + I802_DEBUG_INC(local->tx_handlers_drop_unauth_port); + ieee80211_free_txskb(&local->hw, skb); + goto begin; + } + } /* * The key can be removed while the packet was queued, so need to call -- 2.25.1

5 years, 7 months

3
5
0 0

[PATCH] kernel/taskstats: fix wrong nla type for {cgroup, task}stats policy

by Yafang Shao

After our server is upgraded to a newer kernel, we found that it continuesly print a warning in the kernel message. The warning is, [832984.946322] netlink: 'irmas.lc': attribute type 1 has an invalid length. irmas.lc is one of our container monitor daemons, and it will use CGROUPSTATS_CMD_GET to get the cgroupstats, that is similar with tools/accounting/getdelays.c. We can also produce this warning with getdelays. For example, after running bellow command $ ./getdelays -C /sys/fs/cgroup/memory then you can find a warning in dmesg, [61607.229318] netlink: 'getdelays': attribute type 1 has an invalid length. This warning is introduced in commit 6e237d099fac ("netlink: Relax attr validation for fixed length types"), which is used to check whether attributes using types NLA_U* and NLA_S* have an exact length. Regarding this issue, the root cause is cgroupstats_cmd_get_policy defines a wrong type as NLA_U32, while it should be NLA_NESTED an its minimal length is NLA_HDRLEN. That is similar to taskstats_cmd_get_policy. As this behavior change really breaks our application, we'd better cc stable as well. Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Cc: stable(a)vger.kernel.org --- kernel/taskstats.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/taskstats.c b/kernel/taskstats.c index e2ac0e3..b90a520 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -35,8 +35,8 @@ static struct genl_family family; static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_U32 }, - [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_U32 }, + [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_NESTED }, + [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_NESTED }, [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING }, [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },}; @@ -45,7 +45,7 @@ * Make sure they are always aligned. */ static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 }, + [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_NESTED }, }; struct listener { -- 1.8.3.1

5 years, 7 months

2
1
0 0

Re: [PATCH 11/12] mac80211: drop data frames without key on encrypted links

by Sasha Levin

Hi [This is an automated email] This commit has been processed because it contains a -stable tag. The stable tag indicates that it's relevant for the following trees: all The bot has tested the following trees: v5.5.11, v5.4.27, v4.19.112, v4.14.174, v4.9.217, v4.4.217. v5.5.11: Build OK! v5.4.27: Build OK! v4.19.112: Failed to apply! Possible dependencies: 03512ceb60ae ("ieee80211: remove redundant leading zeroes") 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support") 0eeb2b674f05 ("mac80211: add an option for station management TXQ") 1c9559734eca ("mac80211: remove unnecessary key condition") 57a3a454f303 ("iwlwifi: split HE capabilities between AP and STA") 62872a9b9a10 ("mac80211: Fix PTK rekey freezes and clear text leak") 77f7ffdc335d ("mac80211: minstrel_ht: add flag to indicate missing/inaccurate tx A-MPDU length") 77ff2c6b4984 ("mac80211: update HE IEs to D3.3") 80aaa9c16415 ("mac80211: Add he_capa debugfs entry") 96fc6efb9ad9 ("mac80211: IEEE 802.11 Extended Key ID support") add7453ad62f ("wireless: align to draft 11ax D3.0") adf8ed01e4fd ("mac80211: add an optional TXQ for other PS-buffered frames") caf56338c22f ("mac80211: indicate support for multiple BSSID") daa5b83513a7 ("mac80211: update HE operation fields to D3.0") v4.14.174: Failed to apply! Possible dependencies: 110b32f065f3 ("iwlwifi: mvm: rs: add basic implementation of the new RS API handlers") 1c73acf58bd6 ("iwlwifi: acpi: move ACPI method definitions to acpi.h") 28e9c00fe1f0 ("iwlwifi: remove upper case letters in sku_capa_band_*_enable") 4ae80f6c8d86 ("iwlwifi: support api ver2 of NVM_GET_INFO resp") 4b82455ca51e ("iwlwifi: use flags to denote modifiers for the channel maps") 4c625c564ba2 ("iwlwifi: get rid of fw/nvm.c") 514c30696fbc ("iwlwifi: add support for IEEE802.11ax") 57a3a454f303 ("iwlwifi: split HE capabilities between AP and STA") 77ff2c6b4984 ("mac80211: update HE IEs to D3.3") 813df5cef3bb ("iwlwifi: acpi: add common code to read from ACPI") 8a6171a7b601 ("iwlwifi: fw: add FW APIs for HE") 9c4f7d512740 ("iwlwifi: move all NVM parsing code to the common files") 9f66a397c877 ("iwlwifi: mvm: rs: add ops for the new rate scaling in the FW") e7a3b8d87910 ("iwlwifi: acpi: move ACPI-related definitions to acpi.h") v4.9.217: Failed to apply! Possible dependencies: 01796ff2fa6e ("iwlwifi: mvm: always free inactive queue when moving ownership") 0aaece81114e ("iwlwifi: split firmware API from iwl-trans.h") 1ea423b0e047 ("iwlwifi: remove unnecessary dev_cmd_headroom parameter") 310181ec34e2 ("iwlwifi: move to TVQM mode") 5594d80e9bf4 ("iwlwifi: support two phys for a000 devices") 623e7766be90 ("iwlwifi: pcie: introduce split point to a000 devices") 65e254821cee ("iwlwifi: mvm: use firmware station PM notification for AP_LINK_PS") 6b35ff91572f ("iwlwifi: pcie: introduce a000 TX queues management") 727c02dfb848 ("iwlwifi: pcie: cleanup rfkill checks") 77ff2c6b4984 ("mac80211: update HE IEs to D3.3") 8236f7db2724 ("iwlwifi: mvm: assign cab queue to the correct station") 87d0e1af9db3 ("iwlwifi: mvm: separate queue mapping from queue enablement") bb49701b41de ("iwlwifi: mvm: support a000 SCD queue configuration") cf90da352a32 ("iwlwifi: mvm: use mvm_disable_queue instead of sharing logic") d172a5eff629 ("iwlwifi: reorganize firmware API") df88c08d5c7e ("iwlwifi: mvm: release static queues on bcast release") eda50cde58de ("iwlwifi: pcie: add context information support") v4.4.217: Failed to apply! Possible dependencies: 0aaece81114e ("iwlwifi: split firmware API from iwl-trans.h") 13555e8ba2f4 ("iwlwifi: mvm: add 9000-series RX API") 1a616dd2f171 ("iwlwifi: dump prph registers in a common place for all transports") 1e0bbebaae66 ("mac80211: enable starting BA session with custom timeout") 2f89a5d7d377 ("iwlwifi: mvm: move fw-dbg code to separate file") 39bdb17ebb5b ("iwlwifi: update host command messages to new format") 41837ca962ec ("iwlwifi: pcie: allow to pretend to have Tx CSUM for debug") 4707fde5cdef ("iwlwifi: mvm: use build-time assertion for fw trigger ID") 5b88792cd850 ("iwlwifi: move to wide ID for all commands") 6c4fbcbc1c95 ("iwlwifi: add support for 12K Receive Buffers") 77ff2c6b4984 ("mac80211: update HE IEs to D3.3") 92fe83430b89 ("iwlwifi: uninline iwl_trans_send_cmd") d172a5eff629 ("iwlwifi: reorganize firmware API") dcbb4746286a ("iwlwifi: trans: support a callback for ASYNC commands") NOTE: The patch will not be queued to stable trees until it is upstream. How should we proceed with this patch? -- Thanks Sasha

5 years, 7 months

1
0
0 0

[PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure

by Sriharsha Allenki

In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue. Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure. Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Signed-off-by: Sriharsha Allenki <sallenki(a)codeaurora.org> CC: stable <stable(a)vger.kernel.org> Reviewed-by: Peter Chen <peter.chen(a)nxp.com> --- Changes in v2: - As suggested by Greg, updated the tags drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 571917677d35..767f30b86645 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); if (unlikely(ret)) { + io_data->req = NULL; usb_ep_free_request(ep->ep, req); goto error_lock; } -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

5 years, 7 months

2
1
0 0

[PATCH 1/2] driver core: platform: Initialize dma_parms for platform devices

by Ulf Hansson

It's currently the platform driver's responsibility to initialize the pointer, dma_parms, for its corresponding struct device. The benefit with this approach allows us to avoid the initialization and to not waste memory for the struct device_dma_parameters, as this can be decided on a case by case basis. However, it has turned out that this approach is not very practical. Not only does it lead to open coding, but also to real errors. In principle callers of dma_set_max_seg_size() doesn't check the error code, but just assumes it succeeds. For these reasons, let's do the initialization from the common platform bus at the device registration point. This also follows the way the PCI devices are being managed, see pci_device_add(). Suggested-by: Christoph Hellwig <hch(a)lst.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> --- drivers/base/platform.c | 1 + include/linux/platform_device.h | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index b5ce7b085795..46abbfb52655 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -512,6 +512,7 @@ int platform_device_add(struct platform_device *pdev) pdev->dev.parent = &platform_bus; pdev->dev.bus = &platform_bus_type; + pdev->dev.dma_parms = &pdev->dma_parms; switch (pdev->id) { default: diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index 041bfa412aa0..81900b3cbe37 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -25,6 +25,7 @@ struct platform_device { bool id_auto; struct device dev; u64 platform_dma_mask; + struct device_dma_parameters dma_parms; u32 num_resources; struct resource *resource; -- 2.20.1

5 years, 7 months

5
4
0 0

patch "vt: vt_ioctl: fix use-after-free in vt_in_use()" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vt: vt_ioctl: fix use-after-free in vt_in_use() to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 7cf64b18b0b96e751178b8d0505d8466ff5a448f Mon Sep 17 00:00:00 2001 From: Eric Biggers <ebiggers(a)google.com> Date: Sat, 21 Mar 2020 20:43:05 -0700 Subject: vt: vt_ioctl: fix use-after-free in vt_in_use() vt_in_use() dereferences console_driver->ttys[i] without proper locking. This is broken because the tty can be closed and freed concurrently. We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL' and skipping the check of tty_struct::count. But, looking at console_driver->ttys[i] isn't really appropriate anyway because even if it is NULL the tty can still be in the process of being closed. Instead, fix it by making vt_in_use() require console_lock() and check whether the vt is allocated and has port refcount > 1. This works since following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" the port refcount is incremented while the vt is open. Reproducer (very unreliable, but it worked for me after a few minutes): #include <fcntl.h> #include <linux/vt.h> int main() { int fd, nproc; struct vt_stat state; char ttyname[16]; fd = open("/dev/tty10", O_RDONLY); for (nproc = 1; nproc < 8; nproc *= 2) fork(); for (;;) { sprintf(ttyname, "/dev/tty%d", rand() % 8); close(open(ttyname, O_RDONLY)); ioctl(fd, VT_GETSTATE, &state); } } KASAN report: BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 Read of size 4 at addr ffff888065722468 by task syz-vt2/132 CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Allocated by task 136: [...] kzalloc include/linux/slab.h:669 [inline] alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 41: [...] kfree+0xbf/0x200 mm/slab.c:3757 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable(a)vger.kernel.org> # v3.4+ Acked-by: Jiri Slaby <jslaby(a)suse.cz> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/vt_ioctl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index f62f498f63c0..daf61c28ba76 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -43,9 +43,15 @@ bool vt_dont_switch; static inline bool vt_in_use(unsigned int i) { - extern struct tty_driver *console_driver; + const struct vc_data *vc = vc_cons[i].d; - return console_driver->ttys[i] && console_driver->ttys[i]->count; + /* + * console_lock must be held to prevent the vc from being deallocated + * while we're checking whether it's in-use. + */ + WARN_CONSOLE_UNLOCKED(); + + return vc && kref_read(&vc->port.kref) > 1; } static inline bool vt_busy(int i) @@ -643,15 +649,16 @@ int vt_ioctl(struct tty_struct *tty, struct vt_stat __user *vtstat = up; unsigned short state, mask; - /* Review: FIXME: Console lock ? */ if (put_user(fg_console + 1, &vtstat->v_active)) ret = -EFAULT; else { state = 1; /* /dev/tty0 is always open */ + console_lock(); /* required by vt_in_use() */ for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; ++i, mask <<= 1) if (vt_in_use(i)) state |= mask; + console_unlock(); ret = put_user(state, &vtstat->v_state); } break; @@ -661,10 +668,11 @@ int vt_ioctl(struct tty_struct *tty, * Returns the first available (non-opened) console. */ case VT_OPENQRY: - /* FIXME: locking ? - but then this is a stupid API */ + console_lock(); /* required by vt_in_use() */ for (i = 0; i < MAX_NR_CONSOLES; ++i) if (!vt_in_use(i)) break; + console_unlock(); uival = i < MAX_NR_CONSOLES ? (i+1) : -1; goto setint; -- 2.26.0

5 years, 7 months

1
0
0 0

patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From ca4463bf8438b403596edd0ec961ca0d4fbe0220 Mon Sep 17 00:00:00 2001 From: Eric Biggers <ebiggers(a)google.com> Date: Sat, 21 Mar 2020 20:43:04 -0700 Subject: vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include <fcntl.h> #include <linux/vt.h> #include <sys/ioctl.h> #include <unistd.h> int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable(a)vger.kernel.org> # v3.4+ Reported-by: syzbot+522643ab5729b0421998(a)syzkaller.appspotmail.com Acked-by: Jiri Slaby <jslaby(a)suse.cz> Signed-off-by: Eric Biggers <ebiggers(a)google.com> Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/vt.c | 23 ++++++++++++++++++++++- drivers/tty/vt/vt_ioctl.c | 12 ++++-------- 2 files changed, 26 insertions(+), 9 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index bbc26d73209a..309a39197be0 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1075,6 +1075,17 @@ static void visual_deinit(struct vc_data *vc) module_put(vc->vc_sw->owner); } +static void vc_port_destruct(struct tty_port *port) +{ + struct vc_data *vc = container_of(port, struct vc_data, port); + + kfree(vc); +} + +static const struct tty_port_operations vc_port_ops = { + .destruct = vc_port_destruct, +}; + int vc_allocate(unsigned int currcons) /* return 0 on success */ { struct vt_notifier_param param; @@ -1100,6 +1111,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ vc_cons[currcons].d = vc; tty_port_init(&vc->port); + vc->port.ops = &vc_port_ops; INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); visual_init(vc, currcons, 1); @@ -3250,6 +3262,7 @@ static int con_install(struct tty_driver *driver, struct tty_struct *tty) tty->driver_data = vc; vc->port.tty = tty; + tty_port_get(&vc->port); if (!tty->winsize.ws_row && !tty->winsize.ws_col) { tty->winsize.ws_row = vc_cons[currcons].d->vc_rows; @@ -3285,6 +3298,13 @@ static void con_shutdown(struct tty_struct *tty) console_unlock(); } +static void con_cleanup(struct tty_struct *tty) +{ + struct vc_data *vc = tty->driver_data; + + tty_port_put(&vc->port); +} + static int default_color = 7; /* white */ static int default_italic_color = 2; // green (ASCII) static int default_underline_color = 3; // cyan (ASCII) @@ -3410,7 +3430,8 @@ static const struct tty_operations con_ops = { .throttle = con_throttle, .unthrottle = con_unthrottle, .resize = vt_resize, - .shutdown = con_shutdown + .shutdown = con_shutdown, + .cleanup = con_cleanup, }; static struct cdev vc0_cdev; diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 7297997fcf04..f62f498f63c0 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -310,10 +310,8 @@ static int vt_disallocate(unsigned int vc_num) vc = vc_deallocate(vc_num); console_unlock(); - if (vc && vc_num >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc->port); - kfree(vc); - } + if (vc && vc_num >= MIN_NR_CONSOLES) + tty_port_put(&vc->port); return ret; } @@ -333,10 +331,8 @@ static void vt_disallocate_all(void) console_unlock(); for (i = 1; i < MAX_NR_CONSOLES; i++) { - if (vc[i] && i >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc[i]->port); - kfree(vc[i]); - } + if (vc[i] && i >= MIN_NR_CONSOLES) + tty_port_put(&vc[i]->port); } } -- 2.26.0

5 years, 7 months

1
0
0 0

[PATCH] drm/prime: fix extracting of the DMA addresses from a scatterlist

by Marek Szyprowski

Scatterlist elements contains both pages and DMA addresses, but in general, one cannot assume 1:1 relation between them. The sg->length is the size of the physical memory chunk described by sg->page, while sg_dma_length(sg) is the size of the DMA (IO virtual) chunk described by sg_dma_address(sg). The proper way of extracting both: pages and DMA addresses of the whole buffer described by a scatterlist it to iterate independently over the sg->pages/sg->length and sg_dma_address(sg)/sg_dma_len(sg) entries. Fixes: 42e67b479eab ("drm/prime: use dma length macro when mapping sg") Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> --- This fixes the following kernel panic observed on ARM 32bit Samsung Exynos5250-based Snow Chromebook since linux-next 20200326, which introduced the commit 42e67b479eab ("drm/prime: use dma length macro when mapping sg"): [drm] Initialized panfrost 1.1.0 20180908 for 11800000.gpu on minor 0 [drm] Exynos DRM: using 14400000.fimd device for DMA mapping operations exynos-drm exynos-drm: bound 14400000.fimd (ops fimd_component_ops) exynos-drm exynos-drm: bound 14450000.mixer (ops mixer_component_ops) exynos-drm exynos-drm: bound 145b0000.dp-controller (ops exynos_dp_ops) exynos-drm exynos-drm: bound 14530000.hdmi (ops hdmi_component_ops) [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). ------------[ cut here ]------------ WARNING: CPU: 0 PID: 12 at mm/vmalloc.c:163 vmap_page_range_noflush+0x18c/0x1b0 Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.6.0-rc7-next-20200326-00060-gbb3f893b3f08 #7929 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events deferred_probe_work_func [<c0111f20>] (unwind_backtrace) from [<c010d128>] (show_stack+0x10/0x14) [<c010d128>] (show_stack) from [<c0a78178>] (dump_stack+0xa4/0xd0) [<c0a78178>] (dump_stack) from [<c01271a0>] (__warn+0xf4/0x10c) [<c01271a0>] (__warn) from [<c0127268>] (warn_slowpath_fmt+0xb0/0xb8) [<c0127268>] (warn_slowpath_fmt) from [<c0294fdc>] (vmap_page_range_noflush+0x18c/0x1b0) [<c0294fdc>] (vmap_page_range_noflush) from [<c02952fc>] (map_vm_area+0x30/0x6c) [<c02952fc>] (map_vm_area) from [<c0298df8>] (vmap+0x64/0x80) [<c0298df8>] (vmap) from [<c05f71f4>] (exynos_drm_fbdev_create+0x148/0x270) [<c05f71f4>] (exynos_drm_fbdev_create) from [<c05bde44>] (__drm_fb_helper_initial_config_and_unlock+0x388/0x5dc) [<c05bde44>] (__drm_fb_helper_initial_config_and_unlock) from [<c05f743c>] (exynos_drm_fbdev_init+0x78/0xe0) [<c05f743c>] (exynos_drm_fbdev_init) from [<c05f59f4>] (exynos_drm_bind+0x14c/0x19c) [<c05f59f4>] (exynos_drm_bind) from [<c0614784>] (try_to_bring_up_master+0x208/0x2bc) [<c0614784>] (try_to_bring_up_master) from [<c0614ac4>] (__component_add+0xb0/0x178) [<c0614ac4>] (__component_add) from [<c05fb488>] (exynos_dp_probe+0x94/0x12c) [<c05fb488>] (exynos_dp_probe) from [<c061e330>] (platform_drv_probe+0x48/0x9c) [<c061e330>] (platform_drv_probe) from [<c061badc>] (really_probe+0x1c4/0x470) [<c061badc>] (really_probe) from [<c061bf1c>] (driver_probe_device+0x78/0x1bc) [<c061bf1c>] (driver_probe_device) from [<c0619c9c>] (bus_for_each_drv+0x74/0xb8) [<c0619c9c>] (bus_for_each_drv) from [<c061b878>] (__device_attach+0xd4/0x16c) [<c061b878>] (__device_attach) from [<c061aa38>] (bus_probe_device+0x88/0x90) [<c061aa38>] (bus_probe_device) from [<c061af5c>] (deferred_probe_work_func+0x4c/0xd0) [<c061af5c>] (deferred_probe_work_func) from [<c0149f9c>] (process_one_work+0x30c/0x880) [<c0149f9c>] (process_one_work) from [<c014a568>] (worker_thread+0x58/0x5a4) [<c014a568>] (worker_thread) from [<c0151a5c>] (kthread+0x154/0x19c) [<c0151a5c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20) Exception stack(0xee8fdfb0 to 0xee8fdff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 irq event stamp: 54037 hardirqs last enabled at (54055): [<c019ed50>] console_unlock+0x58c/0x6a8 hardirqs last disabled at (54062): [<c019e890>] console_unlock+0xcc/0x6a8 softirqs last enabled at (54078): [<c0101724>] __do_softirq+0x4fc/0x5f4 softirqs last disabled at (54089): [<c0130248>] irq_exit+0x16c/0x170 ---[ end trace 74519922e0e4625d ]--- exynos4-fb 14400000.fimd: [drm:exynos_drm_fbdev_create] *ERROR* failed to map pages to kernel space. exynos-drm exynos-drm: [drm:exynos_drm_fbdev_init] *ERROR* failed to set up hw configuration. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 12 at kernel/locking/mutex-debug.c:103 mutex_destroy+0x84/0x88 DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G W 5.6.0-rc7-next-20200326-00060-gbb3f893b3f08 #7929 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events deferred_probe_work_func [<c0111f20>] (unwind_backtrace) from [<c010d128>] (show_stack+0x10/0x14) [<c010d128>] (show_stack) from [<c0a78178>] (dump_stack+0xa4/0xd0) [<c0a78178>] (dump_stack) from [<c01271a0>] (__warn+0xf4/0x10c) [<c01271a0>] (__warn) from [<c012722c>] (warn_slowpath_fmt+0x74/0xb8) [<c012722c>] (warn_slowpath_fmt) from [<c01892a4>] (mutex_destroy+0x84/0x88) [<c01892a4>] (mutex_destroy) from [<c05be1a4>] (drm_fb_helper_fini.part.1+0x9c/0xd4) [<c05be1a4>] (drm_fb_helper_fini.part.1) from [<c05f7464>] (exynos_drm_fbdev_init+0xa0/0xe0) [<c05f7464>] (exynos_drm_fbdev_init) from [<c05f59f4>] (exynos_drm_bind+0x14c/0x19c) [<c05f59f4>] (exynos_drm_bind) from [<c0614784>] (try_to_bring_up_master+0x208/0x2bc) [<c0614784>] (try_to_bring_up_master) from [<c0614ac4>] (__component_add+0xb0/0x178) [<c0614ac4>] (__component_add) from [<c05fb488>] (exynos_dp_probe+0x94/0x12c) [<c05fb488>] (exynos_dp_probe) from [<c061e330>] (platform_drv_probe+0x48/0x9c) [<c061e330>] (platform_drv_probe) from [<c061badc>] (really_probe+0x1c4/0x470) [<c061badc>] (really_probe) from [<c061bf1c>] (driver_probe_device+0x78/0x1bc) [<c061bf1c>] (driver_probe_device) from [<c0619c9c>] (bus_for_each_drv+0x74/0xb8) [<c0619c9c>] (bus_for_each_drv) from [<c061b878>] (__device_attach+0xd4/0x16c) [<c061b878>] (__device_attach) from [<c061aa38>] (bus_probe_device+0x88/0x90) [<c061aa38>] (bus_probe_device) from [<c061af5c>] (deferred_probe_work_func+0x4c/0xd0) [<c061af5c>] (deferred_probe_work_func) from [<c0149f9c>] (process_one_work+0x30c/0x880) [<c0149f9c>] (process_one_work) from [<c014a568>] (worker_thread+0x58/0x5a4) [<c014a568>] (worker_thread) from [<c0151a5c>] (kthread+0x154/0x19c) [<c0151a5c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20) Exception stack(0xee8fdfb0 to 0xee8fdff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 irq event stamp: 56283 hardirqs last enabled at (56283): [<c02b189c>] kfree+0x198/0x3e4 hardirqs last disabled at (56282): [<c02b17d0>] kfree+0xcc/0x3e4 softirqs last enabled at (56262): [<c0101724>] __do_softirq+0x4fc/0x5f4 softirqs last disabled at (56255): [<c0130248>] irq_exit+0x16c/0x170 ---[ end trace 74519922e0e4625e ]--- exynos-sysmmu 14640000.sysmmu: 14400000.fimd: PAGE FAULT occurred at 0x20000000 ------------[ cut here ]------------ kernel BUG at drivers/iommu/exynos-iommu.c:447! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 52 Comm: kworker/0:2 Tainted: G W 5.6.0-rc7-next-20200326-00060-gbb3f893b3f08 #7929 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events output_poll_execute PC is at exynos_sysmmu_irq+0x210/0x258 LR is at report_iommu_fault+0x144/0x1cc pc : [<c05a6e34>] lr : [<c05a13ec>] psr: a0000193 sp : cfafdbe8 ip : 2d495ebb fp : 00000200 r10: eeb187e0 r9 : 20000000 r8 : cf300000 r7 : c11d4fb0 r6 : eeb187c0 r5 : 00000000 r4 : c0b59f74 r3 : cfafc000 r2 : 00010001 r1 : 00000000 r0 : ffffffda Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 4000406a DAC: 00000051 Process kworker/0:2 (pid: 52, stack limit = 0x(ptrval)) Stack: (0xcfafdbe8 to 0xcfafe000) ... [<c05a6e34>] (exynos_sysmmu_irq) from [<c01a24f4>] (__handle_irq_event_percpu+0x68/0x42c) [<c01a24f4>] (__handle_irq_event_percpu) from [<c01a28e4>] (handle_irq_event_percpu+0x2c/0x7c) [<c01a28e4>] (handle_irq_event_percpu) from [<c01a296c>] (handle_irq_event+0x38/0x5c) [<c01a296c>] (handle_irq_event) from [<c01a7160>] (handle_level_irq+0xcc/0x150) [<c01a7160>] (handle_level_irq) from [<c01a1574>] (generic_handle_irq+0x34/0x44) [<c01a1574>] (generic_handle_irq) from [<c0509a5c>] (combiner_handle_cascade_irq+0x8c/0xdc) [<c0509a5c>] (combiner_handle_cascade_irq) from [<c01a1574>] (generic_handle_irq+0x34/0x44) [<c01a1574>] (generic_handle_irq) from [<c01a1bbc>] (__handle_domain_irq+0x7c/0xec) [<c01a1bbc>] (__handle_domain_irq) from [<c050a024>] (gic_handle_irq+0x58/0x9c) [<c050a024>] (gic_handle_irq) from [<c0100af0>] (__irq_svc+0x70/0xb0) Exception stack(0xcfafdd00 to 0xcfafdd48) dd00: c02b189c 00000000 2df3c000 00000000 cf2ed3c0 ee801cc0 60000113 ef1ddda0 dd20: c05d5500 00000000 cf2c9800 cf2ea8b8 00003220 cfafdd50 c02b189c c02b18a0 dd40: 60000113 ffffffff [<c0100af0>] (__irq_svc) from [<c02b18a0>] (kfree+0x19c/0x3e4) [<c02b18a0>] (kfree) from [<c05d5500>] (drm_atomic_state_default_clear+0x1b8/0x2dc) [<c05d5500>] (drm_atomic_state_default_clear) from [<c05d5650>] (__drm_atomic_state_free+0x10/0x50) [<c05d5650>] (__drm_atomic_state_free) from [<c05e9d88>] (drm_client_modeset_commit_atomic+0x240/0x26c) [<c05e9d88>] (drm_client_modeset_commit_atomic) from [<c05e9df8>] (drm_client_modeset_commit_locked+0x44/0x1d0) [<c05e9df8>] (drm_client_modeset_commit_locked) from [<c05e9fa8>] (drm_client_modeset_commit+0x24/0x40) [<c05e9fa8>] (drm_client_modeset_commit) from [<c05be3ec>] (drm_fb_helper_restore_fbdev_mode_unlocked+0x58/0xa4) [<c05be3ec>] (drm_fb_helper_restore_fbdev_mode_unlocked) from [<c05be468>] (drm_fb_helper_set_par+0x30/0x5c) [<c05be468>] (drm_fb_helper_set_par) from [<c05be538>] (drm_fb_helper_hotplug_event.part.5+0xa4/0xbc) [<c05be538>] (drm_fb_helper_hotplug_event.part.5) from [<c05ac148>] (drm_kms_helper_hotplug_event+0x24/0x30) [<c05ac148>] (drm_kms_helper_hotplug_event) from [<c05ac238>] (output_poll_execute+0xb8/0x1b4) [<c05ac238>] (output_poll_execute) from [<c0149f9c>] (process_one_work+0x30c/0x880) [<c0149f9c>] (process_one_work) from [<c014a568>] (worker_thread+0x58/0x5a4) [<c014a568>] (worker_thread) from [<c0151a5c>] (kthread+0x154/0x19c) [<c0151a5c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20) Exception stack(0xcfafdfb0 to 0xcfafdff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e34c00de e300119e ebee00e1 eaffff81 (e7f001f2) ---[ end trace 74519922e0e4625f ]--- Kernel panic - not syncing: Fatal exception in interrupt CPU1: stopping CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D W 5.6.0-rc7-next-20200326-00060-gbb3f893b3f08 #7929 Hardware name: Samsung Exynos (Flattened Device Tree) [<c0111f20>] (unwind_backtrace) from [<c010d128>] (show_stack+0x10/0x14) [<c010d128>] (show_stack) from [<c0a78178>] (dump_stack+0xa4/0xd0) [<c0a78178>] (dump_stack) from [<c0110ad4>] (handle_IPI+0x3b4/0x440) [<c0110ad4>] (handle_IPI) from [<c050a064>] (gic_handle_irq+0x98/0x9c) [<c050a064>] (gic_handle_irq) from [<c0100af0>] (__irq_svc+0x70/0xb0) Exception stack(0xee8fff58 to 0xee8fffa0) ff40: c0109534 00000000 ff60: 2df50000 00000000 ee8fe000 c1108ee8 c1108f2c 00000002 00000000 c0de63c0 ff80: 00000000 c1075fe8 2d495ebb ee8fffa8 c0109534 c0109538 60000013 ffffffff [<c0100af0>] (__irq_svc) from [<c0109538>] (arch_cpu_idle+0x24/0x44) [<c0109538>] (arch_cpu_idle) from [<c0163a74>] (do_idle+0x1d8/0x2d4) [<c0163a74>] (do_idle) from [<c0163f24>] (cpu_startup_entry+0x18/0x1c) [<c0163f24>] (cpu_startup_entry) from [<401018ac>] (0x401018ac) ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- --- drivers/gpu/drm/drm_prime.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 1de2cde2277c..424db18987f6 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -962,27 +962,33 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, unsigned count; struct scatterlist *sg; struct page *page; - u32 len, index; + u32 page_len, page_index; dma_addr_t addr; + u32 dma_len, dma_index; - index = 0; + page_index = 0; + dma_index = 0; for_each_sg(sgt->sgl, sg, sgt->nents, count) { - len = sg_dma_len(sg); + page_len = sg->length; page = sg_page(sg); + dma_len = sg_dma_len(sg); addr = sg_dma_address(sg); - while (len > 0) { - if (WARN_ON(index >= max_entries)) + while (pages && page_len > 0) { + if (WARN_ON(page_index >= max_entries)) return -1; - if (pages) - pages[index] = page; - if (addrs) - addrs[index] = addr; - + pages[page_index] = page; page++; + page_len -= PAGE_SIZE; + page_index++; + } + while (addrs && dma_len > 0) { + if (WARN_ON(dma_index >= max_entries)) + return -1; + addrs[dma_index] = addr; addr += PAGE_SIZE; - len -= PAGE_SIZE; - index++; + dma_len -= PAGE_SIZE; + dma_index++; } } return 0; -- 2.17.1

5 years, 7 months

3
4
0 0

Commit 024aa8732acb for 5.4.y

by Rafael J. Wysocki

Hi Greg at al, Please the following commit: commit 024aa8732acb7d2503eae43c3fe3504d0a8646d0 Author: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Date: Thu Nov 28 23:50:40 2019 +0100 ACPI: PM: s2idle: Rework ACPI events synchronization Note that the EC GPE processing need not be synchronized in acpi_s2idle_wake() after invoking acpi_ec_dispatch_gpe(), because that function checks the GPE status and dispatches its handler if need be and the SCI action handler is not going to run anyway at that point. Moreover, it is better to drain all of the pending ACPI events before restoring the working-state configuration of GPEs in acpi_s2idle_restore(), because those events are likely to be related to system wakeup, in which case they will not be relevant going forward. Rework the code to take these observations into account. Tested-by: Kenneth R. Crudup <kenny(a)panix.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> into 5.4.y as it is needed to fix an ACPI wakeup events synchronization issue in suspend-to-idle. Note that this commit was present in 5.5.0, so 5.4.y is the only -stable series needing this fix. Cheers, Rafael

5 years, 7 months

2
1
0 0

[PATCH] ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus

by Marek Szyprowski

GPIO lines for the CM36651 sensor I2C bus use the normal not the inverted polarity. This bug has been there since adding the CM36651 sensor by commit 85cb4e0bd2294, but went unnoticed because the "i2c-gpio" driver ignored the GPIO polarity specified in the device-tree. The recent conversion of "i2c-gpio" driver to the new, descriptor based GPIO API, automatically made it the DT-specified polarity aware, what broke the CM36651 sensor operation. Fixes: c769eaf7a85d ("ARM: dts: exynos: Split Trats2 DTS in preparation for Midas boards") Fixes: c10d3290cbde ("ARM: dts: Use GPIO constants for flags cells in exynos4412 boards") Fixes: 85cb4e0bd229 ("ARM: dts: add cm36651 light/proximity sensor node for exynos4412-trats2") CC: stable(a)vger.kernel.org # 4.16+ Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> --- arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi index 44f97546dd0a..f910aa924bfb 100644 --- a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi +++ b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi @@ -68,7 +68,7 @@ i2c_cm36651: i2c-gpio-2 { compatible = "i2c-gpio"; - gpios = <&gpf0 0 GPIO_ACTIVE_LOW>, <&gpf0 1 GPIO_ACTIVE_LOW>; + gpios = <&gpf0 0 GPIO_ACTIVE_HIGH>, <&gpf0 1 GPIO_ACTIVE_HIGH>; i2c-gpio,delay-us = <2>; #address-cells = <1>; #size-cells = <0>; -- 2.17.1

5 years, 7 months

2
1
0 0

[PATCH 4.19.113 0/5] mmc: Fix some busy detect problems

by Ulf Hansson

This series provides a couple of manually backported mmc changes that fixes some busy detect issues, for a couple of mmc host drivers (sdhci-tegra|omap). Ulf Hansson (5): mmc: core: Allow host controllers to require R1B for CMD6 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY drivers/mmc/core/core.c | 5 ++++- drivers/mmc/core/mmc.c | 7 +++++-- drivers/mmc/core/mmc_ops.c | 8 +++++--- drivers/mmc/host/sdhci-omap.c | 3 +++ drivers/mmc/host/sdhci-tegra.c | 3 +++ include/linux/mmc/host.h | 1 + 6 files changed, 21 insertions(+), 6 deletions(-) -- 2.20.1

5 years, 7 months

2
6
0 0

[PATCH] mpt3sas: Fix kernel panic observed on soft HBA unplug

by Sreekanth Reddy

Generic protection fault type kernel panic is observed when user performs soft(ordered) HBA unplug operation while IOs are running on drives connected to HBA. When user performs ordered HBA removal operation then kernel calls PCI device's .remove() call back function where driver is flushing out all the outstanding SCSI IO commands with DID_NO_CONNECT host byte and also un-maps sg buffers allocated for these IO commands. But in the ordered HBA removal case (unlike of real HBA hot unplug) HBA device is still alive and hence HBA hardware is performing the DMA operations to those buffers on the system memory which are already unmapped while flushing out the outstanding SCSI IO commands and this leads to Kernel panic. Fix: Don't flush out the outstanding IOs from .remove() path in case of ordered HBA removal since HBA will be still alive in this case and it can complete the outstanding IOs. Flush out the outstanding IOs only in case physical HBA hot unplug where their won't be any communication with the HBA. Cc: stable(a)vger.kernel.org Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c index 778d5e6..04a40af 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -9908,8 +9908,8 @@ static void scsih_remove(struct pci_dev *pdev) ioc->remove_host = 1; - mpt3sas_wait_for_commands_to_complete(ioc); - _scsih_flush_running_cmds(ioc); + if (!pci_device_is_present(pdev)) + _scsih_flush_running_cmds(ioc); _scsih_fw_event_cleanup_queue(ioc); @@ -9992,8 +9992,8 @@ static void scsih_remove(struct pci_dev *pdev) ioc->remove_host = 1; - mpt3sas_wait_for_commands_to_complete(ioc); - _scsih_flush_running_cmds(ioc); + if (!pci_device_is_present(pdev)) + _scsih_flush_running_cmds(ioc); _scsih_fw_event_cleanup_queue(ioc); -- 1.8.3.1

5 years, 7 months

4
9
0 0

[PATCH v2] mm/sparse: Fix kernel crash with pfn_section_valid check

by Aneesh Kumar K.V

Fixes the below crash BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000c3447c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1 ... NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0 LR [c000000000088354] vmemmap_free+0x144/0x320 Call Trace: section_deactivate+0x220/0x240 __remove_pages+0x118/0x170 arch_remove_memory+0x3c/0x150 memunmap_pages+0x1cc/0x2f0 devm_action_release+0x30/0x50 release_nodes+0x2f8/0x3e0 device_release_driver_internal+0x168/0x270 unbind_store+0x130/0x170 drv_attr_store+0x44/0x60 sysfs_kf_write+0x68/0x80 kernfs_fop_write+0x100/0x290 __vfs_write+0x3c/0x70 vfs_write+0xcc/0x240 ksys_write+0x7c/0x140 system_call+0x5c/0x68 The crash is due to NULL dereference at test_bit(idx, ms->usage->subsection_map); due to ms->usage = NULL; in pfn_section_valid() With commit: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after depopulate_section_mem(). This was done so that pfn_page() can work correctly with kernel config that disables SPARSEMEM_VMEMMAP. With that config pfn_to_page does __section_mem_map_addr(__sec) + __pfn; where static inline struct page *__section_mem_map_addr(struct mem_section *section) { unsigned long map = section->section_mem_map; map &= SECTION_MAP_MASK; return (struct page *)map; } Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is used to check the pfn validity (pfn_valid()). Since section_deactivate release mem_section->usage if a section is fully deactivated, pfn_valid() check after a subsection_deactivate cause a kernel crash. static inline int pfn_valid(unsigned long pfn) { ... return early_section(ms) || pfn_section_valid(ms, pfn); } where static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); return test_bit(idx, ms->usage->subsection_map); } Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is freed. For architectures like ppc64 where large pages are used for vmmemap mapping (16MB), a specific vmemmap mapping can cover multiple sections. Hence before a vmemmap mapping page can be freed, the kernel needs to make sure there are no valid sections within that mapping. Clearing the section valid bit before depopulate_section_memap enables this. Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> --- mm/sparse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/sparse.c b/mm/sparse.c index aadb7298dcef..65599e8bd636 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -781,6 +781,12 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } if (section_is_early && memmap) -- 2.25.1

5 years, 7 months

6
5
0 0

patch "staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 1165dd73e811a07d947aee218510571f516081f6 Mon Sep 17 00:00:00 2001 From: Qiujun Huang <hqjagain(a)gmail.com> Date: Thu, 26 Mar 2020 21:18:50 +0800 Subject: staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback We can't handle the case length > WLAN_DATA_MAXLEN. Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't read more than that. Thanks-to: Hillf Danton <hdanton(a)sina.com> Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a(a)syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c index e38acb58cd5e..fa1bf8b069fd 100644 --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3376,6 +3376,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev, WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { pr_debug("overlen frm: len=%zd\n", skblen - sizeof(struct p80211_caphdr)); + + return; } skb = dev_alloc_skb(skblen); -- 2.26.0

5 years, 7 months

1
0
0 0

patch "usb: gadget: f_fs: Fix use after free issue as part of queue failure" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: gadget: f_fs: Fix use after free issue as part of queue failure to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From f63ec55ff904b2f2e126884fcad93175f16ab4bb Mon Sep 17 00:00:00 2001 From: Sriharsha Allenki <sallenki(a)codeaurora.org> Date: Thu, 26 Mar 2020 17:26:20 +0530 Subject: usb: gadget: f_fs: Fix use after free issue as part of queue failure In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue. Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure. Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Signed-off-by: Sriharsha Allenki <sallenki(a)codeaurora.org> CC: stable <stable(a)vger.kernel.org> Reviewed-by: Peter Chen <peter.chen(a)nxp.com> Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 571917677d35..767f30b86645 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); if (unlikely(ret)) { + io_data->req = NULL; usb_ep_free_request(ep->ep, req); goto error_lock; } -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: io_edgeport: fix slab-out-of-bounds read in" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: io_edgeport: fix slab-out-of-bounds read in to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 57aa9f294b09463492f604feaa5cc719beaace32 Mon Sep 17 00:00:00 2001 From: Qiujun Huang <hqjagain(a)gmail.com> Date: Wed, 25 Mar 2020 15:52:37 +0800 Subject: USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Fix slab-out-of-bounds read in the interrupt-URB completion handler. The boundary condition should be (length - 1) as we access data[position + 1]. Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd(a)syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain(a)gmail.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index 5737add6a2a4..4cca0b836f43 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -710,7 +710,7 @@ static void edge_interrupt_callback(struct urb *urb) /* grab the txcredits for the ports if available */ position = 2; portNumber = 0; - while ((position < length) && + while ((position < length - 1) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1] << 8); if (txCredits) { -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: option: add Wistron Neweb D19Q1" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add Wistron Neweb D19Q1 to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From dfee7e2f478346b12ea651d5c28b069f6a4af563 Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:19 +0100 Subject: USB: serial: option: add Wistron Neweb D19Q1 This modem is embedded on dlink dwr-960 router. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1435 ProdID=d191 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 655a0e2f0ccf..e73d2bf81bab 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1990,6 +1990,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: option: add BroadMobi BM806U" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add BroadMobi BM806U to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 6cb2669cb97fc4fdf526127159ac59caae052247 Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:18 +0100 Subject: USB: serial: option: add BroadMobi BM806U BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem. Tested hardware BM806U is mounted on D-Link DWR-921-C3 router. T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=2033 Rev= 2.28 S: Manufacturer=Mobile Connect S: Product=Mobile Connect S: SerialNumber=f842866cfd5a C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Co-developed-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index ec3078b0e8b8..655a0e2f0ccf 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1994,6 +1994,8 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: option: add support for ASKEY WWHC050" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add support for ASKEY WWHC050 to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 007d20dca2376a751b1dad03442f118438b7e65e Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:17 +0100 Subject: USB: serial: option: add support for ASKEY WWHC050 ASKEY WWHC050 is a mcie LTE modem. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution. Co-developed-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 084cc2fff3ae..ec3078b0e8b8 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1990,6 +1990,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ -- 2.26.0

5 years, 7 months

1
0
0 0

[PATCH AUTOSEL 5.5 01/28] thunderbolt: Fix error code in tb_port_is_width_supported()

by Sasha Levin

From: Dan Carpenter <dan.carpenter(a)oracle.com> [ Upstream commit e9d0e7511fda92a6511904996dd0aa57b6d7687a ] This function is type bool, and it's supposed to return true on success. Unfortunately, this path takes negative error codes and casts them to bool (true) so it's treated as success instead of failure. Fixes: 91c0c12080d0 ("thunderbolt: Add support for lane bonding") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/thunderbolt/switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c index 43bfeb8866141..f0f77da6ca26d 100644 --- a/drivers/thunderbolt/switch.c +++ b/drivers/thunderbolt/switch.c @@ -848,7 +848,7 @@ static bool tb_port_is_width_supported(struct tb_port *port, int width) ret = tb_port_read(port, &phy, TB_CFG_PORT, port->cap_phy + LANE_ADP_CS_0, 1); if (ret) - return ret; + return false; widths = (phy & LANE_ADP_CS_0_SUPPORTED_WIDTH_MASK) >> LANE_ADP_CS_0_SUPPORTED_WIDTH_SHIFT; -- 2.20.1

5 years, 7 months

4
32
0 0

Re: [PATCH] kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy

by Johannes Berg

On Thu, 2020-03-26 at 13:08 -0700, Andrew Morton wrote: > > After our server is upgraded to a newer kernel, we found that it > > continuesly print a warning in the kernel message. The warning is, > > [832984.946322] netlink: 'irmas.lc': attribute type 1 has an invalid length. > > > > irmas.lc is one of our container monitor daemons, and it will use > > CGROUPSTATS_CMD_GET to get the cgroupstats, that is similar with > > tools/accounting/getdelays.c. We can also produce this warning with > > getdelays. For example, after running bellow command > > $ ./getdelays -C /sys/fs/cgroup/memory > > then you can find a warning in dmesg, > > [61607.229318] netlink: 'getdelays': attribute type 1 has an invalid length. > > > > This warning is introduced in commit 6e237d099fac ("netlink: Relax attr > > validation for fixed length types"), which is used to check whether > > attributes using types NLA_U* and NLA_S* have an exact length. > > > > Regarding this issue, the root cause is cgroupstats_cmd_get_policy defines > > a wrong type as NLA_U32, while it should be NLA_NESTED an its minimal > > length is NLA_HDRLEN. That is similar to taskstats_cmd_get_policy. > > > > As this behavior change really breaks our application, we'd better > > cc stable as well. Can you explain how it breaks the application? I mean, it's really only printing a message to the kernel log in this case? At least that's what you're describing. I think you may be describing it wrong, because an NLA_NESTED is allowed to be *empty* (but otherwise must have at least 4 bytes just like an NLA_U32). That said, I'm not even sure I agree that this fix is right? See below. > Is it correct to say that although the code has always been incorrect, > but only kernels after 6e237d099fac need this change? If so, I'll add > Fixes:6e237d099fac to guide the -stable backporting. That doesn't really seem right - 6e237d099fac *relaxed* the checks. If anything then it ought to point to 28033ae4e0f5 which may have actually returned an error; but again, need to understand better what really the issue is. > > diff --git a/kernel/taskstats.c b/kernel/taskstats.c > > index e2ac0e3..b90a520 100644 > > --- a/kernel/taskstats.c > > +++ b/kernel/taskstats.c > > @@ -35,8 +35,8 @@ > > static struct genl_family family; > > > > static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { > > - [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_U32 }, > > - [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_U32 }, > > + [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_NESTED }, > > + [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_NESTED }, I'm not sure where this is coming from - the kernel evidently uses them as nested attributes in *outgoing* data (see mk_reply()), but as NLA_U32 in *incoming* data, (see cmd_attr_pid() and cmd_attr_tgid()). I would generally recommend not doing such a thing as it's messy, but we do have quite a few such instances cases. In all those cases must the policy list the incoming policy since that's what the kernel uses to validate the attributes. IOW, this part of the change seems _wrong_. > > * Make sure they are always aligned. > > */ > > static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { > > - [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 }, > > + [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_NESTED }, > > }; And same here, actually. johannes

5 years, 7 months

2
1
0 0

Re: [PATCH] kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy

by Johannes Berg

On Thu, 2020-03-26 at 13:08 -0700, Andrew Morton wrote: > (cc's added) > > On Wed, 25 Mar 2020 22:50:42 -0400 Yafang Shao <laoar.shao(a)gmail.com> wrote: > > > After our server is upgraded to a newer kernel, we found that it > > continuesly print a warning in the kernel message. The warning is, > > [832984.946322] netlink: 'irmas.lc': attribute type 1 has an invalid length. > > > > irmas.lc is one of our container monitor daemons, and it will use > > CGROUPSTATS_CMD_GET to get the cgroupstats, that is similar with > > tools/accounting/getdelays.c. We can also produce this warning with > > getdelays. For example, after running bellow command > > $ ./getdelays -C /sys/fs/cgroup/memory > > then you can find a warning in dmesg, > > [61607.229318] netlink: 'getdelays': attribute type 1 has an invalid length. And looking at this ... well, that code is completely wrong? E.g. rc = send_cmd(nl_sd, id, mypid, TASKSTATS_CMD_GET, cmd_type, &tid, sizeof(__u32)); (cmd_type is one of TASKSTATS_CMD_ATTR_TGID, TASKSTATS_CMD_ATTR_PID) or it might do rc = send_cmd(nl_sd, id, mypid, CGROUPSTATS_CMD_GET, CGROUPSTATS_CMD_ATTR_FD, &cfd, sizeof(__u32)); so clearly it wants to produce a u32 attribute. But then static int send_cmd(int sd, __u16 nlmsg_type, __u32 nlmsg_pid, __u8 genl_cmd, __u16 nla_type, void *nla_data, int nla_len) { ... na = (struct nlattr *) GENLMSG_DATA(&msg); // this is still fine na->nla_type = nla_type; // this is also fine na->nla_len = nla_len + 1 + NLA_HDRLEN; // but this??? the nla_len of a netlink attribute should just be // the len ... what's NLA_HDRLEN doing here? this isn't nested // here we end up just reserving 1+NLA_HDRLEN too much space memcpy(NLA_DATA(na), nla_data, nla_len); // but then it anyway only fills the first nla_len bytes, which // is just like a regular attribute. msg.n.nlmsg_len += NLMSG_ALIGN(na->nla_len); // note that this is also wrong - it should be // += NLA_ALIGN(NLA_HDRLEN + nla_len) So really I think what happened here is precisely what we wanted - David's kernel patch caught the broken userspace tool. johannes

5 years, 7 months

3
3
0 0

[PATCH v4 2/7] ima: Evaluate error in init_ima()

by Roberto Sassu

Evaluate error in init_ima() before register_blocking_lsm_notifier() and return if not zero. Cc: stable(a)vger.kernel.org # 5.3.x Fixes: b16942455193 ("ima: use the lsm policy update notifier") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- security/integrity/ima/ima_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 9d0abedeae77..f96f151294e6 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -792,6 +792,9 @@ static int __init init_ima(void) error = ima_init(); } + if (error) + return error; + error = register_blocking_lsm_notifier(&ima_lsm_policy_notifier); if (error) pr_warn("Couldn't register LSM notifier, error %d\n", error); -- 2.17.1

5 years, 7 months

2
1
0 0

[PATCH for-rc 1/2] IB/hfi1: Fix memory leaks in sysfs registration and unregistration

by Dennis Dalessandro

From: Kaike Wan <kaike.wan(a)intel.com> When the hfi1 driver is unloaded, kmemleak will report the following issue: unreferenced object 0xffff8888461a4c08 (size 8): comm "kworker/0:0", pid 5, jiffies 4298601264 (age 2047.134s) hex dump (first 8 bytes): 73 64 6d 61 30 00 ff ff sdma0... backtrace: [<00000000311a6ef5>] kvasprintf+0x62/0xd0 [<00000000ade94d9f>] kobject_set_name_vargs+0x1c/0x90 [<0000000060657dbb>] kobject_init_and_add+0x5d/0xb0 [<00000000346fe72b>] 0xffffffffa0c5ecba [<000000006cfc5819>] 0xffffffffa0c866b9 [<0000000031c65580>] 0xffffffffa0c38e87 [<00000000e9739b3f>] local_pci_probe+0x41/0x80 [<000000006c69911d>] work_for_cpu_fn+0x16/0x20 [<00000000601267b5>] process_one_work+0x171/0x380 [<0000000049a0eefa>] worker_thread+0x1d1/0x3f0 [<00000000909cf2b9>] kthread+0xf8/0x130 [<0000000058f5f874>] ret_from_fork+0x35/0x40 This patch fixes the issue by: - Releasing dd->per_sdma[i].kobject in hfi1_unregister_sysfs(). - This will fix the memory leak. - Calling kobject_put() to unwind operations only for those entries in dd->per_sdma[] whose operations have succeeded (including the current one that has just failed) in hfi1_verbs_register_sysfs(). Fixes: 0cb2aa690c7e ("IB/hfi1: Add sysfs interface for affinity setup") Cc: <stable(a)vger.kernel.org> Reviewed-by: Mike Marciniszyn <mike.marciniszyn(a)intel.com> Signed-off-by: Kaike Wan <kaike.wan(a)intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)intel.com> --- drivers/infiniband/hw/hfi1/sysfs.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c index 90f62c4..f1bcecf 100644 --- a/drivers/infiniband/hw/hfi1/sysfs.c +++ b/drivers/infiniband/hw/hfi1/sysfs.c @@ -853,8 +853,13 @@ int hfi1_verbs_register_sysfs(struct hfi1_devdata *dd) return 0; bail: - for (i = 0; i < dd->num_sdma; i++) - kobject_del(&dd->per_sdma[i].kobj); + /* + * The function kobject_put() will call kobject_del() if the kobject + * has been added successfully. The sysfs files created under the + * kobject directory will also be removed during the process. + */ + for (; i >= 0; i--) + kobject_put(&dd->per_sdma[i].kobj); return ret; } @@ -867,6 +872,10 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd) struct hfi1_pportdata *ppd; int i; + /* Unwind operations in hfi1_verbs_register_sysfs() */ + for (i = 0; i < dd->num_sdma; i++) + kobject_put(&dd->per_sdma[i].kobj); + for (i = 0; i < dd->num_pports; i++) { ppd = &dd->pport[i];

5 years, 7 months

3
6
0 0

[PATCH AUTOSEL 4.4 1/4] ALSA: hda/realtek: Fix pop noise on ALC225

by Sasha Levin

From: Kai-Heng Feng <kai.heng.feng(a)canonical.com> [ Upstream commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757 ] Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot. So partially revert this commit for ALC225 to fix the regression. Fixes: 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") BugLink: https://bugs.launchpad.net/bugs/1866357 Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com> Link: https://lore.kernel.org/r/20200311061328.17614-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 55bae9e6de27d..76cf438aa339c 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6333,6 +6333,8 @@ static int patch_alc269(struct hda_codec *codec) alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/ break; case 0x10ec0225: + codec->power_save_node = 1; + /* fall through */ case 0x10ec0295: case 0x10ec0299: spec->codec_variant = ALC269_TYPE_ALC225; -- 2.20.1

5 years, 7 months

1
3
0 0

[PATCH AUTOSEL 4.9 1/7] ALSA: hda/realtek: Fix pop noise on ALC225

by Sasha Levin

From: Kai-Heng Feng <kai.heng.feng(a)canonical.com> [ Upstream commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757 ] Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot. So partially revert this commit for ALC225 to fix the regression. Fixes: 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") BugLink: https://bugs.launchpad.net/bugs/1866357 Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com> Link: https://lore.kernel.org/r/20200311061328.17614-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index a64612db1f155..d7b33c9c9f40b 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6410,6 +6410,8 @@ static int patch_alc269(struct hda_codec *codec) spec->gen.mixer_nid = 0; break; case 0x10ec0225: + codec->power_save_node = 1; + /* fall through */ case 0x10ec0295: spec->codec_variant = ALC269_TYPE_ALC225; break; -- 2.20.1

5 years, 7 months

1
6
0 0

[PATCH AUTOSEL 4.14 01/10] drm/bridge: dw-hdmi: fix AVI frame colorimetry

by Sasha Levin

From: Jernej Skrabec <jernej.skrabec(a)siol.net> [ Upstream commit e8dca30f7118461d47e1c3510d0e31b277439151 ] CTA-861-F explicitly states that for RGB colorspace colorimetry should be set to "none". Fix that. Acked-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Fixes: def23aa7e982 ("drm: bridge: dw-hdmi: Switch to V4L bus format and encodings") Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net> Link: https://patchwork.freedesktop.org/patch/msgid/20200304232512.51616-2-jernej… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++++++++++++---------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c index cc1094f901255..96cf64d0ee824 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c @@ -1348,28 +1348,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) frame.colorspace = HDMI_COLORSPACE_RGB; /* Set up colorimetry */ - switch (hdmi->hdmi_data.enc_out_encoding) { - case V4L2_YCBCR_ENC_601: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else + if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { + switch (hdmi->hdmi_data.enc_out_encoding) { + case V4L2_YCBCR_ENC_601: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + case V4L2_YCBCR_ENC_709: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_709; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; + break; + default: /* Carries no data */ frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + } + } else { + frame.colorimetry = HDMI_COLORIMETRY_NONE; frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; - case V4L2_YCBCR_ENC_709: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else - frame.colorimetry = HDMI_COLORIMETRY_ITU_709; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; - break; - default: /* Carries no data */ - frame.colorimetry = HDMI_COLORIMETRY_ITU_601; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; } frame.scan_mode = HDMI_SCAN_MODE_NONE; -- 2.20.1

5 years, 7 months

1
9
0 0

[PATCH AUTOSEL 4.19 01/15] drm/bridge: dw-hdmi: fix AVI frame colorimetry

by Sasha Levin

From: Jernej Skrabec <jernej.skrabec(a)siol.net> [ Upstream commit e8dca30f7118461d47e1c3510d0e31b277439151 ] CTA-861-F explicitly states that for RGB colorspace colorimetry should be set to "none". Fix that. Acked-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Fixes: def23aa7e982 ("drm: bridge: dw-hdmi: Switch to V4L bus format and encodings") Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net> Link: https://patchwork.freedesktop.org/patch/msgid/20200304232512.51616-2-jernej… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++++++++++++---------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c index 2a0a1654d3ce5..6930452a712a8 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c @@ -1364,28 +1364,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) frame.colorspace = HDMI_COLORSPACE_RGB; /* Set up colorimetry */ - switch (hdmi->hdmi_data.enc_out_encoding) { - case V4L2_YCBCR_ENC_601: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else + if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { + switch (hdmi->hdmi_data.enc_out_encoding) { + case V4L2_YCBCR_ENC_601: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + case V4L2_YCBCR_ENC_709: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_709; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; + break; + default: /* Carries no data */ frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + } + } else { + frame.colorimetry = HDMI_COLORIMETRY_NONE; frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; - case V4L2_YCBCR_ENC_709: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else - frame.colorimetry = HDMI_COLORIMETRY_ITU_709; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; - break; - default: /* Carries no data */ - frame.colorimetry = HDMI_COLORIMETRY_ITU_601; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; } frame.scan_mode = HDMI_SCAN_MODE_NONE; -- 2.20.1

5 years, 7 months

1
14
0 0

[PATCH AUTOSEL 5.4 01/19] drm/bridge: dw-hdmi: fix AVI frame colorimetry

by Sasha Levin

From: Jernej Skrabec <jernej.skrabec(a)siol.net> [ Upstream commit e8dca30f7118461d47e1c3510d0e31b277439151 ] CTA-861-F explicitly states that for RGB colorspace colorimetry should be set to "none". Fix that. Acked-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Fixes: def23aa7e982 ("drm: bridge: dw-hdmi: Switch to V4L bus format and encodings") Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net> Link: https://patchwork.freedesktop.org/patch/msgid/20200304232512.51616-2-jernej… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++++++++++++---------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c index 1326f2c734bf8..41bf4aaff21c4 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c @@ -1576,28 +1576,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) frame.colorspace = HDMI_COLORSPACE_RGB; /* Set up colorimetry */ - switch (hdmi->hdmi_data.enc_out_encoding) { - case V4L2_YCBCR_ENC_601: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else + if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { + switch (hdmi->hdmi_data.enc_out_encoding) { + case V4L2_YCBCR_ENC_601: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + case V4L2_YCBCR_ENC_709: + if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) + frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; + else + frame.colorimetry = HDMI_COLORIMETRY_ITU_709; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; + break; + default: /* Carries no data */ frame.colorimetry = HDMI_COLORIMETRY_ITU_601; + frame.extended_colorimetry = + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; + break; + } + } else { + frame.colorimetry = HDMI_COLORIMETRY_NONE; frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; - case V4L2_YCBCR_ENC_709: - if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709) - frame.colorimetry = HDMI_COLORIMETRY_EXTENDED; - else - frame.colorimetry = HDMI_COLORIMETRY_ITU_709; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; - break; - default: /* Carries no data */ - frame.colorimetry = HDMI_COLORIMETRY_ITU_601; - frame.extended_colorimetry = - HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; - break; + HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; } frame.scan_mode = HDMI_SCAN_MODE_NONE; -- 2.20.1

5 years, 7 months

1
18
0 0

[PATCH v2] RISC-V: Move all address space definition macros to one place

by Atish Patra

We get the following compilation error if CONFIG_SPARSEMEM_VMEMMAP is set. --------------------------------------------------------------- ./arch/riscv/include/asm/pgtable-64.h: In function ‘pud_page’: ./include/asm-generic/memory_model.h:54:29: error: ‘vmemmap’ undeclared (first use in this function); did you mean ‘mem_map’? #define __pfn_to_page(pfn) (vmemmap + (pfn)) ^~~~~~~ ./include/asm-generic/memory_model.h:82:21: note: in expansion of macro ‘__pfn_to_page’ #define pfn_to_page __pfn_to_page ^~~~~~~~~~~~~ ./arch/riscv/include/asm/pgtable-64.h:70:9: note: in expansion of macro ‘pfn_to_page’ return pfn_to_page(pud_val(pud) >> _PAGE_PFN_SHIFT); --------------------------------------------------------------- Fix the compliation errors by moving all the address space definition macros before including pgtable-64.h. Cc: stable(a)vger.kernel.org Fixes: 8ad8b72721d0 (riscv: Add KASAN support) Signed-off-by: Atish Patra <atish.patra(a)wdc.com> Reviewed-by: Anup Patel <anup(a)brainfault.org> --- arch/riscv/include/asm/pgtable.h | 78 +++++++++++++++++--------------- 1 file changed, 41 insertions(+), 37 deletions(-) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h index e43041519edd..393f2014dfee 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -19,6 +19,47 @@ #include <asm/tlbflush.h> #include <linux/mm_types.h> +#ifdef CONFIG_MMU + +#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) +#define VMALLOC_END (PAGE_OFFSET - 1) +#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) + +#define BPF_JIT_REGION_SIZE (SZ_128M) +#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) +#define BPF_JIT_REGION_END (VMALLOC_END) + +/* + * Roughly size the vmemmap space to be large enough to fit enough + * struct pages to map half the virtual address space. Then + * position vmemmap directly below the VMALLOC region. + */ +#define VMEMMAP_SHIFT \ + (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) +#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) +#define VMEMMAP_END (VMALLOC_START - 1) +#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) + +/* + * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel + * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. + */ +#define vmemmap ((struct page *)VMEMMAP_START) + +#define PCI_IO_SIZE SZ_16M +#define PCI_IO_END VMEMMAP_START +#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) + +#define FIXADDR_TOP PCI_IO_START +#ifdef CONFIG_64BIT +#define FIXADDR_SIZE PMD_SIZE +#else +#define FIXADDR_SIZE PGDIR_SIZE +#endif +#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) + +#endif + #ifdef CONFIG_64BIT #include <asm/pgtable-64.h> #else @@ -90,31 +131,6 @@ extern pgd_t swapper_pg_dir[]; #define __S110 PAGE_SHARED_EXEC #define __S111 PAGE_SHARED_EXEC -#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) -#define VMALLOC_END (PAGE_OFFSET - 1) -#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) - -#define BPF_JIT_REGION_SIZE (SZ_128M) -#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) -#define BPF_JIT_REGION_END (VMALLOC_END) - -/* - * Roughly size the vmemmap space to be large enough to fit enough - * struct pages to map half the virtual address space. Then - * position vmemmap directly below the VMALLOC region. - */ -#define VMEMMAP_SHIFT \ - (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) -#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) -#define VMEMMAP_END (VMALLOC_START - 1) -#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) - -/* - * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel - * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. - */ -#define vmemmap ((struct page *)VMEMMAP_START) - static inline int pmd_present(pmd_t pmd) { return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)); @@ -432,18 +448,6 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma, #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) }) #define __swp_entry_to_pte(x) ((pte_t) { (x).val }) -#define PCI_IO_SIZE SZ_16M -#define PCI_IO_END VMEMMAP_START -#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) - -#define FIXADDR_TOP PCI_IO_START -#ifdef CONFIG_64BIT -#define FIXADDR_SIZE PMD_SIZE -#else -#define FIXADDR_SIZE PGDIR_SIZE -#endif -#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) - /* * Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32. * Note that PGDIR_SIZE must evenly divide TASK_SIZE. -- 2.25.1

5 years, 7 months

1
0
0 0

[PATCH] RISC-V: Move all address space definition macros to one place

by Atish Patra

If both CONFIG_KASAN and CONFIG_SPARSEMEM_VMEMMAP are set, we get the following compilation error. --------------------------------------------------------------- ./arch/riscv/include/asm/pgtable-64.h: In function ‘pud_page’: ./include/asm-generic/memory_model.h:54:29: error: ‘vmemmap’ undeclared (first use in this function); did you mean ‘mem_map’? #define __pfn_to_page(pfn) (vmemmap + (pfn)) ^~~~~~~ ./include/asm-generic/memory_model.h:82:21: note: in expansion of macro ‘__pfn_to_page’ #define pfn_to_page __pfn_to_page ^~~~~~~~~~~~~ ./arch/riscv/include/asm/pgtable-64.h:70:9: note: in expansion of macro ‘pfn_to_page’ return pfn_to_page(pud_val(pud) >> _PAGE_PFN_SHIFT); --------------------------------------------------------------- Fix the compliation errors by moving all the address space definition macros before including pgtable-64.h. Cc: stable(a)vger.kernel.org Fixes: 8ad8b72721d0 (riscv: Add KASAN support) Signed-off-by: Atish Patra <atish.patra(a)wdc.com> --- arch/riscv/include/asm/pgtable.h | 78 +++++++++++++++++--------------- 1 file changed, 41 insertions(+), 37 deletions(-) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h index 453afb0a570a..4f6ee48a42e8 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -19,6 +19,47 @@ #include <asm/tlbflush.h> #include <linux/mm_types.h> +#ifdef CONFIG_MMU + +#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) +#define VMALLOC_END (PAGE_OFFSET - 1) +#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) + +#define BPF_JIT_REGION_SIZE (SZ_128M) +#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) +#define BPF_JIT_REGION_END (VMALLOC_END) + +/* + * Roughly size the vmemmap space to be large enough to fit enough + * struct pages to map half the virtual address space. Then + * position vmemmap directly below the VMALLOC region. + */ +#define VMEMMAP_SHIFT \ + (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) +#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) +#define VMEMMAP_END (VMALLOC_START - 1) +#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) + +/* + * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel + * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. + */ +#define vmemmap ((struct page *)VMEMMAP_START) + +#define PCI_IO_SIZE SZ_16M +#define PCI_IO_END VMEMMAP_START +#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) + +#define FIXADDR_TOP PCI_IO_START +#ifdef CONFIG_64BIT +#define FIXADDR_SIZE PMD_SIZE +#else +#define FIXADDR_SIZE PGDIR_SIZE +#endif +#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) + +#endif + #ifdef CONFIG_64BIT #include <asm/pgtable-64.h> #else @@ -90,31 +131,6 @@ extern pgd_t swapper_pg_dir[]; #define __S110 PAGE_SHARED_EXEC #define __S111 PAGE_SHARED_EXEC -#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) -#define VMALLOC_END (PAGE_OFFSET - 1) -#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) - -#define BPF_JIT_REGION_SIZE (SZ_128M) -#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) -#define BPF_JIT_REGION_END (VMALLOC_END) - -/* - * Roughly size the vmemmap space to be large enough to fit enough - * struct pages to map half the virtual address space. Then - * position vmemmap directly below the VMALLOC region. - */ -#define VMEMMAP_SHIFT \ - (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) -#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) -#define VMEMMAP_END (VMALLOC_START - 1) -#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) - -/* - * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel - * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. - */ -#define vmemmap ((struct page *)VMEMMAP_START) - static inline int pmd_present(pmd_t pmd) { return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)); @@ -452,18 +468,6 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma, #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) }) #define __swp_entry_to_pte(x) ((pte_t) { (x).val }) -#define PCI_IO_SIZE SZ_16M -#define PCI_IO_END VMEMMAP_START -#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) - -#define FIXADDR_TOP PCI_IO_START -#ifdef CONFIG_64BIT -#define FIXADDR_SIZE PMD_SIZE -#else -#define FIXADDR_SIZE PGDIR_SIZE -#endif -#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) - /* * Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32. * Note that PGDIR_SIZE must evenly divide TASK_SIZE. -- 2.25.0

5 years, 7 months

6
6
0 0

[nacked] kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy has been removed from the -mm tree. Its filename was kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy.patch This patch was dropped because it was nacked ------------------------------------------------------ From: Yafang Shao <laoar.shao(a)gmail.com> Subject: kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy After our server is upgraded to a newer kernel, we found that it continuesly print a warning in the kernel message. The warning is, [832984.946322] netlink: 'irmas.lc': attribute type 1 has an invalid length. irmas.lc is one of our container monitor daemons, and it will use CGROUPSTATS_CMD_GET to get the cgroupstats, that is similar with tools/accounting/getdelays.c. We can also produce this warning with getdelays. For example, after running below command $ ./getdelays -C /sys/fs/cgroup/memory then you can find a warning in dmesg, [61607.229318] netlink: 'getdelays': attribute type 1 has an invalid length. This warning is introduced in commit 6e237d099fac ("netlink: Relax attr validation for fixed length types"), which is used to check whether attributes using types NLA_U* and NLA_S* have an exact length. Regarding this issue, the root cause is cgroupstats_cmd_get_policy defines a wrong type as NLA_U32, while it should be NLA_NESTED an its minimal length is NLA_HDRLEN. That is similar to taskstats_cmd_get_policy. As this behavior change really breaks our application, we'd better cc stable as well. Link: http://lkml.kernel.org/r/1585191042-9935-1-git-send-email-laoar.shao@gmail.… Fixes: 6e237d099fac ("netlink: Relax attr validation for fixed length types") Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Cc: Balbir Singh <bsingharora(a)gmail.com> Cc: David Ahern <dsahern(a)gmail.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Johannes Berg <johannes(a)sipsolutions.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/taskstats.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/kernel/taskstats.c~kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy +++ a/kernel/taskstats.c @@ -35,8 +35,8 @@ struct kmem_cache *taskstats_cache; static struct genl_family family; static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_U32 }, - [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_U32 }, + [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_NESTED }, + [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_NESTED }, [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING }, [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },}; @@ -45,7 +45,7 @@ static const struct nla_policy taskstats * Make sure they are always aligned. */ static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 }, + [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_NESTED }, }; struct listener { _ Patches currently in -mm which might be from laoar.shao(a)gmail.com are mm-memcg-fix-build-error-around-the-usage-of-kmem_caches.patch

5 years, 7 months

1
0
0 0

+ kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy has been added to the -mm tree. Its filename is kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/kernel-taskstats-fix-wrong-nla-typ… and later at http://ozlabs.org/~akpm/mmotm/broken-out/kernel-taskstats-fix-wrong-nla-typ… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Yafang Shao <laoar.shao(a)gmail.com> Subject: kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy After our server is upgraded to a newer kernel, we found that it continuesly print a warning in the kernel message. The warning is, [832984.946322] netlink: 'irmas.lc': attribute type 1 has an invalid length. irmas.lc is one of our container monitor daemons, and it will use CGROUPSTATS_CMD_GET to get the cgroupstats, that is similar with tools/accounting/getdelays.c. We can also produce this warning with getdelays. For example, after running bellow command $ ./getdelays -C /sys/fs/cgroup/memory then you can find a warning in dmesg, [61607.229318] netlink: 'getdelays': attribute type 1 has an invalid length. This warning is introduced in commit 6e237d099fac ("netlink: Relax attr validation for fixed length types"), which is used to check whether attributes using types NLA_U* and NLA_S* have an exact length. Regarding this issue, the root cause is cgroupstats_cmd_get_policy defines a wrong type as NLA_U32, while it should be NLA_NESTED an its minimal length is NLA_HDRLEN. That is similar to taskstats_cmd_get_policy. As this behavior change really breaks our application, we'd better cc stable as well. Link: http://lkml.kernel.org/r/1585191042-9935-1-git-send-email-laoar.shao@gmail.… Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Cc: Balbir Singh <bsingharora(a)gmail.com> Cc: David Ahern <dsahern(a)gmail.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Johannes Berg <johannes(a)sipsolutions.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/taskstats.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/kernel/taskstats.c~kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy +++ a/kernel/taskstats.c @@ -35,8 +35,8 @@ struct kmem_cache *taskstats_cache; static struct genl_family family; static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_U32 }, - [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_U32 }, + [TASKSTATS_CMD_ATTR_PID] = { .type = NLA_NESTED }, + [TASKSTATS_CMD_ATTR_TGID] = { .type = NLA_NESTED }, [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING }, [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },}; @@ -45,7 +45,7 @@ static const struct nla_policy taskstats * Make sure they are always aligned. */ static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = { - [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 }, + [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_NESTED }, }; struct listener { _ Patches currently in -mm which might be from laoar.shao(a)gmail.com are kernel-taskstats-fix-wrong-nla-type-for-cgrouptaskstats-policy.patch mm-memcg-fix-build-error-around-the-usage-of-kmem_caches.patch

5 years, 7 months

1
0
0 0

+ mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 has been added to the -mm tree. Its filename is mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-sparse-fix-kernel-crash-with-pf… and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-sparse-fix-kernel-crash-with-pf… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com> Subject: mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 add comment Link: http://lkml.kernel.org/r/20200326133235.343616-1-aneesh.kumar@linux.ibm.com Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Reviewed-by: Baoquan He <bhe(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/mm/sparse.c~mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2 +++ a/mm/sparse.c @@ -781,7 +781,11 @@ static void section_deactivate(unsigned ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - /* Mark the section invalid */ + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } _ Patches currently in -mm which might be from aneesh.kumar(a)linux.ibm.com are mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch mm-sparse-fix-kernel-crash-with-pfn_section_valid-check-v2.patch

5 years, 7 months

1
0
0 0

[merged] libfs-fix-infoleak-in-simple_attr_read.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: libfs: fix infoleak in simple_attr_read() has been removed from the -mm tree. Its filename was libfs-fix-infoleak-in-simple_attr_read.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Eric Biggers <ebiggers(a)google.com> Subject: libfs: fix infoleak in simple_attr_read() Reading from a debugfs file at a nonzero position, without first reading at position 0, leaks uninitialized memory to userspace. It's a bit tricky to do this, since lseek() and pread() aren't allowed on these files, and write() doesn't update the position on them. But writing to them with splice() *does* update the position: #define _GNU_SOURCE 1 #include <fcntl.h> #include <stdio.h> #include <unistd.h> int main() { int pipes[2], fd, n, i; char buf[32]; pipe(pipes); write(pipes[1], "0", 1); fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR); splice(pipes[0], NULL, fd, NULL, 1, 0); n = read(fd, buf, sizeof(buf)); for (i = 0; i < n; i++) printf("%02x", buf[i]); printf(" "); } Output: 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30 Fix the infoleak by making simple_attr_read() always fill simple_attr::get_buf if it hasn't been filled yet. Link: http://lkml.kernel.org/r/20200308023849.988264-1-ebiggers@kernel.org Fixes: acaefc25d21f ("[PATCH] libfs: add simple attribute files") Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reported-by: syzbot+fcab69d1ada3e8d6f06b(a)syzkaller.appspotmail.com Reported-by: Alexander Potapenko <glider(a)google.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Kees Cook <keescook(a)chromium.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/libfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/fs/libfs.c~libfs-fix-infoleak-in-simple_attr_read +++ a/fs/libfs.c @@ -891,7 +891,7 @@ int simple_attr_open(struct inode *inode { struct simple_attr *attr; - attr = kmalloc(sizeof(*attr), GFP_KERNEL); + attr = kzalloc(sizeof(*attr), GFP_KERNEL); if (!attr) return -ENOMEM; @@ -931,9 +931,11 @@ ssize_t simple_attr_read(struct file *fi if (ret) return ret; - if (*ppos) { /* continued read */ + if (*ppos && attr->get_buf[0]) { + /* continued read */ size = strlen(attr->get_buf); - } else { /* first read */ + } else { + /* first read */ u64 val; ret = attr->get(attr->data, &val); if (ret) _ Patches currently in -mm which might be from ebiggers(a)google.com are kmod-make-request_module-return-an-error-when-autoloading-is-disabled.patch fs-filesystemsc-downgrade-user-reachable-warn_once-to-pr_warn_once.patch docs-admin-guide-document-the-kernelmodprobe-sysctl.patch selftests-kmod-fix-handling-test-numbers-above-9.patch selftests-kmod-test-disabling-module-autoloading.patch

5 years, 7 months

1
0
0 0

[merged] x86-mm-split-vmalloc_sync_all.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: x86/mm: split vmalloc_sync_all() has been removed from the -mm tree. Its filename was x86-mm-split-vmalloc_sync_all.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Joerg Roedel <jroedel(a)suse.de> Subject: x86/mm: split vmalloc_sync_all() Commit 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()") introduced a call to vmalloc_sync_all() in the vunmap() code-path. While this change was necessary to maintain correctness on x86-32-pae kernels, it also adds additional cycles for architectures that don't need it. Specifically on x86-64 with CONFIG_VMAP_STACK=y some people reported severe performance regressions in micro-benchmarks because it now also calls the x86-64 implementation of vmalloc_sync_all() on vunmap(). But the vmalloc_sync_all() implementation on x86-64 is only needed for newly created mappings. To avoid the unnecessary work on x86-64 and to gain the performance back, split up vmalloc_sync_all() into two functions: * vmalloc_sync_mappings(), and * vmalloc_sync_unmappings() Most call-sites to vmalloc_sync_all() only care about new mappings being synchronized. The only exception is the new call-site added in the above mentioned commit. Shile Zhang directed us to a report of an 80% regression in reaim throughput. Link: http://lkml.kernel.org/r/20191009124418.8286-1-joro@8bytes.org Link: https://lists.01.org/hyperkitty/list/lkp@lists.01.org/thread/4D3JPPHBNOSPFK… Link: http://lkml.kernel.org/r/20191113095530.228959-1-shile.zhang@linux.alibaba.… Fixes: 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()") Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Reported-by: kernel test robot <oliver.sang(a)intel.com> Reported-by: Shile Zhang <shile.zhang(a)linux.alibaba.com> Acked-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> [GHES] Tested-by: Borislav Petkov <bp(a)suse.de> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/x86/mm/fault.c | 26 ++++++++++++++++++++++++-- drivers/acpi/apei/ghes.c | 2 +- include/linux/vmalloc.h | 5 +++-- kernel/notifier.c | 2 +- mm/nommu.c | 10 +++++++--- mm/vmalloc.c | 11 +++++++---- 6 files changed, 43 insertions(+), 13 deletions(-) --- a/arch/x86/mm/fault.c~x86-mm-split-vmalloc_sync_all +++ a/arch/x86/mm/fault.c @@ -190,7 +190,7 @@ static inline pmd_t *vmalloc_sync_one(pg return pmd_k; } -void vmalloc_sync_all(void) +static void vmalloc_sync(void) { unsigned long address; @@ -217,6 +217,16 @@ void vmalloc_sync_all(void) } } +void vmalloc_sync_mappings(void) +{ + vmalloc_sync(); +} + +void vmalloc_sync_unmappings(void) +{ + vmalloc_sync(); +} + /* * 32-bit: * @@ -319,11 +329,23 @@ out: #else /* CONFIG_X86_64: */ -void vmalloc_sync_all(void) +void vmalloc_sync_mappings(void) { + /* + * 64-bit mappings might allocate new p4d/pud pages + * that need to be propagated to all tasks' PGDs. + */ sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END); } +void vmalloc_sync_unmappings(void) +{ + /* + * Unmappings never allocate or free p4d/pud pages. + * No work is required here. + */ +} + /* * 64-bit: * --- a/drivers/acpi/apei/ghes.c~x86-mm-split-vmalloc_sync_all +++ a/drivers/acpi/apei/ghes.c @@ -171,7 +171,7 @@ int ghes_estatus_pool_init(int num_ghes) * New allocation must be visible in all pgd before it can be found by * an NMI allocating from the pool. */ - vmalloc_sync_all(); + vmalloc_sync_mappings(); rc = gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); if (rc) --- a/include/linux/vmalloc.h~x86-mm-split-vmalloc_sync_all +++ a/include/linux/vmalloc.h @@ -141,8 +141,9 @@ extern int remap_vmalloc_range_partial(s extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, unsigned long pgoff); -void vmalloc_sync_all(void); - +void vmalloc_sync_mappings(void); +void vmalloc_sync_unmappings(void); + /* * Lowlevel-APIs (not for driver use!) */ --- a/kernel/notifier.c~x86-mm-split-vmalloc_sync_all +++ a/kernel/notifier.c @@ -519,7 +519,7 @@ NOKPROBE_SYMBOL(notify_die); int register_die_notifier(struct notifier_block *nb) { - vmalloc_sync_all(); + vmalloc_sync_mappings(); return atomic_notifier_chain_register(&die_chain, nb); } EXPORT_SYMBOL_GPL(register_die_notifier); --- a/mm/nommu.c~x86-mm-split-vmalloc_sync_all +++ a/mm/nommu.c @@ -370,10 +370,14 @@ void vm_unmap_aliases(void) EXPORT_SYMBOL_GPL(vm_unmap_aliases); /* - * Implement a stub for vmalloc_sync_all() if the architecture chose not to - * have one. + * Implement a stub for vmalloc_sync_[un]mapping() if the architecture + * chose not to have one. */ -void __weak vmalloc_sync_all(void) +void __weak vmalloc_sync_mappings(void) +{ +} + +void __weak vmalloc_sync_unmappings(void) { } --- a/mm/vmalloc.c~x86-mm-split-vmalloc_sync_all +++ a/mm/vmalloc.c @@ -1295,7 +1295,7 @@ static bool __purge_vmap_area_lazy(unsig * First make sure the mappings are removed from all page-tables * before they are freed. */ - vmalloc_sync_all(); + vmalloc_sync_unmappings(); /* * TODO: to calculate a flush range without looping. @@ -3128,16 +3128,19 @@ int remap_vmalloc_range(struct vm_area_s EXPORT_SYMBOL(remap_vmalloc_range); /* - * Implement a stub for vmalloc_sync_all() if the architecture chose not to - * have one. + * Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose + * not to have one. * * The purpose of this function is to make sure the vmalloc area * mappings are identical in all page-tables in the system. */ -void __weak vmalloc_sync_all(void) +void __weak vmalloc_sync_mappings(void) { } +void __weak vmalloc_sync_unmappings(void) +{ +} static int f(pte_t *pte, unsigned long addr, void *data) { _ Patches currently in -mm which might be from jroedel(a)suse.de are

5 years, 7 months

1
0
0 0

[merged] mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, slub: prevent kmalloc_node crashes and memory leaks has been removed from the -mm tree. Its filename was mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Vlastimil Babka <vbabka(a)suse.cz> Subject: mm, slub: prevent kmalloc_node crashes and memory leaks Sachin reports [1] a crash in SLUB __slab_alloc(): BUG: Kernel NULL pointer dereference on read at 0x000073b0 Faulting instruction address: 0xc0000000003d55f4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1 NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000 REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000 CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1 GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500 GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620 GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000 GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000 GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002 GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122 GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8 GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180 NIP [c0000000003d55f4] ___slab_alloc+0x1f4/0x760 LR [c0000000003d5b94] __slab_alloc+0x34/0x60 Call Trace: [c0000008b3783960] [c0000000003d5734] ___slab_alloc+0x334/0x760 (unreliable) [c0000008b3783a40] [c0000000003d5b94] __slab_alloc+0x34/0x60 [c0000008b3783a70] [c0000000003d6fa0] __kmalloc_node+0x110/0x490 [c0000008b3783af0] [c0000000003443d8] kvmalloc_node+0x58/0x110 [c0000008b3783b30] [c0000000003fee38] mem_cgroup_css_online+0x108/0x270 [c0000008b3783b90] [c000000000235aa8] online_css+0x48/0xd0 [c0000008b3783bc0] [c00000000023eaec] cgroup_apply_control_enable+0x2ec/0x4d0 [c0000008b3783ca0] [c000000000242318] cgroup_mkdir+0x228/0x5f0 [c0000008b3783d10] [c00000000051e170] kernfs_iop_mkdir+0x90/0xf0 [c0000008b3783d50] [c00000000043dc00] vfs_mkdir+0x110/0x230 [c0000008b3783da0] [c000000000441c90] do_mkdirat+0xb0/0x1a0 [c0000008b3783e20] [c00000000000b278] system_call+0x5c/0x68 This is a PowerPC platform with following NUMA topology: available: 2 nodes (0-1) node 0 cpus: node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 node 1 size: 35247 MB node 1 free: 30907 MB node distances: node 0 1 0: 10 40 1: 40 10 possible numa nodes: 0-31 This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on appropriate NUMA node" [2] which effectively calls kmalloc_node for each possible node. SLUB however only allocates kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node for other nodes since commit a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node"). This is however not true in this configuration where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up accessing non-allocated kmem_cache_node. A related issue was reported by Bharata (originally by Ramachandran) [3] where a similar PowerPC configuration, but with mainline kernel without patch [2] ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems to have the same underlying issue with node_to_mem_node() not behaving as expected, and might probably also lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4]. This patch should fix both issues by not relying on node_to_mem_node() anymore and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is attempted for a node that's not online, or has no usable memory. The "usable memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly the condition that SLUB uses to allocate kmem_cache_node structures. The check in get_partial() is removed completely, as the checks in ___slab_alloc() are now sufficient to prevent get_partial() being reached with an invalid node. [1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@lin… [2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtu… [3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/ [4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.… Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node") Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy(a)in.ibm.com> Tested-by: Bharata B Rao <bharata(a)linux.ibm.com> Debugged-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Christopher Lameter <cl(a)linux.com> Cc: linuxppc-dev(a)lists.ozlabs.org Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Nathan Lynch <nathanl(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/slub.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) --- a/mm/slub.c~mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks +++ a/mm/slub.c @@ -1973,8 +1973,6 @@ static void *get_partial(struct kmem_cac if (node == NUMA_NO_NODE) searchnode = numa_mem_id(); - else if (!node_present_pages(node)) - searchnode = node_to_mem_node(node); object = get_partial_node(s, get_node(s, searchnode), c, flags); if (object || node != NUMA_NO_NODE) @@ -2563,17 +2561,27 @@ static void *___slab_alloc(struct kmem_c struct page *page; page = c->page; - if (!page) + if (!page) { + /* + * if the node is not online or has no normal memory, just + * ignore the node constraint + */ + if (unlikely(node != NUMA_NO_NODE && + !node_state(node, N_NORMAL_MEMORY))) + node = NUMA_NO_NODE; goto new_slab; + } redo: if (unlikely(!node_match(page, node))) { - int searchnode = node; - - if (node != NUMA_NO_NODE && !node_present_pages(node)) - searchnode = node_to_mem_node(node); - - if (unlikely(!node_match(page, searchnode))) { + /* + * same as above but node_match() being false already + * implies node != NUMA_NO_NODE + */ + if (!node_state(node, N_NORMAL_MEMORY)) { + node = NUMA_NO_NODE; + goto redo; + } else { stat(s, ALLOC_NODE_MISMATCH); deactivate_slab(s, page, c->freelist, c); goto new_slab; _ Patches currently in -mm which might be from vbabka(a)suse.cz are revert-topology-add-support-for-node_to_mem_node-to-determine-the-fallback-node.patch mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch mm-hugetlb-remove-unnecessary-memory-fetch-in-pageheadhuge.patch

5 years, 7 months

1
0
0 0

[merged] epoll-fix-possible-lost-wakeup-on-epoll_ctl-path.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: epoll: fix possible lost wakeup on epoll_ctl() path has been removed from the -mm tree. Its filename was epoll-fix-possible-lost-wakeup-on-epoll_ctl-path.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Roman Penyaev <rpenyaev(a)suse.de> Subject: epoll: fix possible lost wakeup on epoll_ctl() path This fixes possible lost wakeup introduced by commit a218cc491420. Originally modifications to ep->wq were serialized by ep->wq.lock, but in the a218cc491420 new rw lock was introduced in order to relax fd event path, i.e. callers of ep_poll_callback() function. After the change ep_modify and ep_insert (both are called on epoll_ctl() path) were switched to ep->lock, but ep_poll (epoll_wait) was using ep->wq.lock on wqueue list modification. The bug doesn't lead to any wqueue list corruptions, because wake up path and list modifications were serialized by ep->wq.lock internally, but actual waitqueue_active() check prior wake_up() call can be reordered with modifications of ep ready list, thus wake up can be lost. And yes, can be healed by explicit smp_mb(): list_add_tail(&epi->rdlink, &ep->rdllist); smp_mb(); if (waitqueue_active(&ep->wq)) wake_up(&ep->wp); But let's make it simple, thus current patch replaces ep->wq.lock with the ep->lock for wqueue modifications, thus wake up path always observes activeness of the wqueue correcty. Link: http://lkml.kernel.org/r/20200214170211.561524-1-rpenyaev@suse.de Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") References: https://bugzilla.kernel.org/show_bug.cgi?id=205933 Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de> Reported-by: Max Neunhoeffer <max(a)arangodb.com> Bisected-by: Max Neunhoeffer <max(a)arangodb.com> Tested-by: Max Neunhoeffer <max(a)arangodb.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Christopher Kohlhoff <chris.kohlhoff(a)clearpool.io> Cc: Davidlohr Bueso <dbueso(a)suse.de> Cc: Jason Baron <jbaron(a)akamai.com> Cc: Jes Sorensen <jes.sorensen(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.1+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/eventpoll.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/fs/eventpoll.c~epoll-fix-possible-lost-wakeup-on-epoll_ctl-path +++ a/fs/eventpoll.c @@ -1854,9 +1854,9 @@ fetch_events: waiter = true; init_waitqueue_entry(&wait, current); - spin_lock_irq(&ep->wq.lock); + write_lock_irq(&ep->lock); __add_wait_queue_exclusive(&ep->wq, &wait); - spin_unlock_irq(&ep->wq.lock); + write_unlock_irq(&ep->lock); } for (;;) { @@ -1904,9 +1904,9 @@ send_events: goto fetch_events; if (waiter) { - spin_lock_irq(&ep->wq.lock); + write_lock_irq(&ep->lock); __remove_wait_queue(&ep->wq, &wait); - spin_unlock_irq(&ep->wq.lock); + write_unlock_irq(&ep->lock); } return res; _ Patches currently in -mm which might be from rpenyaev(a)suse.de are kselftest-introduce-new-epoll-test-case.patch

5 years, 7 months

1
0
0 0

[merged] mm-do-not-allow-madv_pageout-for-cow-pages.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm: do not allow MADV_PAGEOUT for CoW pages has been removed from the -mm tree. Its filename was mm-do-not-allow-madv_pageout-for-cow-pages.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Michal Hocko <mhocko(a)suse.com> Subject: mm: do not allow MADV_PAGEOUT for CoW pages Jann has brought up a very interesting point [1]. While shared pages are excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed that way. This can lead to all sorts of hard to debug problems. E.g. performance problems outlined by Daniel [2]. There are runtime environments where there is a substantial memory shared among security domains via CoW memory and a easy to reclaim way of that memory, which MADV_{COLD,PAGEOUT} offers, can lead to either performance degradation in for the parent process which might be more privileged or even open side channel attacks. The feasibility of the latter is not really clear to me TBH but there is no real reason for exposure at this stage. It seems there is no real use case to depend on reclaiming CoW memory via madvise at this stage so it is much easier to simply disallow it and this is what this patch does. Put it simply MADV_{PAGEOUT,COLD} can operate only on the exclusively owned memory which is a straightforward semantic. [1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKu… [2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zR… Link: http://lkml.kernel.org/r/20200312082248.GS23944@dhcp22.suse.cz Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD") Signed-off-by: Michal Hocko <mhocko(a)suse.com> Reported-by: Jann Horn <jannh(a)google.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Daniel Colascione <dancol(a)google.com> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: "Joel Fernandes (Google)" <joel(a)joelfernandes.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/madvise.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/mm/madvise.c~mm-do-not-allow-madv_pageout-for-cow-pages +++ a/mm/madvise.c @@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_r } page = pmd_page(orig_pmd); + + /* Do not interfere with other mappings of this page */ + if (page_mapcount(page) != 1) + goto huge_unlock; + if (next - addr != HPAGE_PMD_SIZE) { int err; - if (page_mapcount(page) != 1) - goto huge_unlock; - get_page(page); spin_unlock(ptl); lock_page(page); @@ -426,6 +428,10 @@ regular_page: continue; } + /* Do not interfere with other mappings of this page */ + if (page_mapcount(page) != 1) + continue; + VM_BUG_ON_PAGE(PageTransCompound(page), page); if (pte_young(ptent)) { _ Patches currently in -mm which might be from mhocko(a)suse.com are selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests.patch

5 years, 7 months

1
0
0 0

[merged] mm-memcg-throttle-allocators-based-on-ancestral-memoryhigh.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, memcg: throttle allocators based on ancestral memory.high has been removed from the -mm tree. Its filename was mm-memcg-throttle-allocators-based-on-ancestral-memoryhigh.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Chris Down <chris(a)chrisdown.name> Subject: mm, memcg: throttle allocators based on ancestral memory.high Prior to this commit, we only directly check the affected cgroup's memory.high against its usage. However, it's possible that we are being reclaimed as a result of hitting an ancestor memory.high and should be penalised based on that, instead. This patch changes memory.high overage throttling to use the largest overage in its ancestors when considering how many penalty jiffies to charge. This makes sure that we penalise poorly behaving cgroups in the same way regardless of at what level of the hierarchy memory.high was breached. Link: http://lkml.kernel.org/r/8cd132f84bd7e16cdb8fde3378cdbf05ba00d387.158403614… Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high") Signed-off-by: Chris Down <chris(a)chrisdown.name> Reported-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Tejun Heo <tj(a)kernel.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Nathan Chancellor <natechancellor(a)gmail.com> Cc: Roman Gushchin <guro(a)fb.com> Cc: <stable(a)vger.kernel.org> [5.4.x+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol.c | 93 ++++++++++++++++++++++++++++------------------ 1 file changed, 58 insertions(+), 35 deletions(-) --- a/mm/memcontrol.c~mm-memcg-throttle-allocators-based-on-ancestral-memoryhigh +++ a/mm/memcontrol.c @@ -2297,28 +2297,41 @@ static void high_work_func(struct work_s #define MEMCG_DELAY_SCALING_SHIFT 14 /* - * Scheduled by try_charge() to be executed from the userland return path - * and reclaims memory over the high limit. + * Get the number of jiffies that we should penalise a mischievous cgroup which + * is exceeding its memory.high by checking both it and its ancestors. */ -void mem_cgroup_handle_over_high(void) +static unsigned long calculate_high_delay(struct mem_cgroup *memcg, + unsigned int nr_pages) { - unsigned long usage, high, clamped_high; - unsigned long pflags; - unsigned long penalty_jiffies, overage; - unsigned int nr_pages = current->memcg_nr_pages_over_high; - struct mem_cgroup *memcg; + unsigned long penalty_jiffies; + u64 max_overage = 0; - if (likely(!nr_pages)) - return; + do { + unsigned long usage, high; + u64 overage; + + usage = page_counter_read(&memcg->memory); + high = READ_ONCE(memcg->high); + + /* + * Prevent division by 0 in overage calculation by acting as if + * it was a threshold of 1 page + */ + high = max(high, 1UL); + + overage = usage - high; + overage <<= MEMCG_DELAY_PRECISION_SHIFT; + overage = div64_u64(overage, high); + + if (overage > max_overage) + max_overage = overage; + } while ((memcg = parent_mem_cgroup(memcg)) && + !mem_cgroup_is_root(memcg)); - memcg = get_mem_cgroup_from_mm(current->mm); - reclaim_high(memcg, nr_pages, GFP_KERNEL); - current->memcg_nr_pages_over_high = 0; + if (!max_overage) + return 0; /* - * memory.high is breached and reclaim is unable to keep up. Throttle - * allocators proactively to slow down excessive growth. - * * We use overage compared to memory.high to calculate the number of * jiffies to sleep (penalty_jiffies). Ideally this value should be * fairly lenient on small overages, and increasingly harsh when the @@ -2326,24 +2339,9 @@ void mem_cgroup_handle_over_high(void) * its crazy behaviour, so we exponentially increase the delay based on * overage amount. */ - - usage = page_counter_read(&memcg->memory); - high = READ_ONCE(memcg->high); - - if (usage <= high) - goto out; - - /* - * Prevent division by 0 in overage calculation by acting as if it was a - * threshold of 1 page - */ - clamped_high = max(high, 1UL); - - overage = div64_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT, - clamped_high); - - penalty_jiffies = ((u64)overage * overage * HZ) - >> (MEMCG_DELAY_PRECISION_SHIFT + MEMCG_DELAY_SCALING_SHIFT); + penalty_jiffies = max_overage * max_overage * HZ; + penalty_jiffies >>= MEMCG_DELAY_PRECISION_SHIFT; + penalty_jiffies >>= MEMCG_DELAY_SCALING_SHIFT; /* * Factor in the task's own contribution to the overage, such that four @@ -2360,7 +2358,32 @@ void mem_cgroup_handle_over_high(void) * application moving forwards and also permit diagnostics, albeit * extremely slowly. */ - penalty_jiffies = min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES); + return min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES); +} + +/* + * Scheduled by try_charge() to be executed from the userland return path + * and reclaims memory over the high limit. + */ +void mem_cgroup_handle_over_high(void) +{ + unsigned long penalty_jiffies; + unsigned long pflags; + unsigned int nr_pages = current->memcg_nr_pages_over_high; + struct mem_cgroup *memcg; + + if (likely(!nr_pages)) + return; + + memcg = get_mem_cgroup_from_mm(current->mm); + reclaim_high(memcg, nr_pages, GFP_KERNEL); + current->memcg_nr_pages_over_high = 0; + + /* + * memory.high is breached and reclaim is unable to keep up. Throttle + * allocators proactively to slow down excessive growth. + */ + penalty_jiffies = calculate_high_delay(memcg, nr_pages); /* * Don't sleep if the amount of jiffies this memcg owes us is so low _ Patches currently in -mm which might be from chris(a)chrisdown.name are mm-memcg-prevent-memoryhigh-load-store-tearing.patch mm-memcg-prevent-memorymax-load-tearing.patch mm-memcg-prevent-memorylow-load-store-tearing.patch mm-memcg-prevent-memorymin-load-store-tearing.patch mm-memcg-prevent-memoryswapmax-load-tearing.patch mm-memcg-prevent-mem_cgroup_protected-store-tearing.patch mm-memcg-bypass-high-reclaim-iteration-for-cgroup-hierarchy-root.patch

5 years, 7 months

1
0
0 0

[merged] mm-memcg-fix-corruption-on-64-bit-divisor-in-memoryhigh-throttling.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, memcg: fix corruption on 64-bit divisor in memory.high throttling has been removed from the -mm tree. Its filename was mm-memcg-fix-corruption-on-64-bit-divisor-in-memoryhigh-throttling.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Chris Down <chris(a)chrisdown.name> Subject: mm, memcg: fix corruption on 64-bit divisor in memory.high throttling 0e4b01df8659 had a bunch of fixups to use the right division method. However, it seems that after all that it still wasn't right -- div_u64 takes a 32-bit divisor. The headroom is still large (2^32 pages), so on mundane systems you won't hit this, but this should definitely be fixed. Link: http://lkml.kernel.org/r/80780887060514967d414b3cd91f9a316a16ab98.158403614… Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high") Signed-off-by: Chris Down <chris(a)chrisdown.name> Reported-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Tejun Heo <tj(a)kernel.org> Cc: Roman Gushchin <guro(a)fb.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Nathan Chancellor <natechancellor(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.4.x+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/memcontrol.c~mm-memcg-fix-corruption-on-64-bit-divisor-in-memoryhigh-throttling +++ a/mm/memcontrol.c @@ -2339,7 +2339,7 @@ void mem_cgroup_handle_over_high(void) */ clamped_high = max(high, 1UL); - overage = div_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT, + overage = div64_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT, clamped_high); penalty_jiffies = ((u64)overage * overage * HZ) _ Patches currently in -mm which might be from chris(a)chrisdown.name are mm-memcg-prevent-memoryhigh-load-store-tearing.patch mm-memcg-prevent-memorymax-load-tearing.patch mm-memcg-prevent-memorylow-load-store-tearing.patch mm-memcg-prevent-memorymin-load-store-tearing.patch mm-memcg-prevent-memoryswapmax-load-tearing.patch mm-memcg-prevent-mem_cgroup_protected-store-tearing.patch mm-memcg-bypass-high-reclaim-iteration-for-cgroup-hierarchy-root.patch

5 years, 7 months

1
0
0 0

[merged] page-flags-fix-a-crash-at-setpageerrorthp_swap.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: page-flags: fix a crash at SetPageError(THP_SWAP) has been removed from the -mm tree. Its filename was page-flags-fix-a-crash-at-setpageerrorthp_swap.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Qian Cai <cai(a)lca.pw> Subject: page-flags: fix a crash at SetPageError(THP_SWAP) The commit bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out") supported writing THP to a swap device but forgot to upgrade an older commit df8c94d13c7e ("page-flags: define behavior of FS/IO-related flags on compound pages") which could trigger a crash during THP swapping out with DEBUG_VM_PGFLAGS=y, kernel BUG at include/linux/page-flags.h:317! page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page)) page:fffff3b2ec3a8000 refcount:512 mapcount:0 mapping:000000009eb0338c index:0x7f6e58200 head:fffff3b2ec3a8000 order:9 compound_mapcount:0 compound_pincount:0 anon flags: 0x45fffe0000d8454(uptodate|lru|workingset|owner_priv_1|writeback|head|reclaim|swapbacked) end_swap_bio_write() SetPageError(page) VM_BUG_ON_PAGE(1 && PageCompound(page)) <IRQ> bio_endio+0x297/0x560 dec_pending+0x218/0x430 [dm_mod] clone_endio+0xe4/0x2c0 [dm_mod] bio_endio+0x297/0x560 blk_update_request+0x201/0x920 scsi_end_request+0x6b/0x4b0 scsi_io_completion+0x509/0x7e0 scsi_finish_command+0x1ed/0x2a0 scsi_softirq_done+0x1c9/0x1d0 __blk_mqnterrupt+0xf/0x20 </IRQ> Fix by checking PF_NO_TAIL in those places instead. Link: http://lkml.kernel.org/r/20200310235846.1319-1-cai@lca.pw Fixes: bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out") Signed-off-by: Qian Cai <cai(a)lca.pw> Acked-by: "Huang, Ying" <ying.huang(a)intel.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Acked-by: Rafael Aquini <aquini(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/page-flags.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/page-flags.h~page-flags-fix-a-crash-at-setpageerrorthp_swap +++ a/include/linux/page-flags.h @@ -311,7 +311,7 @@ static inline int TestClearPage##uname(s __PAGEFLAG(Locked, locked, PF_NO_TAIL) PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) -PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND) +PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL) PAGEFLAG(Referenced, referenced, PF_HEAD) TESTCLEARFLAG(Referenced, referenced, PF_HEAD) __SETPAGEFLAG(Referenced, referenced, PF_HEAD) _ Patches currently in -mm which might be from cai(a)lca.pw are mm-disable-kcsan-for-kmemleak.patch mm-swapfile-fix-data-races-in-try_to_unuse.patch kasan-detect-negative-size-in-memory-operation-function-fix.patch mm-vmscan-fix-data-races-at-kswapd_classzone_idx.patch percpu_counter-fix-a-data-race-at-vm_committed_as.patch mm-kmemleak-silence-kcsan-splats-in-checksum.patch mm-frontswap-mark-various-intentional-data-races.patch mm-page_io-mark-various-intentional-data-races.patch mm-page_io-mark-various-intentional-data-races-v2.patch mm-swap_state-mark-various-intentional-data-races.patch mm-swapfile-fix-and-annotate-various-data-races.patch mm-swapfile-fix-and-annotate-various-data-races-v2.patch mm-page_counter-fix-various-data-races-at-memsw.patch mm-memcontrol-fix-a-data-race-in-scan-count.patch mm-list_lru-fix-a-data-race-in-list_lru_count_one.patch mm-mempool-fix-a-data-race-in-mempool_free.patch mm-util-annotate-an-data-race-at-vm_committed_as.patch mm-rmap-annotate-a-data-race-at-tlb_flush_batched.patch mm-annotate-a-data-race-in-page_zonenum.patch mm-swap-annotate-data-races-for-lru_rotate_pvecs.patch

5 years, 7 months

1
0
0 0

[merged] mm-hotplug-fix-hot-remove-failure-in-sparsememvmemmap-case.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case has been removed from the -mm tree. Its filename was mm-hotplug-fix-hot-remove-failure-in-sparsememvmemmap-case.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Baoquan He <bhe(a)redhat.com> Subject: mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case In section_deactivate(), pfn_to_page() doesn't work any more after ms->section_mem_map is resetting to NULL in SPARSEMEM|!VMEMMAP case. It caused hot remove failure: kernel BUG at mm/page_alloc.c:4806! invalid opcode: 0000 [#1] SMP PTI CPU: 3 PID: 8 Comm: kworker/u16:0 Tainted: G W 5.5.0-next-20200205+ #340 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:free_pages+0x85/0xa0 Call Trace: __remove_pages+0x99/0xc0 arch_remove_memory+0x23/0x4d try_remove_memory+0xc8/0x130 ? walk_memory_blocks+0x72/0xa0 __remove_memory+0xa/0x11 acpi_memory_device_remove+0x72/0x100 acpi_bus_trim+0x55/0x90 acpi_device_hotplug+0x2eb/0x3d0 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x1a7/0x370 worker_thread+0x30/0x380 ? flush_rcu_work+0x30/0x30 kthread+0x112/0x130 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x35/0x40 Let's move the ->section_mem_map resetting after depopulate_section_memmap() to fix it. [akpm(a)linux-foundation.org: remove unneeded initialization, per David] Link: http://lkml.kernel.org/r/20200307084229.28251-2-bhe@redhat.com Fixes: ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug") Signed-off-by: Baoquan He <bhe(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/mm/sparse.c~mm-hotplug-fix-hot-remove-failure-in-sparsememvmemmap-case +++ a/mm/sparse.c @@ -734,6 +734,7 @@ static void section_deactivate(unsigned struct mem_section *ms = __pfn_to_section(pfn); bool section_is_early = early_section(ms); struct page *memmap = NULL; + bool empty; unsigned long *subsection_map = ms->usage ? &ms->usage->subsection_map[0] : NULL; @@ -764,7 +765,8 @@ static void section_deactivate(unsigned * For 2/ and 3/ the SPARSEMEM_VMEMMAP={y,n} cases are unified */ bitmap_xor(subsection_map, map, subsection_map, SUBSECTIONS_PER_SECTION); - if (bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION)) { + empty = bitmap_empty(subsection_map, SUBSECTIONS_PER_SECTION); + if (empty) { unsigned long section_nr = pfn_to_section_nr(pfn); /* @@ -779,13 +781,15 @@ static void section_deactivate(unsigned ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - ms->section_mem_map = (unsigned long)NULL; } if (section_is_early && memmap) free_map_bootmem(memmap); else depopulate_section_memmap(pfn, nr_pages, altmap); + + if (empty) + ms->section_mem_map = (unsigned long)NULL; } static struct page * __meminit section_activate(int nid, unsigned long pfn, _ Patches currently in -mm which might be from bhe(a)redhat.com are mm-sparsec-use-kvmalloc-kvfree-to-alloc-free-memmap-for-the-classic-sparse.patch mm-sparsec-allocate-memmap-preferring-the-given-node.patch mm-hotplug-only-respect-mem=-parameter-during-boot-stage.patch mm-sparsec-introduce-new-function-fill_subsection_map.patch mm-sparsec-introduce-a-new-function-clear_subsection_map.patch mm-sparsec-only-use-subsection-map-in-vmemmap-case.patch mm-sparsec-add-note-about-only-vmemmap-supporting-sub-section-hotplug.patch mm-sparsec-move-subsection_map-related-functions-together.patch mm-sparsec-move-subsection_map-related-functions-together-fix.patch

5 years, 7 months

1
0
0 0

[merged] memcg-fix-null-pointer-dereference-in-__mem_cgroup_usage_unregister_event.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event has been removed from the -mm tree. Its filename was memcg-fix-null-pointer-dereference-in-__mem_cgroup_usage_unregister_event.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Chunguang Xu <brookxu(a)tencent.com> Subject: memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event An eventfd monitors multiple memory thresholds of the cgroup, closes them, the kernel deletes all events related to this eventfd. Before all events are deleted, another eventfd monitors the memory threshold of this cgroup, leading to a crash: [135.675108] BUG: kernel NULL pointer dereference, address: 0000000000000004 [135.675350] #PF: supervisor write access in kernel mode [135.675579] #PF: error_code(0x0002) - not-present page [135.675816] PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0 [135.676080] Oops: 0002 [#1] SMP PTI [135.676332] CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3 [135.676610] Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014 [135.676909] Workqueue: events memcg_event_remove [135.677192] RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190 [135.677825] RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202 [135.678186] RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001 [135.678548] RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001 [135.678912] RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010 [135.679287] R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880 [135.679670] R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000 [135.680066] FS: 0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000 [135.680475] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [135.680894] CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0 [135.681325] Call Trace: [135.681763]� memcg_event_remove+0x32/0x90 [135.682209]� process_one_work+0x172/0x380 [135.682657]� worker_thread+0x49/0x3f0 [135.683111]� kthread+0xf8/0x130 [135.683570]� ? max_active_store+0x80/0x80 [135.684034]� ? kthread_bind+0x10/0x10 [135.684506]� ret_from_fork+0x35/0x40 [135.689733] CR2: 0000000000000004 We can reproduce this problem in the following ways: 1. We create a new cgroup subdirectory and a new eventfd, and then we monitor multiple memory thresholds of the cgroup through this eventfd. 2. closing this eventfd, and __mem_cgroup_usage_unregister_event () will be called multiple times to delete all events related to this eventfd. The first time __mem_cgroup_usage_unregister_event() is called, the kernel will clear all items related to this eventfd in thresholds-> primary.Since there is currently only one eventfd, thresholds-> primary becomes empty, so the kernel will set thresholds-> primary and hresholds-> spare to NULL. If at this time, the user creates a new eventfd and monitor the memory threshold of this cgroup, kernel will re-initialize thresholds-> primary. Then when __mem_cgroup_usage_unregister_event () is called for the second time, because thresholds-> primary is not empty, the system will access thresholds-> spare, but thresholds-> spare is NULL, which will trigger a crash. In general, the longer it takes to delete all events related to this eventfd, the easier it is to trigger this problem. The solution is to check whether the thresholds associated with the eventfd has been cleared when deleting the event. If so, we do nothing. [akpm(a)linux-foundation.org: fix comment, per Kirill] Link: http://lkml.kernel.org/r/077a6f67-aefa-4591-efec-f2f3af2b0b02@gmail.com Fixes: 907860ed381a ("cgroups: make cftype.unregister_event() void-returning") Signed-off-by: Chunguang Xu <brookxu(a)tencent.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/mm/memcontrol.c~memcg-fix-null-pointer-dereference-in-__mem_cgroup_usage_unregister_event +++ a/mm/memcontrol.c @@ -4027,7 +4027,7 @@ static void __mem_cgroup_usage_unregiste struct mem_cgroup_thresholds *thresholds; struct mem_cgroup_threshold_ary *new; unsigned long usage; - int i, j, size; + int i, j, size, entries; mutex_lock(&memcg->thresholds_lock); @@ -4047,14 +4047,20 @@ static void __mem_cgroup_usage_unregiste __mem_cgroup_threshold(memcg, type == _MEMSWAP); /* Calculate new number of threshold */ - size = 0; + size = entries = 0; for (i = 0; i < thresholds->primary->size; i++) { if (thresholds->primary->entries[i].eventfd != eventfd) size++; + else + entries++; } new = thresholds->spare; + /* If no items related to eventfd have been cleared, nothing to do */ + if (!entries) + goto unlock; + /* Set thresholds array to NULL if we don't have thresholds */ if (!size) { kfree(new); _ Patches currently in -mm which might be from brookxu(a)tencent.com are

5 years, 7 months

1
0
0 0

[PATCH for-rc 2/2] IB/hfi1: Call kobject_put() when kobject_init_and_add() fails

by Dennis Dalessandro

From: Kaike Wan <kaike.wan(a)intel.com> When kobject_init_and_add() returns an error in the function hfi1_create_port_files(), the function kobject_put() is not called for the corresponding kobject, which potentially leads to memory leak. This patch fixes the issue by calling kobject_put() even if kobject_init_and_add() fails. Cc: <stable(a)vger.kernel.org> Reviewed-by: Mike Marciniszyn <mike.marciniszyn(a)intel.com> Signed-off-by: Kaike Wan <kaike.wan(a)intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)intel.com> --- drivers/infiniband/hw/hfi1/sysfs.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c index f1bcecf..074ec71 100644 --- a/drivers/infiniband/hw/hfi1/sysfs.c +++ b/drivers/infiniband/hw/hfi1/sysfs.c @@ -674,7 +674,11 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, dd_dev_err(dd, "Skipping sc2vl sysfs info, (err %d) port %u\n", ret, port_num); - goto bail; + /* + * Based on the documentation for kobject_init_and_add(), the + * caller should call kobject_put even if this call fails. + */ + goto bail_sc2vl; } kobject_uevent(&ppd->sc2vl_kobj, KOBJ_ADD); @@ -684,7 +688,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, dd_dev_err(dd, "Skipping sl2sc sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_sc2vl; + goto bail_sl2sc; } kobject_uevent(&ppd->sl2sc_kobj, KOBJ_ADD); @@ -694,7 +698,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, dd_dev_err(dd, "Skipping vl2mtu sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_sl2sc; + goto bail_vl2mtu; } kobject_uevent(&ppd->vl2mtu_kobj, KOBJ_ADD); @@ -704,7 +708,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, dd_dev_err(dd, "Skipping Congestion Control sysfs info, (err %d) port %u\n", ret, port_num); - goto bail_vl2mtu; + goto bail_cc; } kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); @@ -742,7 +746,6 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, kobject_put(&ppd->sl2sc_kobj); bail_sc2vl: kobject_put(&ppd->sc2vl_kobj); -bail: return ret; }

5 years, 7 months

1
1
0 0

[PATCH] drm/vboxvideo: Add missing remove_conflicting_pci_framebuffers call

by Hans de Goede

The vboxvideo driver is missing a call to remove conflicting framebuffers. Surprisingly, when using legacy BIOS booting this does not really cause any issues. But when using UEFI to boot the VM then plymouth will draw on both the efifb /dev/fb0 and /dev/drm/card0 (which has registered /dev/fb1 as fbdev emulation). VirtualBox will actual display the output of both devices (I guess it is showing whatever was drawn last), this causes weird artifacts because of pitch issues in the efifb when the VM window is not sized at 1024x768 (the window will resize to its last size once the vboxvideo driver loads, changing the pitch). Adding the missing drm_fb_helper_remove_conflicting_pci_framebuffers() call fixes this. Cc: stable(a)vger.kernel.org Fixes: 2695eae1f6d3 ("drm/vboxvideo: Switch to generic fbdev emulation") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/gpu/drm/vboxvideo/vbox_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vboxvideo/vbox_drv.c b/drivers/gpu/drm/vboxvideo/vbox_drv.c index 8512d970a09f..261255085918 100644 --- a/drivers/gpu/drm/vboxvideo/vbox_drv.c +++ b/drivers/gpu/drm/vboxvideo/vbox_drv.c @@ -76,6 +76,10 @@ static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (ret) goto err_mode_fini; + ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, "vboxvideodrmfb"); + if (ret) + goto err_irq_fini; + ret = drm_fbdev_generic_setup(&vbox->ddev, 32); if (ret) goto err_irq_fini; -- 2.26.0.rc2

5 years, 7 months

2
6
0 0

patch "amba: Initialize dma_parms for amba devices" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled amba: Initialize dma_parms for amba devices to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 5caf6102e32ead7ed5d21b5309c1a4a7d70e6a9f Mon Sep 17 00:00:00 2001 From: Ulf Hansson <ulf.hansson(a)linaro.org> Date: Wed, 25 Mar 2020 12:34:07 +0100 Subject: amba: Initialize dma_parms for amba devices It's currently the amba driver's responsibility to initialize the pointer, dma_parms, for its corresponding struct device. The benefit with this approach allows us to avoid the initialization and to not waste memory for the struct device_dma_parameters, as this can be decided on a case by case basis. However, it has turned out that this approach is not very practical. Not only does it lead to open coding, but also to real errors. In principle callers of dma_set_max_seg_size() doesn't check the error code, but just assumes it succeeds. For these reasons, let's do the initialization from the common amba bus at the device registration point. This also follows the way the PCI devices are being managed, see pci_device_add(). Cc: <stable(a)vger.kernel.org> Cc: Russell King <linux(a)armlinux.org.uk> Suggested-by: Christoph Hellwig <hch(a)lst.de> Tested-by: Ludovic Barre <ludovic.barre(a)st.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://lore.kernel.org/r/20200325113407.26996-3-ulf.hansson@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/amba/bus.c | 2 ++ include/linux/amba/bus.h | 1 + 2 files changed, 3 insertions(+) diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c index fe1523664816..5e61783ce92d 100644 --- a/drivers/amba/bus.c +++ b/drivers/amba/bus.c @@ -374,6 +374,8 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent) WARN_ON(dev->irq[0] == (unsigned int)-1); WARN_ON(dev->irq[1] == (unsigned int)-1); + dev->dev.dma_parms = &dev->dma_parms; + ret = request_resource(parent, &dev->res); if (ret) goto err_out; diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h index 26f0ecf401ea..0bbfd647f5c6 100644 --- a/include/linux/amba/bus.h +++ b/include/linux/amba/bus.h @@ -65,6 +65,7 @@ struct amba_device { struct device dev; struct resource res; struct clk *pclk; + struct device_dma_parameters dma_parms; unsigned int periphid; unsigned int cid; struct amba_cs_uci_id uci; -- 2.26.0

5 years, 7 months

1
0
0 0

patch "misc: rtsx: set correct pcr_ops for rts522A" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled misc: rtsx: set correct pcr_ops for rts522A to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 10cea23b6aae15e8324f4101d785687f2c514fe5 Mon Sep 17 00:00:00 2001 From: YueHaibing <yuehaibing(a)huawei.com> Date: Thu, 26 Mar 2020 11:26:18 +0800 Subject: misc: rtsx: set correct pcr_ops for rts522A rts522a should use rts522a_pcr_ops, which is diffrent with rts5227 in phy/hw init setting. Fixes: ce6a5acc9387 ("mfd: rtsx: Add support for rts522A") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200326032618.20472-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/cardreader/rts5227.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c index 423fecc19fc4..3a9467aaa435 100644 --- a/drivers/misc/cardreader/rts5227.c +++ b/drivers/misc/cardreader/rts5227.c @@ -394,6 +394,7 @@ static const struct pcr_ops rts522a_pcr_ops = { void rts522a_init_params(struct rtsx_pcr *pcr) { rts5227_init_params(pcr); + pcr->ops = &rts522a_pcr_ops; pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11); pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3; -- 2.26.0

5 years, 7 months

1
0
0 0

patch "staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback" added to staging-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 1165dd73e811a07d947aee218510571f516081f6 Mon Sep 17 00:00:00 2001 From: Qiujun Huang <hqjagain(a)gmail.com> Date: Thu, 26 Mar 2020 21:18:50 +0800 Subject: staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback We can't handle the case length > WLAN_DATA_MAXLEN. Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't read more than that. Thanks-to: Hillf Danton <hdanton(a)sina.com> Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a(a)syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c index e38acb58cd5e..fa1bf8b069fd 100644 --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3376,6 +3376,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev, WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { pr_debug("overlen frm: len=%zd\n", skblen - sizeof(struct p80211_caphdr)); + + return; } skb = dev_alloc_skb(skblen); -- 2.26.0

5 years, 7 months

1
0
0 0

patch "mei: me: add cedar fork device ids" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mei: me: add cedar fork device ids to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 99397d33b763dc554d118aaa38cc5abc6ce985de Mon Sep 17 00:00:00 2001 From: Alexander Usyskin <alexander.usyskin(a)intel.com> Date: Tue, 24 Mar 2020 23:07:30 +0200 Subject: mei: me: add cedar fork device ids Add Cedar Fork (CDF) device ids, those belongs to the cannon point family. Cc: <stable(a)vger.kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com> Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Link: https://lore.kernel.org/r/20200324210730.17672-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h index d2359aed79ae..9392934e3a06 100644 --- a/drivers/misc/mei/hw-me-regs.h +++ b/drivers/misc/mei/hw-me-regs.h @@ -87,6 +87,8 @@ #define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */ #define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */ +#define MEI_DEV_ID_CDF 0x18D3 /* Cedar Fork */ + #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */ #define MEI_DEV_ID_JSP_N 0x4DE0 /* Jasper Lake Point N */ diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c index ebdc2d6f8ddb..3d21c38e2dbb 100644 --- a/drivers/misc/mei/pci-me.c +++ b/drivers/misc/mei/pci-me.c @@ -102,6 +102,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_CDF, MEI_ME_PCH8_CFG)}, + /* required last entry */ {0, } }; -- 2.26.0

5 years, 7 months

1
0
0 0

patch "coresight: do not use the BIT() macro in the UAPI header" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled coresight: do not use the BIT() macro in the UAPI header to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 9b6eaaf3db5e5888df7bca7fed7752a90f7fd871 Mon Sep 17 00:00:00 2001 From: Eugene Syromiatnikov <esyr(a)redhat.com> Date: Tue, 24 Mar 2020 05:22:13 +0100 Subject: coresight: do not use the BIT() macro in the UAPI header The BIT() macro definition is not available for the UAPI headers (moreover, it can be defined differently in the user space); replace its usage with the _BITUL() macro that is defined in <linux/const.h>. Fixes: 237483aa5cf4 ("coresight: stm: adding driver for CoreSight STM component") Signed-off-by: Eugene Syromiatnikov <esyr(a)redhat.com> Cc: stable <stable(a)vger.kernel.org> Reviewed-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Link: https://lore.kernel.org/r/20200324042213.GA10452@asgard.redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/uapi/linux/coresight-stm.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/coresight-stm.h b/include/uapi/linux/coresight-stm.h index aac550a52f80..8847dbf24151 100644 --- a/include/uapi/linux/coresight-stm.h +++ b/include/uapi/linux/coresight-stm.h @@ -2,8 +2,10 @@ #ifndef __UAPI_CORESIGHT_STM_H_ #define __UAPI_CORESIGHT_STM_H_ -#define STM_FLAG_TIMESTAMPED BIT(3) -#define STM_FLAG_GUARANTEED BIT(7) +#include <linux/const.h> + +#define STM_FLAG_TIMESTAMPED _BITUL(3) +#define STM_FLAG_GUARANTEED _BITUL(7) /* * The CoreSight STM supports guaranteed and invariant timing -- 2.26.0

5 years, 7 months

1
0
0 0

patch "usb: gadget: f_fs: Fix use after free issue as part of queue failure" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: gadget: f_fs: Fix use after free issue as part of queue failure to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From f63ec55ff904b2f2e126884fcad93175f16ab4bb Mon Sep 17 00:00:00 2001 From: Sriharsha Allenki <sallenki(a)codeaurora.org> Date: Thu, 26 Mar 2020 17:26:20 +0530 Subject: usb: gadget: f_fs: Fix use after free issue as part of queue failure In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue. Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure. Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Signed-off-by: Sriharsha Allenki <sallenki(a)codeaurora.org> CC: stable <stable(a)vger.kernel.org> Reviewed-by: Peter Chen <peter.chen(a)nxp.com> Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 571917677d35..767f30b86645 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); if (unlikely(ret)) { + io_data->req = NULL; usb_ep_free_request(ep->ep, req); goto error_lock; } -- 2.26.0

5 years, 7 months

1
0
0 0

[PATCH 2/2] amba: Initialize dma_parms for amba devices

by Ulf Hansson

It's currently the amba driver's responsibility to initialize the pointer, dma_parms, for its corresponding struct device. The benefit with this approach allows us to avoid the initialization and to not waste memory for the struct device_dma_parameters, as this can be decided on a case by case basis. However, it has turned out that this approach is not very practical. Not only does it lead to open coding, but also to real errors. In principle callers of dma_set_max_seg_size() doesn't check the error code, but just assumes it succeeds. For these reasons, let's do the initialization from the common amba bus at the device registration point. This also follows the way the PCI devices are being managed, see pci_device_add(). Suggested-by: Christoph Hellwig <hch(a)lst.de> Cc: Russell King <linux(a)armlinux.org.uk> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> --- drivers/amba/bus.c | 2 ++ include/linux/amba/bus.h | 1 + 2 files changed, 3 insertions(+) diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c index fe1523664816..5e61783ce92d 100644 --- a/drivers/amba/bus.c +++ b/drivers/amba/bus.c @@ -374,6 +374,8 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent) WARN_ON(dev->irq[0] == (unsigned int)-1); WARN_ON(dev->irq[1] == (unsigned int)-1); + dev->dev.dma_parms = &dev->dma_parms; + ret = request_resource(parent, &dev->res); if (ret) goto err_out; diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h index 26f0ecf401ea..0bbfd647f5c6 100644 --- a/include/linux/amba/bus.h +++ b/include/linux/amba/bus.h @@ -65,6 +65,7 @@ struct amba_device { struct device dev; struct resource res; struct clk *pclk; + struct device_dma_parameters dma_parms; unsigned int periphid; unsigned int cid; struct amba_cs_uci_id uci; -- 2.20.1

5 years, 7 months

4
3
0 0

stable-rc/linux-5.4.y boot: 162 boots: 2 failed, 152 passed with 3 offline, 5 untried/unknown (v5.4.28)

by kernelci.org bot

stable-rc/linux-5.4.y boot: 162 boots: 2 failed, 152 passed with 3 offline, 5 untried/unknown (v5.4.28) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-5.4.y/kernel/v5.4.28/ Tree: stable-rc Branch: linux-5.4.y Git Describe: v5.4.28 Git Commit: 462afcd6e7ea94a7027a96a3bb12d0140b0b4216 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 100 unique boards, 26 SoC families, 21 builds out of 200 Boot Regressions Detected: arm: qcom_defconfig: gcc-8: qcom-apq8064-cm-qs600: lab-baylibre-seattle: failing since 46 days (last pass: v5.4.17-99-gbd0c6624a110 - first fail: v5.4.17-238-gbffcaa93483d) sama5_defconfig: gcc-8: at91-sama5d4_xplained: lab-baylibre: failing since 10 days (last pass: v5.4.25 - first fail: v5.4.25-58-gc72f49ecd87b) arm64: defconfig: gcc-8: meson-axg-s400: lab-baylibre-seattle: new failure (last pass: v5.4.25-278-g14bb11f6495f) meson-gxm-q200: lab-baylibre: new failure (last pass: v5.4.25-278-g14bb11f6495f) Boot Failures Detected: arm: sama5_defconfig: gcc-8: at91-sama5d4_xplained: 1 failed lab arm64: defconfig: gcc-8: meson-gxm-q200: 1 failed lab Offline Platforms: arm: qcom_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab multi_v7_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab arm64: defconfig: gcc-8 meson-axg-s400: 1 offline lab --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

[PATCH 5.5.12 0/5] mmc: Fix some busy detect problems

by Ulf Hansson

This series provides a couple of manually backported mmc changes that fixes some busy detect issues, for a couple of mmc host drivers (sdhci-tegra|omap). Ulf Hansson (5): mmc: core: Allow host controllers to require R1B for CMD6 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY drivers/mmc/core/core.c | 5 ++++- drivers/mmc/core/mmc.c | 7 +++++-- drivers/mmc/core/mmc_ops.c | 8 +++++--- drivers/mmc/host/sdhci-omap.c | 3 +++ drivers/mmc/host/sdhci-tegra.c | 3 +++ include/linux/mmc/host.h | 1 + 6 files changed, 21 insertions(+), 6 deletions(-) -- 2.20.1

5 years, 7 months

4
9
0 0

[PATCH stable 5.4] nvmet: fix dsm failure when payload does not match sgl descriptor

by Sagi Grimberg

commit b716e6889c95f64ba32af492461f6cc9341f3f05 upstream. The host is allowed to pass the controller an sgl describing a buffer that is larger than the dsm payload itself, allow it when executing dsm. Reported-by: Dakshaja Uppalapati <dakshaja(a)chelsio.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de>, Reviewed-by: Max Gurtovoy <maxg(a)mellanox.com> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Keith Busch <kbusch(a)kernel.org> --- drivers/nvme/target/core.c | 11 +++++++++++ drivers/nvme/target/io-cmd-bdev.c | 2 +- drivers/nvme/target/io-cmd-file.c | 2 +- drivers/nvme/target/nvmet.h | 1 + 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 35810a0a8d21..461987f669c5 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -939,6 +939,17 @@ bool nvmet_check_data_len(struct nvmet_req *req, size_t data_len) } EXPORT_SYMBOL_GPL(nvmet_check_data_len); +bool nvmet_check_data_len_lte(struct nvmet_req *req, size_t data_len) +{ + if (unlikely(data_len > req->transfer_len)) { + req->error_loc = offsetof(struct nvme_common_command, dptr); + nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR); + return false; + } + + return true; +} + int nvmet_req_alloc_sgl(struct nvmet_req *req) { struct pci_dev *p2p_dev = NULL; diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c index b6fca0e421ef..ea0e596be15d 100644 --- a/drivers/nvme/target/io-cmd-bdev.c +++ b/drivers/nvme/target/io-cmd-bdev.c @@ -280,7 +280,7 @@ static void nvmet_bdev_execute_discard(struct nvmet_req *req) static void nvmet_bdev_execute_dsm(struct nvmet_req *req) { - if (!nvmet_check_data_len(req, nvmet_dsm_len(req))) + if (!nvmet_check_data_len_lte(req, nvmet_dsm_len(req))) return; switch (le32_to_cpu(req->cmd->dsm.attributes)) { diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c index caebfce06605..cd5670b83118 100644 --- a/drivers/nvme/target/io-cmd-file.c +++ b/drivers/nvme/target/io-cmd-file.c @@ -336,7 +336,7 @@ static void nvmet_file_dsm_work(struct work_struct *w) static void nvmet_file_execute_dsm(struct nvmet_req *req) { - if (!nvmet_check_data_len(req, nvmet_dsm_len(req))) + if (!nvmet_check_data_len_lte(req, nvmet_dsm_len(req))) return; INIT_WORK(&req->f.work, nvmet_file_dsm_work); schedule_work(&req->f.work); diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h index 46df45e837c9..eda28b22a2c8 100644 --- a/drivers/nvme/target/nvmet.h +++ b/drivers/nvme/target/nvmet.h @@ -374,6 +374,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, struct nvmet_sq *sq, const struct nvmet_fabrics_ops *ops); void nvmet_req_uninit(struct nvmet_req *req); bool nvmet_check_data_len(struct nvmet_req *req, size_t data_len); +bool nvmet_check_data_len_lte(struct nvmet_req *req, size_t data_len); void nvmet_req_complete(struct nvmet_req *req, u16 status); int nvmet_req_alloc_sgl(struct nvmet_req *req); void nvmet_req_free_sgl(struct nvmet_req *req); -- 2.20.1

5 years, 7 months

2
1
0 0

patch "USB: serial: option: add Wistron Neweb D19Q1" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add Wistron Neweb D19Q1 to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From dfee7e2f478346b12ea651d5c28b069f6a4af563 Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:19 +0100 Subject: USB: serial: option: add Wistron Neweb D19Q1 This modem is embedded on dlink dwr-960 router. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1435 ProdID=d191 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 655a0e2f0ccf..e73d2bf81bab 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1990,6 +1990,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: io_edgeport: fix slab-out-of-bounds read in" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: io_edgeport: fix slab-out-of-bounds read in to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 57aa9f294b09463492f604feaa5cc719beaace32 Mon Sep 17 00:00:00 2001 From: Qiujun Huang <hqjagain(a)gmail.com> Date: Wed, 25 Mar 2020 15:52:37 +0800 Subject: USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Fix slab-out-of-bounds read in the interrupt-URB completion handler. The boundary condition should be (length - 1) as we access data[position + 1]. Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd(a)syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain(a)gmail.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index 5737add6a2a4..4cca0b836f43 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -710,7 +710,7 @@ static void edge_interrupt_callback(struct urb *urb) /* grab the txcredits for the ports if available */ position = 2; portNumber = 0; - while ((position < length) && + while ((position < length - 1) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1] << 8); if (txCredits) { -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: option: add BroadMobi BM806U" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add BroadMobi BM806U to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 6cb2669cb97fc4fdf526127159ac59caae052247 Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:18 +0100 Subject: USB: serial: option: add BroadMobi BM806U BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem. Tested hardware BM806U is mounted on D-Link DWR-921-C3 router. T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=2033 Rev= 2.28 S: Manufacturer=Mobile Connect S: Product=Mobile Connect S: SerialNumber=f842866cfd5a C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Co-developed-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index ec3078b0e8b8..655a0e2f0ccf 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1994,6 +1994,8 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ -- 2.26.0

5 years, 7 months

1
0
0 0

patch "USB: serial: option: add support for ASKEY WWHC050" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: serial: option: add support for ASKEY WWHC050 to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 007d20dca2376a751b1dad03442f118438b7e65e Mon Sep 17 00:00:00 2001 From: Pawel Dembicki <paweldembicki(a)gmail.com> Date: Wed, 25 Mar 2020 06:44:17 +0100 Subject: USB: serial: option: add support for ASKEY WWHC050 ASKEY WWHC050 is a mcie LTE modem. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution. Co-developed-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Cezary Jackiewicz <cezary(a)eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 084cc2fff3ae..ec3078b0e8b8 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1990,6 +1990,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ -- 2.26.0

5 years, 7 months

1
0
0 0

stable-rc/linux-4.19.y boot: 113 boots: 1 failed, 106 passed with 3 offline, 3 untried/unknown (v4.19.113)

by kernelci.org bot

stable-rc/linux-4.19.y boot: 113 boots: 1 failed, 106 passed with 3 offline, 3 untried/unknown (v4.19.113) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.19.y/kernel/v4.1… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.19.y/kernel/v4.19.113/ Tree: stable-rc Branch: linux-4.19.y Git Describe: v4.19.113 Git Commit: 54b4fa6d39551639cb10664f6ac78b01993a1d7e Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 74 unique boards, 21 SoC families, 20 builds out of 206 Boot Regressions Detected: arm: qcom_defconfig: gcc-8: qcom-apq8064-cm-qs600: lab-baylibre-seattle: failing since 46 days (last pass: v4.19.101 - first fail: v4.19.102-96-g0632821fe218) sama5_defconfig: gcc-8: at91-sama5d4_xplained: lab-baylibre: failing since 13 days (last pass: v4.19.108-87-g624c124960e8 - first fail: v4.19.109) arm64: defconfig: gcc-8: meson-axg-s400: lab-baylibre-seattle: new failure (last pass: v4.19.109-202-g69e7137de31c) meson-gxl-s905d-p230: lab-baylibre: failing since 1 day (last pass: v4.19.109-192-gbae09bf235a5 - first fail: v4.19.109-202-g69e7137de31c) Boot Failure Detected: arm: sama5_defconfig: gcc-8: at91-sama5d4_xplained: 1 failed lab Offline Platforms: arm: qcom_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab multi_v7_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab arm64: defconfig: gcc-8 meson-axg-s400: 1 offline lab --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.4.y boot: 95 boots: 3 failed, 86 passed with 2 offline, 4 untried/unknown (v4.4.217)

by kernelci.org bot

stable-rc/linux-4.4.y boot: 95 boots: 3 failed, 86 passed with 2 offline, 4 untried/unknown (v4.4.217) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.217/ Tree: stable-rc Branch: linux-4.4.y Git Describe: v4.4.217 Git Commit: 3b41c631678a15390920ffc1e72470e83db73ac8 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 50 unique boards, 18 SoC families, 17 builds out of 190 Boot Regressions Detected: arm: qcom_defconfig: gcc-8: qcom-apq8064-cm-qs600: lab-baylibre-seattle: failing since 46 days (last pass: v4.4.212-56-g758a39807529 - first fail: v4.4.213-28-ga3b43e6eae91) sama5_defconfig: gcc-8: at91-sama5d4_xplained: lab-baylibre: new failure (last pass: v4.4.216-127-g955137020949) Boot Failures Detected: arm: sama5_defconfig: gcc-8: at91-sama5d4_xplained: 1 failed lab imx_v4_v5_defconfig: gcc-8: imx27-phytec-phycard-s-rdk: 1 failed lab multi_v5_defconfig: gcc-8: imx27-phytec-phycard-s-rdk: 1 failed lab Offline Platforms: arm: qcom_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab multi_v7_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-5.4.y build: 200 builds: 1 failed, 199 passed, 1 error, 107 warnings (v5.4.28)

by kernelci.org bot

stable-rc/linux-5.4.y build: 200 builds: 1 failed, 199 passed, 1 error, 107 warnings (v5.4.28) Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-5.4.y/kernel/v5.4.28/ Tree: stable-rc Branch: linux-5.4.y Git Describe: v5.4.28 Git Commit: 462afcd6e7ea94a7027a96a3bb12d0140b0b4216 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 7 unique architectures Build Failure Detected: mips: ip27_defconfig: (gcc-8) FAIL Errors and Warnings Detected: arc: allnoconfig (gcc-8): 1 warning axs103_defconfig (gcc-8): 2 warnings axs103_smp_defconfig (gcc-8): 2 warnings haps_hs_defconfig (gcc-8): 2 warnings haps_hs_smp_defconfig (gcc-8): 2 warnings hsdk_defconfig (gcc-8): 2 warnings nsim_hs_defconfig (gcc-8): 2 warnings nsim_hs_smp_defconfig (gcc-8): 2 warnings nsimosci_hs_defconfig (gcc-8): 2 warnings nsimosci_hs_smp_defconfig (gcc-8): 2 warnings tinyconfig (gcc-8): 1 warning vdk_hs38_defconfig (gcc-8): 1 warning vdk_hs38_smp_defconfig (gcc-8): 1 warning arm64: defconfig (gcc-8): 12 warnings arm: am200epdkit_defconfig (gcc-8): 1 warning assabet_defconfig (gcc-8): 1 warning at91_dt_defconfig (gcc-8): 1 warning axm55xx_defconfig (gcc-8): 1 warning cm_x2xx_defconfig (gcc-8): 1 warning cm_x300_defconfig (gcc-8): 1 warning cns3420vb_defconfig (gcc-8): 1 warning colibri_pxa270_defconfig (gcc-8): 1 warning colibri_pxa300_defconfig (gcc-8): 1 warning collie_defconfig (gcc-8): 1 warning davinci_all_defconfig (gcc-8): 1 warning dove_defconfig (gcc-8): 1 warning em_x270_defconfig (gcc-8): 1 warning ep93xx_defconfig (gcc-8): 1 warning eseries_pxa_defconfig (gcc-8): 1 warning exynos_defconfig (gcc-8): 1 warning ezx_defconfig (gcc-8): 1 warning h3600_defconfig (gcc-8): 1 warning h5000_defconfig (gcc-8): 1 warning imote2_defconfig (gcc-8): 1 warning imx_v4_v5_defconfig (gcc-8): 1 warning imx_v6_v7_defconfig (gcc-8): 1 warning integrator_defconfig (gcc-8): 1 warning ixp4xx_defconfig (gcc-8): 1 warning keystone_defconfig (gcc-8): 1 warning lpc32xx_defconfig (gcc-8): 1 warning magician_defconfig (gcc-8): 1 warning milbeaut_m10v_defconfig (gcc-8): 1 warning mini2440_defconfig (gcc-8): 1 warning mmp2_defconfig (gcc-8): 1 warning multi_v5_defconfig (gcc-8): 1 warning multi_v7_defconfig (gcc-8): 1 warning mv78xx0_defconfig (gcc-8): 1 warning mvebu_v5_defconfig (gcc-8): 1 warning mvebu_v7_defconfig (gcc-8): 1 warning mxs_defconfig (gcc-8): 1 warning neponset_defconfig (gcc-8): 1 warning nhk8815_defconfig (gcc-8): 1 warning omap1_defconfig (gcc-8): 1 warning omap2plus_defconfig (gcc-8): 1 warning orion5x_defconfig (gcc-8): 1 warning oxnas_v6_defconfig (gcc-8): 1 warning palmz72_defconfig (gcc-8): 1 warning pcm027_defconfig (gcc-8): 1 warning prima2_defconfig (gcc-8): 1 warning pxa168_defconfig (gcc-8): 1 warning pxa3xx_defconfig (gcc-8): 1 warning pxa910_defconfig (gcc-8): 1 warning qcom_defconfig (gcc-8): 1 warning realview_defconfig (gcc-8): 1 warning s3c6400_defconfig (gcc-8): 1 warning s5pv210_defconfig (gcc-8): 1 warning sama5_defconfig (gcc-8): 1 warning shannon_defconfig (gcc-8): 1 warning spear13xx_defconfig (gcc-8): 1 warning sunxi_defconfig (gcc-8): 1 warning tango4_defconfig (gcc-8): 1 warning tegra_defconfig (gcc-8): 1 warning trizeps4_defconfig (gcc-8): 1 warning u300_defconfig (gcc-8): 1 warning u8500_defconfig (gcc-8): 1 warning versatile_defconfig (gcc-8): 1 warning vexpress_defconfig (gcc-8): 1 warning viper_defconfig (gcc-8): 1 warning xcep_defconfig (gcc-8): 1 warning zeus_defconfig (gcc-8): 1 warning i386: mips: ip27_defconfig (gcc-8): 1 error riscv: rv32_defconfig (gcc-8): 6 warnings x86_64: tinyconfig (gcc-8): 1 warning Errors summary: 1 arch/mips/pci/pci-xtalk-bridge.c:287:9: error: ‘struct bridge_irq_chip_data’ has no member named ‘nnasid’; did you mean ‘nasid’? Warnings summary: 61 WARNING: "return_address" [vmlinux] is a static EXPORT_SYMBOL_GPL 24 <stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp] 5 drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] 2 arch/arm64/boot/dts/exynos/exynos5433.dtsi:254.3-29: Warning (reg_format): /gpu@14ac0000:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 2) 2 <stdin>:830:2: warning: #warning syscall fstat64 not implemented [-Wcpp] 2 <stdin>:1127:2: warning: #warning syscall fstatat64 not implemented [-Wcpp] 1 arch/arm64/boot/dts/exynos/exynos7.dtsi:83.3-29: Warning (reg_format): /gpu@14ac0000:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 2) 1 arch/arm64/boot/dts/exynos/exynos7-espresso.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos7-espresso.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos7-espresso.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2e.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2e.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2e.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' 1 arch/arm64/boot/dts/exynos/exynos5433-tm2.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' 1 .config:1157:warning: override: UNWINDER_GUESS changes choice state Section mismatches summary: 1 WARNING: vmlinux.o(.text.unlikely+0x3598): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() 1 WARNING: vmlinux.o(.text.unlikely+0x321c): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.14.y boot: 121 boots: 2 failed, 109 passed with 4 offline, 5 untried/unknown, 1 conflict (v4.14.174)

by kernelci.org bot

stable-rc/linux-4.14.y boot: 121 boots: 2 failed, 109 passed with 4 offline, 5 untried/unknown, 1 conflict (v4.14.174) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.1… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.174/ Tree: stable-rc Branch: linux-4.14.y Git Describe: v4.14.174 Git Commit: 01364dad1d4577e27a57729d41053f661bb8a5b9 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 69 unique boards, 21 SoC families, 16 builds out of 201 Boot Regressions Detected: arm: multi_v7_defconfig: gcc-8: tegra20-iris-512: lab-baylibre-seattle: new failure (last pass: v4.14.173-155-g78d092884075) qcom_defconfig: gcc-8: qcom-apq8064-cm-qs600: lab-baylibre-seattle: failing since 46 days (last pass: v4.14.169-92-gb4137330c582 - first fail: v4.14.170-62-gd6856e4a2c23) sama5_defconfig: gcc-8: at91-sama5d4_xplained: lab-baylibre: failing since 35 days (last pass: v4.14.170-141-g00a0113414f7 - first fail: v4.14.171-29-g9cfe30e85240) tegra_defconfig: gcc-8: tegra20-iris-512: lab-baylibre-seattle: new failure (last pass: v4.14.173-155-g78d092884075) i386: i386_defconfig: gcc-8: qemu_i386: lab-baylibre: new failure (last pass: v4.14.173-155-g78d092884075) Boot Failures Detected: arm: sama5_defconfig: gcc-8: at91-sama5d4_xplained: 1 failed lab arm64: defconfig: gcc-8: meson-gxm-q200: 1 failed lab Offline Platforms: arm: qcom_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab multi_v7_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab tegra20-iris-512: 1 offline lab tegra_defconfig: gcc-8 tegra20-iris-512: 1 offline lab Conflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.) i386: i386_defconfig: qemu_i386: lab-baylibre: FAIL (gcc-8) lab-collabora: PASS (gcc-8) --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

patch "staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From a1f165a6b738f0c9d744bad4af7a53909278f5fc Mon Sep 17 00:00:00 2001 From: Qiujun Huang <hqjagain(a)gmail.com> Date: Wed, 25 Mar 2020 15:06:46 +0800 Subject: staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb We should cancel hw->usb_work before kfree(hw). Reported-by: syzbot+6d2e7f6fa90e27be9d62(a)syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/wlan-ng/prism2usb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c index 352556f6870a..4689b2170e4f 100644 --- a/drivers/staging/wlan-ng/prism2usb.c +++ b/drivers/staging/wlan-ng/prism2usb.c @@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(struct usb_interface *interface) cancel_work_sync(&hw->link_bh); cancel_work_sync(&hw->commsqual_bh); + cancel_work_sync(&hw->usb_work); /* Now we complete any outstanding commands * and tell everyone who is waiting for their -- 2.26.0

5 years, 7 months

1
0
0 0

stable-rc/linux-4.9.y boot: 111 boots: 1 failed, 100 passed with 4 offline, 5 untried/unknown, 1 conflict (v4.9.217)

by kernelci.org bot

stable-rc/linux-4.9.y boot: 111 boots: 1 failed, 100 passed with 4 offline, 5 untried/unknown, 1 conflict (v4.9.217) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.217/ Tree: stable-rc Branch: linux-4.9.y Git Describe: v4.9.217 Git Commit: 10a20903d7ac2be29e0e13d66ad0d74e637b8343 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 59 unique boards, 20 SoC families, 19 builds out of 197 Boot Regressions Detected: arm: multi_v7_defconfig: gcc-8: tegra20-iris-512: lab-baylibre-seattle: new failure (last pass: v4.9.216-128-geb874cb221b9) qcom_defconfig: gcc-8: qcom-apq8064-cm-qs600: lab-baylibre-seattle: failing since 46 days (last pass: v4.9.213 - first fail: v4.9.213-37-g860ec95da9ad) tegra_defconfig: gcc-8: tegra20-iris-512: lab-baylibre-seattle: new failure (last pass: v4.9.216-128-geb874cb221b9) versatile_defconfig: gcc-8: versatile-pb: lab-collabora: new failure (last pass: v4.9.216-128-geb874cb221b9) x86_64: x86_64_defconfig: gcc-8: qemu_x86_64: lab-baylibre: new failure (last pass: v4.9.216-128-geb874cb221b9) Boot Failure Detected: arm: sama5_defconfig: gcc-8: at91-sama5d4_xplained: 1 failed lab Offline Platforms: arm: qcom_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab multi_v7_defconfig: gcc-8 qcom-apq8064-cm-qs600: 1 offline lab tegra20-iris-512: 1 offline lab tegra_defconfig: gcc-8 tegra20-iris-512: 1 offline lab Conflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.) x86_64: x86_64_defconfig: qemu_x86_64: lab-baylibre: FAIL (gcc-8) lab-collabora: PASS (gcc-8) --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.19.y build: 206 builds: 0 failed, 206 passed, 10 warnings (v4.19.113)

by kernelci.org bot

stable-rc/linux-4.19.y build: 206 builds: 0 failed, 206 passed, 10 warnings (v4.19.113) Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.19.y/kernel/v4.19.113/ Tree: stable-rc Branch: linux-4.19.y Git Describe: v4.19.113 Git Commit: 54b4fa6d39551639cb10664f6ac78b01993a1d7e Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 7 unique architectures Warnings Detected: arc: arm64: arm: multi_v7_defconfig (gcc-8): 2 warnings sunxi_defconfig (gcc-8): 2 warnings i386: mips: lemote2f_defconfig (gcc-8): 1 warning loongson3_defconfig (gcc-8): 2 warnings malta_qemu_32r6_defconfig (gcc-8): 1 warning nlm_xlp_defconfig (gcc-8): 1 warning riscv: x86_64: tinyconfig (gcc-8): 1 warning Warnings summary: 3 net/core/rtnetlink.c:3190:1: warning: the frame size of 1312 bytes is larger than 1024 bytes [-Wframe-larger-than=] 2 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c:159:5: warning: ‘is_double’ may be used uninitialized in this function [-Wmaybe-uninitialized] 2 arch/arm/boot/dts/sun8i-h3-beelink-x2.dtb: Warning (clocks_property): /wifi_pwrseq: Missing property '#clock-cells' in node /soc/rtc@1f00000 or bad phandle (referred from clocks[0]) 1 {standard input}:131: Warning: macro instruction expanded into multiple instructions 1 arch/mips/configs/loongson3_defconfig:55:warning: symbol value 'm' invalid for HOTPLUG_PCI_SHPC 1 .config:1010:warning: override: UNWINDER_GUESS changes choice state --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.4.y build: 190 builds: 1 failed, 189 passed, 2 errors, 13 warnings (v4.4.217)

by kernelci.org bot

stable-rc/linux-4.4.y build: 190 builds: 1 failed, 189 passed, 2 errors, 13 warnings (v4.4.217) Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.217/ Tree: stable-rc Branch: linux-4.4.y Git Describe: v4.4.217 Git Commit: 3b41c631678a15390920ffc1e72470e83db73ac8 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 6 unique architectures Build Failure Detected: mips: sead3micro_defconfig: (gcc-8) FAIL Errors and Warnings Detected: arc: allnoconfig (gcc-8): 3 warnings tinyconfig (gcc-8): 4 warnings arm64: arm: clps711x_defconfig (gcc-8): 1 warning davinci_all_defconfig (gcc-8): 1 warning lpc32xx_defconfig (gcc-8): 1 warning mxs_defconfig (gcc-8): 1 warning i386: mips: ip22_defconfig (gcc-8): 1 warning ip28_defconfig (gcc-8): 1 warning sead3micro_defconfig (gcc-8): 2 errors x86_64: Errors summary: 1 arch/mips/kernel/genex.S:271: Error: branch to a symbol in another ISA mode 1 arch/mips/kernel/genex.S:152: Error: branch to a symbol in another ISA mode Warnings summary: 7 warning: (ARC) selects HAVE_FUTEX_CMPXCHG which has unmet direct dependencies (FUTEX) 2 drivers/net/ethernet/seeq/sgiseeq.c:804:26: warning: passing argument 5 of ‘dma_free_attrs’ makes pointer from integer without a cast [-Wint-conversion] 1 arch/arm/mach-mxs/mach-mxs.c:285:26: warning: duplicate ‘const’ declaration specifier [-Wduplicate-decl-specifier] 1 arch/arm/mach-lpc32xx/phy3250.c:215:36: warning: duplicate ‘const’ declaration specifier [-Wduplicate-decl-specifier] 1 arch/arm/mach-davinci/da8xx-dt.c:23:34: warning: duplicate ‘const’ declaration specifier [-Wduplicate-decl-specifier] 1 arch/arm/mach-clps711x/board-autcpu12.c:163:26: warning: duplicate ‘const’ declaration specifier [-Wduplicate-decl-specifier] --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.14.y build: 201 builds: 0 failed, 201 passed, 102 warnings (v4.14.174)

by kernelci.org bot

stable-rc/linux-4.14.y build: 201 builds: 0 failed, 201 passed, 102 warnings (v4.14.174) Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.174/ Tree: stable-rc Branch: linux-4.14.y Git Describe: v4.14.174 Git Commit: 01364dad1d4577e27a57729d41053f661bb8a5b9 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 6 unique architectures Warnings Detected: arc: arm64: defconfig (gcc-8): 1 warning arm: acs5k_defconfig (gcc-8): 1 warning acs5k_tiny_defconfig (gcc-8): 1 warning aspeed_g4_defconfig (gcc-8): 1 warning aspeed_g5_defconfig (gcc-8): 1 warning assabet_defconfig (gcc-8): 1 warning axm55xx_defconfig (gcc-8): 1 warning badge4_defconfig (gcc-8): 1 warning cerfcube_defconfig (gcc-8): 1 warning clps711x_defconfig (gcc-8): 1 warning cm_x300_defconfig (gcc-8): 1 warning cns3420vb_defconfig (gcc-8): 1 warning colibri_pxa270_defconfig (gcc-8): 1 warning colibri_pxa300_defconfig (gcc-8): 1 warning collie_defconfig (gcc-8): 1 warning corgi_defconfig (gcc-8): 1 warning davinci_all_defconfig (gcc-8): 1 warning dove_defconfig (gcc-8): 1 warning ebsa110_defconfig (gcc-8): 1 warning ep93xx_defconfig (gcc-8): 1 warning eseries_pxa_defconfig (gcc-8): 1 warning exynos_defconfig (gcc-8): 1 warning ezx_defconfig (gcc-8): 1 warning footbridge_defconfig (gcc-8): 1 warning gemini_defconfig (gcc-8): 1 warning h3600_defconfig (gcc-8): 1 warning hackkit_defconfig (gcc-8): 1 warning hisi_defconfig (gcc-8): 1 warning imote2_defconfig (gcc-8): 1 warning imx_v6_v7_defconfig (gcc-8): 1 warning integrator_defconfig (gcc-8): 1 warning iop13xx_defconfig (gcc-8): 1 warning iop32x_defconfig (gcc-8): 1 warning iop33x_defconfig (gcc-8): 1 warning ixp4xx_defconfig (gcc-8): 1 warning jornada720_defconfig (gcc-8): 1 warning keystone_defconfig (gcc-8): 1 warning ks8695_defconfig (gcc-8): 1 warning lart_defconfig (gcc-8): 1 warning lpd270_defconfig (gcc-8): 1 warning lubbock_defconfig (gcc-8): 1 warning magician_defconfig (gcc-8): 1 warning mainstone_defconfig (gcc-8): 1 warning mini2440_defconfig (gcc-8): 1 warning mmp2_defconfig (gcc-8): 1 warning moxart_defconfig (gcc-8): 1 warning multi_v4t_defconfig (gcc-8): 1 warning multi_v5_defconfig (gcc-8): 1 warning multi_v7_defconfig (gcc-8): 2 warnings mv78xx0_defconfig (gcc-8): 1 warning mvebu_v5_defconfig (gcc-8): 1 warning mvebu_v7_defconfig (gcc-8): 1 warning mxs_defconfig (gcc-8): 1 warning neponset_defconfig (gcc-8): 1 warning netwinder_defconfig (gcc-8): 1 warning netx_defconfig (gcc-8): 1 warning nhk8815_defconfig (gcc-8): 1 warning nuc910_defconfig (gcc-8): 1 warning nuc950_defconfig (gcc-8): 1 warning nuc960_defconfig (gcc-8): 1 warning omap2plus_defconfig (gcc-8): 1 warning orion5x_defconfig (gcc-8): 1 warning palmz72_defconfig (gcc-8): 1 warning pcm027_defconfig (gcc-8): 1 warning prima2_defconfig (gcc-8): 1 warning pxa168_defconfig (gcc-8): 1 warning pxa255-idp_defconfig (gcc-8): 1 warning pxa3xx_defconfig (gcc-8): 1 warning pxa910_defconfig (gcc-8): 1 warning pxa_defconfig (gcc-8): 1 warning qcom_defconfig (gcc-8): 1 warning raumfeld_defconfig (gcc-8): 1 warning realview_defconfig (gcc-8): 1 warning rpc_defconfig (gcc-8): 1 warning s3c2410_defconfig (gcc-8): 1 warning s3c6400_defconfig (gcc-8): 1 warning s5pv210_defconfig (gcc-8): 1 warning sama5_defconfig (gcc-8): 1 warning shannon_defconfig (gcc-8): 1 warning simpad_defconfig (gcc-8): 1 warning socfpga_defconfig (gcc-8): 1 warning spear13xx_defconfig (gcc-8): 1 warning spear3xx_defconfig (gcc-8): 1 warning spear6xx_defconfig (gcc-8): 1 warning spitz_defconfig (gcc-8): 1 warning sunxi_defconfig (gcc-8): 2 warnings tango4_defconfig (gcc-8): 1 warning tegra_defconfig (gcc-8): 1 warning trizeps4_defconfig (gcc-8): 1 warning u300_defconfig (gcc-8): 1 warning u8500_defconfig (gcc-8): 1 warning versatile_defconfig (gcc-8): 1 warning vexpress_defconfig (gcc-8): 1 warning vt8500_v6_v7_defconfig (gcc-8): 1 warning zeus_defconfig (gcc-8): 1 warning zx_defconfig (gcc-8): 1 warning i386: i386_defconfig (gcc-8): 1 warning mips: malta_qemu_32r6_defconfig (gcc-8): 1 warning x86_64: tinyconfig (gcc-8): 1 warning x86_64_defconfig (gcc-8): 1 warning Warnings summary: 98 fs/proc/task_mmu.c:761:7: warning: ‘last_vma’ may be used uninitialized in this function [-Wmaybe-uninitialized] 2 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c:146:5: warning: ‘is_double’ may be used uninitialized in this function [-Wmaybe-uninitialized] 1 {standard input}:29: Warning: macro instruction expanded into multiple instructions 1 .config:1028:warning: override: UNWINDER_GUESS changes choice state --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

stable-rc/linux-4.9.y build: 197 builds: 1 failed, 196 passed (v4.9.217)

by kernelci.org bot

stable-rc/linux-4.9.y build: 197 builds: 1 failed, 196 passed (v4.9.217) Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.217/ Tree: stable-rc Branch: linux-4.9.y Git Describe: v4.9.217 Git Commit: 10a20903d7ac2be29e0e13d66ad0d74e637b8343 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 6 unique architectures Build Failure Detected: mips: 32r2el_defconfig: (gcc-8) FAIL --- For more info write to <info(a)kernelci.org>

5 years, 7 months

1
0
0 0

+ selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: selftests: vm: drop dependencies on page flags from mlock2 tests has been added to the -mm tree. Its filename is selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/selftests-vm-drop-dependencies-on-… and later at http://ozlabs.org/~akpm/mmotm/broken-out/selftests-vm-drop-dependencies-on-… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Michal Hocko <mhocko(a)suse.com> Subject: selftests: vm: drop dependencies on page flags from mlock2 tests It was noticed that mlock2 tests are failing after 9c4e6b1a7027f ("mm, mlock, vmscan: no more skipping pagevecs") because the patch has changed the timing on when the page is added to the unevictable LRU list and thus gains the unevictable page flag. The test was just too dependent on the implementation details which were true at the time when it was introduced. Page flags and the timing when they are set is something no userspace should ever depend on. The test should be testing only for the user observable contract of the tested syscalls. Those are defined pretty well for the mlock and there are other means for testing them. In fact this is already done and testing for page flags can be safely dropped to achieve the aimed purpose. Present bits can be checked by /proc/<pid>/smaps RSS field and the locking state by VmFlags although I would argue that Locked: field would be more appropriate. Drop all the page flag machinery and considerably simplify the test. This should be more robust for future kernel changes while checking the promised contract is still valid. Link: http://lkml.kernel.org/r/20200324154218.GS19542@dhcp22.suse.cz Fixes: 9c4e6b1a7027f ("mm, mlock, vmscan: no more skipping pagevecs") Signed-off-by: Michal Hocko <mhocko(a)suse.com> Reported-by: Rafael Aquini <aquini(a)redhat.com> Acked-by: Rafael Aquini <aquini(a)redhat.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Eric B Munson <emunson(a)akamai.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/vm/mlock2-tests.c | 233 +++----------------- 1 file changed, 37 insertions(+), 196 deletions(-) --- a/tools/testing/selftests/vm/mlock2-tests.c~selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests +++ a/tools/testing/selftests/vm/mlock2-tests.c @@ -67,59 +67,6 @@ out: return ret; } -static uint64_t get_pageflags(unsigned long addr) -{ - FILE *file; - uint64_t pfn; - unsigned long offset; - - file = fopen("/proc/self/pagemap", "r"); - if (!file) { - perror("fopen pagemap"); - _exit(1); - } - - offset = addr / getpagesize() * sizeof(pfn); - - if (fseek(file, offset, SEEK_SET)) { - perror("fseek pagemap"); - _exit(1); - } - - if (fread(&pfn, sizeof(pfn), 1, file) != 1) { - perror("fread pagemap"); - _exit(1); - } - - fclose(file); - return pfn; -} - -static uint64_t get_kpageflags(unsigned long pfn) -{ - uint64_t flags; - FILE *file; - - file = fopen("/proc/kpageflags", "r"); - if (!file) { - perror("fopen kpageflags"); - _exit(1); - } - - if (fseek(file, pfn * sizeof(flags), SEEK_SET)) { - perror("fseek kpageflags"); - _exit(1); - } - - if (fread(&flags, sizeof(flags), 1, file) != 1) { - perror("fread kpageflags"); - _exit(1); - } - - fclose(file); - return flags; -} - #define VMFLAGS "VmFlags:" static bool is_vmflag_set(unsigned long addr, const char *vmflag) @@ -159,19 +106,13 @@ out: #define RSS "Rss:" #define LOCKED "lo" -static bool is_vma_lock_on_fault(unsigned long addr) +static unsigned long get_value_for_name(unsigned long addr, const char *name) { - bool ret = false; - bool locked; - FILE *smaps = NULL; - unsigned long vma_size, vma_rss; char *line = NULL; - char *value; size_t size = 0; - - locked = is_vmflag_set(addr, LOCKED); - if (!locked) - goto out; + char *value_ptr; + FILE *smaps = NULL; + unsigned long value = -1UL; smaps = seek_to_smaps_entry(addr); if (!smaps) { @@ -180,112 +121,70 @@ static bool is_vma_lock_on_fault(unsigne } while (getline(&line, &size, smaps) > 0) { - if (!strstr(line, SIZE)) { + if (!strstr(line, name)) { free(line); line = NULL; size = 0; continue; } - value = line + strlen(SIZE); - if (sscanf(value, "%lu kB", &vma_size) < 1) { + value_ptr = line + strlen(name); + if (sscanf(value_ptr, "%lu kB", &value) < 1) { printf("Unable to parse smaps entry for Size\n"); goto out; } break; } - while (getline(&line, &size, smaps) > 0) { - if (!strstr(line, RSS)) { - free(line); - line = NULL; - size = 0; - continue; - } - - value = line + strlen(RSS); - if (sscanf(value, "%lu kB", &vma_rss) < 1) { - printf("Unable to parse smaps entry for Rss\n"); - goto out; - } - break; - } - - ret = locked && (vma_rss < vma_size); out: - free(line); if (smaps) fclose(smaps); - return ret; + free(line); + return value; } -#define PRESENT_BIT 0x8000000000000000ULL -#define PFN_MASK 0x007FFFFFFFFFFFFFULL -#define UNEVICTABLE_BIT (1UL << 18) - -static int lock_check(char *map) +static bool is_vma_lock_on_fault(unsigned long addr) { - unsigned long page_size = getpagesize(); - uint64_t page1_flags, page2_flags; + bool locked; + unsigned long vma_size, vma_rss; + + locked = is_vmflag_set(addr, LOCKED); + if (!locked) + return false; - page1_flags = get_pageflags((unsigned long)map); - page2_flags = get_pageflags((unsigned long)map + page_size); + vma_size = get_value_for_name(addr, SIZE); + vma_rss = get_value_for_name(addr, RSS); - /* Both pages should be present */ - if (((page1_flags & PRESENT_BIT) == 0) || - ((page2_flags & PRESENT_BIT) == 0)) { - printf("Failed to make both pages present\n"); - return 1; - } + /* only one page is faulted in */ + return (vma_rss < vma_size); +} - page1_flags = get_kpageflags(page1_flags & PFN_MASK); - page2_flags = get_kpageflags(page2_flags & PFN_MASK); +#define PRESENT_BIT 0x8000000000000000ULL +#define PFN_MASK 0x007FFFFFFFFFFFFFULL +#define UNEVICTABLE_BIT (1UL << 18) - /* Both pages should be unevictable */ - if (((page1_flags & UNEVICTABLE_BIT) == 0) || - ((page2_flags & UNEVICTABLE_BIT) == 0)) { - printf("Failed to make both pages unevictable\n"); - return 1; - } +static int lock_check(unsigned long addr) +{ + bool locked; + unsigned long vma_size, vma_rss; - if (!is_vmflag_set((unsigned long)map, LOCKED)) { - printf("VMA flag %s is missing on page 1\n", LOCKED); - return 1; - } + locked = is_vmflag_set(addr, LOCKED); + if (!locked) + return false; - if (!is_vmflag_set((unsigned long)map + page_size, LOCKED)) { - printf("VMA flag %s is missing on page 2\n", LOCKED); - return 1; - } + vma_size = get_value_for_name(addr, SIZE); + vma_rss = get_value_for_name(addr, RSS); - return 0; + return (vma_rss == vma_size); } static int unlock_lock_check(char *map) { - unsigned long page_size = getpagesize(); - uint64_t page1_flags, page2_flags; - - page1_flags = get_pageflags((unsigned long)map); - page2_flags = get_pageflags((unsigned long)map + page_size); - page1_flags = get_kpageflags(page1_flags & PFN_MASK); - page2_flags = get_kpageflags(page2_flags & PFN_MASK); - - if ((page1_flags & UNEVICTABLE_BIT) || (page2_flags & UNEVICTABLE_BIT)) { - printf("A page is still marked unevictable after unlock\n"); - return 1; - } - if (is_vmflag_set((unsigned long)map, LOCKED)) { printf("VMA flag %s is present on page 1 after unlock\n", LOCKED); return 1; } - if (is_vmflag_set((unsigned long)map + page_size, LOCKED)) { - printf("VMA flag %s is present on page 2 after unlock\n", LOCKED); - return 1; - } - return 0; } @@ -311,7 +210,7 @@ static int test_mlock_lock() goto unmap; } - if (lock_check(map)) + if (!lock_check((unsigned long)map)) goto unmap; /* Now unlock and recheck attributes */ @@ -330,64 +229,18 @@ out: static int onfault_check(char *map) { - unsigned long page_size = getpagesize(); - uint64_t page1_flags, page2_flags; - - page1_flags = get_pageflags((unsigned long)map); - page2_flags = get_pageflags((unsigned long)map + page_size); - - /* Neither page should be present */ - if ((page1_flags & PRESENT_BIT) || (page2_flags & PRESENT_BIT)) { - printf("Pages were made present by MLOCK_ONFAULT\n"); - return 1; - } - *map = 'a'; - page1_flags = get_pageflags((unsigned long)map); - page2_flags = get_pageflags((unsigned long)map + page_size); - - /* Only page 1 should be present */ - if ((page1_flags & PRESENT_BIT) == 0) { - printf("Page 1 is not present after fault\n"); - return 1; - } else if (page2_flags & PRESENT_BIT) { - printf("Page 2 was made present\n"); - return 1; - } - - page1_flags = get_kpageflags(page1_flags & PFN_MASK); - - /* Page 1 should be unevictable */ - if ((page1_flags & UNEVICTABLE_BIT) == 0) { - printf("Failed to make faulted page unevictable\n"); - return 1; - } - if (!is_vma_lock_on_fault((unsigned long)map)) { printf("VMA is not marked for lock on fault\n"); return 1; } - if (!is_vma_lock_on_fault((unsigned long)map + page_size)) { - printf("VMA is not marked for lock on fault\n"); - return 1; - } - return 0; } static int unlock_onfault_check(char *map) { unsigned long page_size = getpagesize(); - uint64_t page1_flags; - - page1_flags = get_pageflags((unsigned long)map); - page1_flags = get_kpageflags(page1_flags & PFN_MASK); - - if (page1_flags & UNEVICTABLE_BIT) { - printf("Page 1 is still marked unevictable after unlock\n"); - return 1; - } if (is_vma_lock_on_fault((unsigned long)map) || is_vma_lock_on_fault((unsigned long)map + page_size)) { @@ -445,7 +298,6 @@ static int test_lock_onfault_of_present( char *map; int ret = 1; unsigned long page_size = getpagesize(); - uint64_t page1_flags, page2_flags; map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); @@ -465,17 +317,6 @@ static int test_lock_onfault_of_present( goto unmap; } - page1_flags = get_pageflags((unsigned long)map); - page2_flags = get_pageflags((unsigned long)map + page_size); - page1_flags = get_kpageflags(page1_flags & PFN_MASK); - page2_flags = get_kpageflags(page2_flags & PFN_MASK); - - /* Page 1 should be unevictable */ - if ((page1_flags & UNEVICTABLE_BIT) == 0) { - printf("Failed to make present page unevictable\n"); - goto unmap; - } - if (!is_vma_lock_on_fault((unsigned long)map) || !is_vma_lock_on_fault((unsigned long)map + page_size)) { printf("VMA with present pages is not marked lock on fault\n"); @@ -507,7 +348,7 @@ static int test_munlockall() goto out; } - if (lock_check(map)) + if (!lock_check((unsigned long)map)) goto unmap; if (munlockall()) { @@ -549,7 +390,7 @@ static int test_munlockall() goto out; } - if (lock_check(map)) + if (!lock_check((unsigned long)map)) goto unmap; if (munlockall()) { _ Patches currently in -mm which might be from mhocko(a)suse.com are selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests.patch

5 years, 7 months

1
0
0 0

+ ipc-mqueuec-change-__do_notify-to-bypass-check_kill_permission.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() has been added to the -mm tree. Its filename is ipc-mqueuec-change-__do_notify-to-bypass-check_kill_permission.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/ipc-mqueuec-change-__do_notify-to-… and later at http://ozlabs.org/~akpm/mmotm/broken-out/ipc-mqueuec-change-__do_notify-to-… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Oleg Nesterov <oleg(a)redhat.com> Subject: ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() Commit cc731525f26a ("signal: Remove kernel interal si_code magic") changed the value of SI_FROMUSER(SI_MESGQ), this means that mq_notify() no longer works if the sender doesn't have rights to send a signal. Change __do_notify() to use do_send_sig_info() instead of kill_pid_info() to avoid check_kill_permission(). This needs the additional notify.sigev_signo != 0 check, shouldn't we change do_mq_notify() to deny sigev_signo == 0 ? Test-case: #include <signal.h> #include <mqueue.h> #include <unistd.h> #include <sys/wait.h> #include <assert.h> static int notified; static void sigh(int sig) { notified = 1; } int main(void) { signal(SIGIO, sigh); int fd = mq_open("/mq", O_RDWR|O_CREAT, 0666, NULL); assert(fd >= 0); struct sigevent se = { .sigev_notify = SIGEV_SIGNAL, .sigev_signo = SIGIO, }; assert(mq_notify(fd, &se) == 0); if (!fork()) { assert(setuid(1) == 0); mq_send(fd, "",1,0); return 0; } wait(NULL); mq_unlink("/mq"); assert(notified); return 0; } Link: http://lkml.kernel.org/r/20200324200932.GB24230@redhat.com Fixes: cc731525f26a ("signal: Remove kernel interal si_code magic") Reported-by: Yoji <yoji.fujihar.min(a)gmail.com> Signed-off-by: Oleg Nesterov <oleg(a)redhat.com> Cc: "Eric W. Biederman" <ebiederm(a)xmission.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Manfred Spraul <manfred(a)colorfullife.com> Cc: Markus Elfring <elfring(a)users.sourceforge.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- ipc/mqueue.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) --- a/ipc/mqueue.c~ipc-mqueuec-change-__do_notify-to-bypass-check_kill_permission +++ a/ipc/mqueue.c @@ -774,28 +774,40 @@ static void __do_notify(struct mqueue_in * synchronously. */ if (info->notify_owner && info->attr.mq_curmsgs == 1) { - struct kernel_siginfo sig_i; switch (info->notify.sigev_notify) { case SIGEV_NONE: break; - case SIGEV_SIGNAL: - /* sends signal */ + case SIGEV_SIGNAL: { + struct kernel_siginfo sig_i; + struct task_struct *task; + + /* do_mq_notify() accepts sigev_signo == 0, why?? */ + if (!info->notify.sigev_signo) + break; clear_siginfo(&sig_i); sig_i.si_signo = info->notify.sigev_signo; sig_i.si_errno = 0; sig_i.si_code = SI_MESGQ; sig_i.si_value = info->notify.sigev_value; - /* map current pid/uid into info->owner's namespaces */ rcu_read_lock(); + /* map current pid/uid into info->owner's namespaces */ sig_i.si_pid = task_tgid_nr_ns(current, ns_of_pid(info->notify_owner)); - sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid()); + sig_i.si_uid = from_kuid_munged(info->notify_user_ns, + current_uid()); + /* + * We can't use kill_pid_info(), this signal should + * bypass check_kill_permission(). It is from kernel + * but si_fromuser() can't know this. + */ + task = pid_task(info->notify_owner, PIDTYPE_PID); + if (task) + do_send_sig_info(info->notify.sigev_signo, + &sig_i, task, PIDTYPE_TGID); rcu_read_unlock(); - - kill_pid_info(info->notify.sigev_signo, - &sig_i, info->notify_owner); break; + } case SIGEV_THREAD: set_cookie(info->notify_cookie, NOTIFY_WOKENUP); netlink_sendskb(info->notify_sock, info->notify_cookie); _ Patches currently in -mm which might be from oleg(a)redhat.com are ipc-mqueuec-change-__do_notify-to-bypass-check_kill_permission.patch aio-simplify-read_events.patch

5 years, 7 months

1
0
0 0

+ mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm/sparse: fix kernel crash with pfn_section_valid check has been added to the -mm tree. Its filename is mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-sparse-fix-kernel-crash-with-pf… and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-sparse-fix-kernel-crash-with-pf… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com> Subject: mm/sparse: fix kernel crash with pfn_section_valid check Fixes the below crash BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000c3447c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1 ... NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0 LR [c000000000088354] vmemmap_free+0x144/0x320 Call Trace: section_deactivate+0x220/0x240 __remove_pages+0x118/0x170 arch_remove_memory+0x3c/0x150 memunmap_pages+0x1cc/0x2f0 devm_action_release+0x30/0x50 release_nodes+0x2f8/0x3e0 device_release_driver_internal+0x168/0x270 unbind_store+0x130/0x170 drv_attr_store+0x44/0x60 sysfs_kf_write+0x68/0x80 kernfs_fop_write+0x100/0x290 __vfs_write+0x3c/0x70 vfs_write+0xcc/0x240 ksys_write+0x7c/0x140 system_call+0x5c/0x68 With commit: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after depopulate_section_mem(). This was done so that pfn_page() can work correctly with kernel config that disables SPARSEMEM_VMEMMAP. With that config pfn_to_page does __section_mem_map_addr(__sec) + __pfn; where static inline struct page *__section_mem_map_addr(struct mem_section *section) { unsigned long map = section->section_mem_map; map &= SECTION_MAP_MASK; return (struct page *)map; } Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is used to check the pfn validity (pfn_valid()). Since section_deactivate release mem_section->usage if a section is fully deactivated, pfn_valid() check after a subsection_deactivate cause a kernel crash. static inline int pfn_valid(unsigned long pfn) { ... return early_section(ms) || pfn_section_valid(ms, pfn); } where static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); return test_bit(idx, ms->usage->subsection_map); } Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is freed. Link: http://lkml.kernel.org/r/20200325031914.107660-1-aneesh.kumar@linux.ibm.com Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Wei Yang <richardw.yang(a)linux.intel.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 2 ++ 1 file changed, 2 insertions(+) --- a/mm/sparse.c~mm-sparse-fix-kernel-crash-with-pfn_section_valid-check +++ a/mm/sparse.c @@ -781,6 +781,8 @@ static void section_deactivate(unsigned ms->usage = NULL; } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); + /* Mark the section invalid */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } if (section_is_early && memmap) _ Patches currently in -mm which might be from aneesh.kumar(a)linux.ibm.com are mm-sparse-fix-kernel-crash-with-pfn_section_valid-check.patch

5 years, 7 months

1
0
0 0

Re: [PATCH] gpio: thunderx: fix irq_request_resources

by Tim Harvey

On Thu, Mar 12, 2020 at 6:42 AM Linus Walleij <linus.walleij(a)linaro.org> wrote: > > On Wed, Mar 11, 2020 at 4:43 PM Tim Harvey <tharvey(a)gateworks.com> wrote: > > > If there are no parent resources do not call irq_chip_request_resources_parent > > at all as this will return an error. > > > > This resolves a regression where devices using a thunderx gpio as an interrupt > > would fail probing. > > > > Fixes: 0d04d0c ("gpio: thunderx: Use the default parent apis for {request,release}_resources") > > Signed-off-by: Tim Harvey <tharvey(a)gateworks.com> > > This patch does not apply to the mainline kernel or v5.6-rc1. > > Please verify: > 1. If the problem is still in v5.6 (we refactored the driver to > use GPIOLIB_IRQCHIP) Linus, Sorry, another issue was keeping me from being able to boot 5.6-rc but that's now understood and I can confirm the issue is not present in v5.6-rc5 > > 2. If not, only propose it for linux-stable v5.5 etc. > Yes, needs to be applied to v5.2, v5.3, v5.4, v5.5. I cc'd stable. If I need to re-submit please let me know. Cc: stable(a)vger.kernel.org Tim

5 years, 7 months

3
2
0 0

✅ PASS: Test report for kernel 5.5.13-rc1-0b0b40a.cki (stable)

by CKI Project

Hello, We ran automated tests on a recent commit from this kernel tree: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Commit: 0b0b40a42baf - Linux 5.5.13-rc1 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK All kernel binaries, config files, and logs are available for download here: https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware… Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Compile testing --------------- We compiled the kernel for 4 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg s390x: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ✅ Podman system integration test - as root ✅ Podman system integration test - as user ✅ LTP ✅ Loopdev Sanity ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking MACsec: sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking: igmp conformance test ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - transport ✅ Networking ipsec: basic netns - tunnel ✅ httpd: mod_ssl smoke sanity ✅ tuned: tune-processes-through-perf ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ jvm - DaCapo Benchmark Suite 🚧 ✅ jvm - jcstress tests 🚧 ✅ Memory function: kaslr 🚧 ✅ LTP: openposix test suite 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ❌ audit: audit testsuite test 🚧 ✅ iotop: sanity 🚧 ✅ storage: dm/common Host 2: ✅ Boot test ✅ xfstests - ext4 ✅ xfstests - xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing ✅ stress: stress-ng 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test 🚧 ✅ Storage blktests ppc64le: Host 1: ✅ Boot test ✅ Podman system integration test - as root ✅ Podman system integration test - as user ✅ LTP ✅ Loopdev Sanity ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking MACsec: sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - tunnel ✅ httpd: mod_ssl smoke sanity ✅ tuned: tune-processes-through-perf ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ Usex - version 1.9-29 ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ jvm - DaCapo Benchmark Suite 🚧 ✅ jvm - jcstress tests 🚧 ✅ Memory function: kaslr 🚧 ✅ LTP: openposix test suite 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ❌ audit: audit testsuite test 🚧 ✅ iotop: sanity 🚧 ✅ storage: dm/common Host 2: ✅ Boot test ✅ xfstests - ext4 ✅ xfstests - xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test 🚧 ✅ Storage blktests s390x: Host 1: ✅ Boot test ✅ selinux-policy: serge-testsuite 🚧 ✅ Storage blktests Host 2: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ✅ Boot test ✅ Podman system integration test - as root ✅ Podman system integration test - as user ✅ Loopdev Sanity ✅ Memory function: memfd_create ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking MACsec: sanity ✅ Networking sctp-auth: sockopts test ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - transport ✅ Networking ipsec: basic netns - tunnel ✅ httpd: mod_ssl smoke sanity ✅ tuned: tune-processes-through-perf ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ jvm - DaCapo Benchmark Suite 🚧 ✅ jvm - jcstress tests 🚧 ✅ Memory function: kaslr 🚧 ✅ LTP: openposix test suite 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ⚡⚡⚡ audit: audit testsuite test 🚧 ✅ iotop: sanity 🚧 ✅ storage: dm/common x86_64: Host 1: ✅ Boot test ✅ Storage SAN device stress - megaraid_sas Host 2: ✅ Boot test ✅ Storage SAN device stress - mpt3sas driver Host 3: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ Podman system integration test - as root ⚡⚡⚡ Podman system integration test - as user ⚡⚡⚡ LTP ⚡⚡⚡ Loopdev Sanity ⚡⚡⚡ Memory function: memfd_create ⚡⚡⚡ AMTU (Abstract Machine Test Utility) ⚡⚡⚡ Networking bridge: sanity ⚡⚡⚡ Ethernet drivers sanity ⚡⚡⚡ Networking MACsec: sanity ⚡⚡⚡ Networking socket: fuzz ⚡⚡⚡ Networking sctp-auth: sockopts test ⚡⚡⚡ Networking: igmp conformance test ⚡⚡⚡ Networking route: pmtu ⚡⚡⚡ Networking route_func - local ⚡⚡⚡ Networking route_func - forward ⚡⚡⚡ Networking TCP: keepalive test ⚡⚡⚡ Networking UDP: socket ⚡⚡⚡ Networking tunnel: geneve basic test ⚡⚡⚡ Networking tunnel: gre basic ⚡⚡⚡ L2TP basic test ⚡⚡⚡ Networking tunnel: vxlan basic ⚡⚡⚡ Networking ipsec: basic netns - transport ⚡⚡⚡ Networking ipsec: basic netns - tunnel ⚡⚡⚡ httpd: mod_ssl smoke sanity ⚡⚡⚡ tuned: tune-processes-through-perf ⚡⚡⚡ pciutils: sanity smoke test ⚡⚡⚡ ALSA PCM loopback test ⚡⚡⚡ ALSA Control (mixer) Userspace Element test ⚡⚡⚡ Usex - version 1.9-29 ⚡⚡⚡ storage: SCSI VPD ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ CIFS Connectathon 🚧 ⚡⚡⚡ POSIX pjd-fstest suites 🚧 ⚡⚡⚡ jvm - DaCapo Benchmark Suite 🚧 ⚡⚡⚡ jvm - jcstress tests 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ LTP: openposix test suite 🚧 ⚡⚡⚡ Networking vnic: ipvlan/basic 🚧 ⚡⚡⚡ audit: audit testsuite test 🚧 ⚡⚡⚡ iotop: sanity 🚧 ⚡⚡⚡ storage: dm/common Host 4: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ✅ Boot test ✅ xfstests - ext4 ⚡⚡⚡ xfstests - xfs ⚡⚡⚡ selinux-policy: serge-testsuite ⚡⚡⚡ lvm thinp sanity ⚡⚡⚡ storage: software RAID testing ⚡⚡⚡ stress: stress-ng 🚧 ⚡⚡⚡ IOMMU boot test 🚧 ⚡⚡⚡ IPMI driver test 🚧 ⚡⚡⚡ IPMItool loop stress test 🚧 ⚡⚡⚡ power-management: cpupower/sanity test 🚧 ⚡⚡⚡ Storage blktests Host 5: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ Podman system integration test - as root ⚡⚡⚡ Podman system integration test - as user ⚡⚡⚡ LTP ⚡⚡⚡ Loopdev Sanity ⚡⚡⚡ Memory function: memfd_create ⚡⚡⚡ AMTU (Abstract Machine Test Utility) ⚡⚡⚡ Networking bridge: sanity ⚡⚡⚡ Ethernet drivers sanity ⚡⚡⚡ Networking MACsec: sanity ⚡⚡⚡ Networking socket: fuzz ⚡⚡⚡ Networking sctp-auth: sockopts test ⚡⚡⚡ Networking: igmp conformance test ⚡⚡⚡ Networking route: pmtu ⚡⚡⚡ Networking route_func - local ⚡⚡⚡ Networking route_func - forward ⚡⚡⚡ Networking TCP: keepalive test ⚡⚡⚡ Networking UDP: socket ⚡⚡⚡ Networking tunnel: geneve basic test ⚡⚡⚡ Networking tunnel: gre basic ⚡⚡⚡ L2TP basic test ⚡⚡⚡ Networking tunnel: vxlan basic ⚡⚡⚡ Networking ipsec: basic netns - transport ⚡⚡⚡ Networking ipsec: basic netns - tunnel ⚡⚡⚡ httpd: mod_ssl smoke sanity ⚡⚡⚡ tuned: tune-processes-through-perf ⚡⚡⚡ pciutils: sanity smoke test ⚡⚡⚡ ALSA PCM loopback test ⚡⚡⚡ ALSA Control (mixer) Userspace Element test ⚡⚡⚡ Usex - version 1.9-29 ⚡⚡⚡ storage: SCSI VPD ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ CIFS Connectathon 🚧 ⚡⚡⚡ POSIX pjd-fstest suites 🚧 ⚡⚡⚡ jvm - DaCapo Benchmark Suite 🚧 ⚡⚡⚡ jvm - jcstress tests 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ LTP: openposix test suite 🚧 ⚡⚡⚡ Networking vnic: ipvlan/basic 🚧 ⚡⚡⚡ audit: audit testsuite test 🚧 ⚡⚡⚡ iotop: sanity 🚧 ⚡⚡⚡ storage: dm/common Host 6: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ Podman system integration test - as root ⚡⚡⚡ Podman system integration test - as user ⚡⚡⚡ LTP ⚡⚡⚡ Loopdev Sanity ⚡⚡⚡ Memory function: memfd_create ⚡⚡⚡ AMTU (Abstract Machine Test Utility) ⚡⚡⚡ Networking bridge: sanity ⚡⚡⚡ Ethernet drivers sanity ⚡⚡⚡ Networking MACsec: sanity ⚡⚡⚡ Networking socket: fuzz ⚡⚡⚡ Networking sctp-auth: sockopts test ⚡⚡⚡ Networking: igmp conformance test ⚡⚡⚡ Networking route: pmtu ⚡⚡⚡ Networking route_func - local ⚡⚡⚡ Networking route_func - forward ⚡⚡⚡ Networking TCP: keepalive test ⚡⚡⚡ Networking UDP: socket ⚡⚡⚡ Networking tunnel: geneve basic test ⚡⚡⚡ Networking tunnel: gre basic ⚡⚡⚡ L2TP basic test ⚡⚡⚡ Networking tunnel: vxlan basic ⚡⚡⚡ Networking ipsec: basic netns - transport ⚡⚡⚡ Networking ipsec: basic netns - tunnel ⚡⚡⚡ httpd: mod_ssl smoke sanity ⚡⚡⚡ tuned: tune-processes-through-perf ⚡⚡⚡ pciutils: sanity smoke test ⚡⚡⚡ ALSA PCM loopback test ⚡⚡⚡ ALSA Control (mixer) Userspace Element test ⚡⚡⚡ Usex - version 1.9-29 ⚡⚡⚡ storage: SCSI VPD ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ CIFS Connectathon 🚧 ⚡⚡⚡ POSIX pjd-fstest suites 🚧 ⚡⚡⚡ jvm - DaCapo Benchmark Suite 🚧 ⚡⚡⚡ jvm - jcstress tests 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ LTP: openposix test suite 🚧 ⚡⚡⚡ Networking vnic: ipvlan/basic 🚧 ⚡⚡⚡ audit: audit testsuite test 🚧 ⚡⚡⚡ iotop: sanity 🚧 ⚡⚡⚡ storage: dm/common Test sources: https://github.com/CKI-project/tests-beaker 💚 Pull requests are welcome for new tests or improvements to existing tests! Aborted tests ------------- Tests that didn't complete running successfully are marked with ⚡⚡⚡. If this was caused by an infrastructure issue, we try to mark that explicitly in the report. Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed. Testing timeout --------------- We aim to provide a report within reasonable timeframe. Tests that haven't finished running yet are marked with ⏱.

5 years, 7 months

1
0
0 0

[PATCH] x86/Hyper-V: Fix hv sched clock function return wrong time unit

by Yubo Xie

sched clock callback should return time with nano second as unit but current hv callback returns time with 100ns. Fix it. Cc: stable(a)vger.kernel.org Signed-off-by: Yubo Xie <yuboxie(a)microsoft.com> Signed-off-by: Tianyu Lan <Tianyu.Lan(a)microsoft.com> Fixes: adb87ff4f96c ("clocksource/drivers/hyperv: Allocate Hyper-V TSC page statically") --- drivers/clocksource/hyperv_timer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c index 9d808d595ca8..662ed978fa24 100644 --- a/drivers/clocksource/hyperv_timer.c +++ b/drivers/clocksource/hyperv_timer.c @@ -343,7 +343,8 @@ static u64 notrace read_hv_clock_tsc_cs(struct clocksource *arg) static u64 read_hv_sched_clock_tsc(void) { - return read_hv_clock_tsc() - hv_sched_clock_offset; + return (read_hv_clock_tsc() - hv_sched_clock_offset) + * (NSEC_PER_SEC / HV_CLOCK_HZ); } static void suspend_hv_clock_tsc(struct clocksource *arg) @@ -398,7 +399,8 @@ static u64 notrace read_hv_clock_msr_cs(struct clocksource *arg) static u64 read_hv_sched_clock_msr(void) { - return read_hv_clock_msr() - hv_sched_clock_offset; + return (read_hv_clock_msr() - hv_sched_clock_offset) + * (NSEC_PER_SEC / HV_CLOCK_HZ); } static struct clocksource hyperv_cs_msr = { -- 2.14.5

5 years, 7 months

6
6
0 0

[PATCH 5.5 000/119] 5.5.12-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.5.12-rc1 Masahiro Yamada <masahiroy(a)kernel.org> int128: fix __uint128_t compiler test in Kconfig Masahiro Yamada <masahiroy(a)kernel.org> kconfig: introduce m32-flag and m64-flag Johan Hovold <johan(a)kernel.org> staging: greybus: loopback_test: fix potential path truncations Johan Hovold <johan(a)kernel.org> staging: greybus: loopback_test: fix potential path truncation Matt Roper <matthew.d.roper(a)intel.com> drm/i915: Handle all MCR ranges Chris Wilson <chris(a)chris-wilson.co.uk> drm/i915/execlists: Track active elements during dequeue Jernej Skrabec <jernej.skrabec(a)siol.net> drm/bridge: dw-hdmi: fix AVI frame colorimetry Caz Yokoyama <caz.yokoyama(a)intel.com> Revert "drm/i915/tgl: Add extra hdc flush workaround" Filipe Manana <fdmanana(a)suse.com> btrfs: fix removal of raid[56|1c34} incompat flags after removing block group Xiao Yang <yangx.jy(a)cn.fujitsu.com> modpost: Get proper section index by get_secindex() instead of st_shndx Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: set MSG_MORE only if we actually have more to send Cristian Marussi <cristian.marussi(a)arm.com> arm64: smp: fix crash_smp_send_stop() behaviour Cristian Marussi <cristian.marussi(a)arm.com> arm64: smp: fix smp_send_stop() behaviour Dan Carpenter <dan.carpenter(a)oracle.com> thunderbolt: Fix error code in tb_port_is_width_supported() Kai-Heng Feng <kai.heng.feng(a)canonical.com> ALSA: hda/realtek: Fix pop noise on ALC225 Thomas Gleixner <tglx(a)linutronix.de> futex: Unbreak futex hashing Peter Zijlstra <peterz(a)infradead.org> futex: Fix inode life-time issue Pavel Begunkov <asml.silence(a)gmail.com> io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN} Joerg Roedel <jroedel(a)suse.de> x86/mm: split vmalloc_sync_all() Qian Cai <cai(a)lca.pw> page-flags: fix a crash at SetPageError(THP_SWAP) Vlastimil Babka <vbabka(a)suse.cz> mm, slub: prevent kmalloc_node crashes and memory leaks Linus Torvalds <torvalds(a)linux-foundation.org> mm: slub: be more careful about the double cmpxchg of freelist Roman Penyaev <rpenyaev(a)suse.de> epoll: fix possible lost wakeup on epoll_ctl() path Michal Hocko <mhocko(a)suse.com> mm: do not allow MADV_PAGEOUT for CoW pages Baoquan He <bhe(a)redhat.com> mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case Chris Down <chris(a)chrisdown.name> mm, memcg: throttle allocators based on ancestral memory.high Chris Down <chris(a)chrisdown.name> mm, memcg: fix corruption on 64-bit divisor in memory.high throttling Chunguang Xu <brookxu(a)tencent.com> memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event Alexander Shishkin <alexander.shishkin(a)linux.intel.com> stm class: sys-t: Fix the use of time_after() Qiujun Huang <hqjagain(a)gmail.com> drm/lease: fix WARNING in idr_destroy Tom St Denis <tom.stdenis(a)amd.com> drm/amd/amdgpu: Fix GPR read from debugfs (v2) Filipe Manana <fdmanana(a)suse.com> btrfs: fix log context list corruption after rename whiteout error Steven Rostedt (VMware) <rostedt(a)goodmis.org> xhci: Do not open code __print_symbolic() in xhci trace events Vincenzo Frascino <vincenzo.frascino(a)arm.com> arm64: compat: Fix syscall number of compat_clock_getres Corentin Labbe <clabbe(a)baylibre.com> rtc: max8907: add missing select REGMAP_IRQ Jessica Yu <jeyu(a)kernel.org> modpost: move the namespace field in Module.symvers last Alexander Shishkin <alexander.shishkin(a)linux.intel.com> intel_th: pci: Add Elkhart Lake CPU support Alexander Shishkin <alexander.shishkin(a)linux.intel.com> intel_th: Fix user-visible error codes Alexander Shishkin <alexander.shishkin(a)linux.intel.com> intel_th: msu: Fix the unexpected state warning Samuel Thibault <samuel.thibault(a)ens-lyon.org> staging/speakup: fix get_word non-space look-ahead Johan Hovold <johan(a)kernel.org> staging: greybus: loopback_test: fix poll-mask build breakage Michael Straube <straube.linux(a)gmail.com> staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 Nathan Chancellor <natechancellor(a)gmail.com> kbuild: Disable -Wpointer-to-enum-cast Murphy Zhou <jencce.kernel(a)gmail.com> CIFS: fiemap: do not return EINVAL if get nothing Hans de Goede <hdegoede(a)redhat.com> mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012) Hans de Goede <hdegoede(a)redhat.com> mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320 Masahiro Yamada <yamada.masahiro(a)socionext.com> mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier Michał Mirosław <mirq-linux(a)rere.qmqm.pl> mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 Ricky Wu <ricky_wu(a)realtek.com> mmc: rtsx_pci: Fix support for speed-modes that relies on tuning Tomas Novotny <tomas(a)novotny.cz> iio: light: vcnl4000: update sampling periods for vcnl4040 Tomas Novotny <tomas(a)novotny.cz> iio: light: vcnl4000: update sampling periods for vcnl4200 Eugen Hristev <eugen.hristev(a)microchip.com> iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode Olivier Moysan <olivier.moysan(a)st.com> iio: adc: stm32-dfsdm: fix sleep in atomic context Stephan Gerhold <stephan(a)gerhold.net> iio: magnetometer: ak8974: Fix negative raw values in sysfs Alexandru Tachici <alexandru.tachici(a)analog.com> iio: accel: adxl372: Set iio_chan BE Fabrice Gasnier <fabrice.gasnier(a)st.com> iio: trigger: stm32-timer: disable master mode when stopping Wen-chien Jesse Sung <jesse.sung(a)canonical.com> iio: st_sensors: remap SMO8840 to LIS2DH12 Petr Štetiar <ynezz(a)true.cz> iio: chemical: sps30: fix missing triggered buffer dependency Eric Biggers <ebiggers(a)google.com> tty: fix compat TIOCGSERIAL checking wrong function ptr Eric Biggers <ebiggers(a)google.com> tty: fix compat TIOCGSERIAL leaking uninitialized memory Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Avoid plugin buffer overflow Takashi Iwai <tiwai(a)suse.de> ALSA: seq: oss: Fix running status after receiving sysex Takashi Iwai <tiwai(a)suse.de> ALSA: seq: virmidi: Fix running status after receiving sysex Jian-Hong Pan <jian-hong(a)endlessm.com> ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 Jian-Hong Pan <jian-hong(a)endlessm.com> ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 Takashi Iwai <tiwai(a)suse.de> ALSA: line6: Fix endless MIDI read loop Anthony Mallet <anthony.mallet(a)laas.fr> USB: cdc-acm: fix rounding error in TIOCSSERIAL Anthony Mallet <anthony.mallet(a)laas.fr> USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: typec: ucsi: displayport: Fix a potential race during registration Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: typec: ucsi: displayport: Fix NULL pointer dereference Alberto Mattea <alberto(a)mattea.info> usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c Scott Chen <scott(a)labau.com.tw> USB: serial: pl2303: add device-id for HP LD381 Ran Wang <ran.wang_1(a)nxp.com> usb: host: xhci-plat: add a shutdown Peter Chen <peter.chen(a)nxp.com> usb: chipidea: udc: fix sleeping function called from invalid context Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add ME910G1 ECM composition 0x110b Hans de Goede <hdegoede(a)redhat.com> usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters Kai-Heng Feng <kai.heng.feng(a)canonical.com> USB: Disable LPM on WD19's Realtek Hub Sasha Levin <sashal(a)kernel.org> Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present" Christian Brauner <christian.brauner(a)ubuntu.com> binderfs: use refcount for binder control devices too Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix lockup with timeouts Jonathan Neuschäfer <j.neuschaefer(a)gmx.net> parse-maintainers: Mark as executable Tycho Andersen <tycho(a)tycho.ws> riscv: fix seccomp reject syscall code path Dongli Zhang <dongli.zhang(a)oracle.com> xenbus: req->err should be updated before req->state Dongli Zhang <dongli.zhang(a)oracle.com> xenbus: req->body should be updated before req->state Josip Pavic <Josip.Pavic(a)amd.com> drm/amd/display: fix dcc swath size calculations on dcn1 Bhawanpreet Lakha <Bhawanpreet.Lakha(a)amd.com> drm/amd/display: Clear link settings on MST disable connector Yintian Tao <yttao(a)amd.com> drm/amdgpu: clean wptr on wb when gpu recovery Alexandre Ghiti <alex(a)ghiti.fr> riscv: Fix range looking for kernel image memblock Damien Le Moal <damien.lemoal(a)wdc.com> riscv: Force flat memory model with no-mmu Aaro Koskinen <aaro.koskinen(a)nokia.com> spi: spi_register_controller(): free bus id on error paths Olivier Moysan <olivier.moysan(a)st.com> ASoC: stm32: sai: manage rebind issue Vincent Chen <vincent.chen(a)sifive.com> riscv: avoid the PIC offset of static percpu data in module beyond 2G limits Mike Snitzer <snitzer(a)redhat.com> dm integrity: use dm_bio_record and dm_bio_restore Mike Snitzer <snitzer(a)redhat.com> dm bio record: save/restore bi_end_io and bi_integrity Daniel Axtens <dja(a)axtens.net> altera-stapl: altera_get_note: prevent write beyond end of 'key' Stefan Wahren <stefan.wahren(a)i2se.com> ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS Pavel Begunkov <asml.silence(a)gmail.com> io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation luanshi <zhangliguang(a)linux.alibaba.com> drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer Joakim Zhang <qiangqing.zhang(a)nxp.com> drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition Marek Szyprowski <m.szyprowski(a)samsung.com> drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails Marek Szyprowski <m.szyprowski(a)samsung.com> drm/exynos: dsi: fix workaround for the legacy clock name Marek Szyprowski <m.szyprowski(a)samsung.com> drm/exynos: dsi: propagate error value and silence meaningless warning Stefan Wahren <stefan.wahren(a)i2se.com> ARM: dts: bcm283x: Add missing properties to the PWR LED Thommy Jakobsson <thommyj(a)gmail.com> spi/zynqmp: remove entry that causes a cs glitch Evan Green <evgreen(a)chromium.org> spi: pxa2xx: Add CS control clock quirk Kishon Vijay Abraham I <kishon(a)ti.com> ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Steve French <stfrench(a)microsoft.com> cifs: add missing mount option to /proc/mounts Paulo Alcantara (SUSE) <pc(a)cjr.nz> cifs: fix potential mismatch of UNC paths Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc: Include .BTF section Yuji Sasaki <sasakiy(a)chromium.org> spi: qup: call spi_qup_pm_resume_runtime before suspending Grygorii Strashko <grygorii.strashko(a)ti.com> ARM: dts: dra7-l4: mark timer13-16 as pwm capable Grygorii Strashko <grygorii.strashko(a)ti.com> phy: ti: gmii-sel: do not fail in case of gmii Grygorii Strashko <grygorii.strashko(a)ti.com> phy: ti: gmii-sel: fix set of copy-paste errors Sean Paul <seanpaul(a)chromium.org> drm/mediatek: Ensure the cursor plane is on top of other overlays Evan Benn <evanbenn(a)chromium.org> drm/mediatek: Find the cursor plane instead of hard coding it Vignesh Raghavendra <vigneshr(a)ti.com> spi: spi-omap2-mcspi: Support probe deferral for DMA channels Linus Torvalds <torvalds(a)linux-foundation.org> locks: reinstate locks_delete_block optimization yangerkun <yangerkun(a)huawei.com> locks: fix a potential use-after-free problem when wakeup a waiter ------------- Diffstat: Documentation/kbuild/modules.rst | 4 +- Makefile | 4 +- arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 + arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts | 2 + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 + arch/arm/boot/dts/dra7-l4.dtsi | 4 + arch/arm/boot/dts/dra7.dtsi | 2 + arch/arm/configs/bcm2835_defconfig | 1 + arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/kernel/smp.c | 25 ++++- arch/powerpc/kernel/vmlinux.lds.S | 6 ++ arch/riscv/Kconfig | 1 + arch/riscv/include/asm/syscall.h | 7 -- arch/riscv/kernel/entry.S | 11 +-- arch/riscv/kernel/module.c | 16 ++++ arch/riscv/kernel/ptrace.c | 11 +-- arch/riscv/mm/init.c | 2 +- arch/x86/mm/fault.c | 26 +++++- drivers/acpi/apei/ghes.c | 2 +- drivers/android/binderfs.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++++---- drivers/gpu/drm/drm_client_modeset.c | 72 -------------- drivers/gpu/drm/drm_lease.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 ++- drivers/gpu/drm/exynos/exynos_hdmi.c | 22 +++-- drivers/gpu/drm/i915/gt/intel_lrc.c | 52 +++-------- drivers/gpu/drm/i915/gt/intel_workarounds.c | 25 ++++- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 26 ++++-- drivers/hwtracing/intel_th/msu.c | 13 +-- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/p_sys-t.c | 6 +- drivers/iio/accel/adxl372.c | 1 + drivers/iio/accel/st_accel_i2c.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 15 +++ drivers/iio/adc/stm32-dfsdm-adc.c | 43 ++------- drivers/iio/chemical/Kconfig | 2 + drivers/iio/light/vcnl4000.c | 15 +-- drivers/iio/magnetometer/ak8974.c | 2 +- drivers/iio/trigger/stm32-timer-trigger.c | 11 ++- drivers/md/dm-bio-record.h | 15 +++ drivers/md/dm-integrity.c | 32 ++----- drivers/misc/altera-stapl/altera.c | 12 +-- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5249.c | 2 + drivers/misc/cardreader/rts5260.c | 2 +- drivers/misc/cardreader/rts5261.c | 2 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 13 ++- drivers/mmc/host/sdhci-acpi.c | 84 ++++++++++++++++- drivers/mmc/host/sdhci-cadence.c | 18 +++- drivers/mmc/host/sdhci-of-at91.c | 8 +- drivers/nvme/target/tcp.c | 12 ++- drivers/perf/arm_pmu_acpi.c | 7 +- drivers/perf/fsl_imx8_ddr_perf.c | 10 +- drivers/phy/ti/phy-gmii-sel.c | 10 +- drivers/rtc/Kconfig | 1 + drivers/spi/spi-omap2-mcspi.c | 77 ++++++++------- drivers/spi/spi-pxa2xx.c | 23 +++++ drivers/spi/spi-qup.c | 11 ++- drivers/spi/spi-zynqmp-gqspi.c | 3 - drivers/spi/spi.c | 32 +++---- drivers/staging/greybus/tools/loopback_test.c | 21 +++-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/speakup/main.c | 2 +- drivers/thunderbolt/switch.c | 2 +- drivers/tty/tty_io.c | 6 +- drivers/usb/chipidea/udc.c | 7 +- drivers/usb/class/cdc-acm.c | 34 ++++--- drivers/usb/core/quirks.c | 6 ++ drivers/usb/host/xhci-pci.c | 3 +- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/host/xhci-trace.h | 23 ++--- drivers/usb/serial/option.c | 2 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/typec/ucsi/displayport.c | 12 ++- drivers/xen/xenbus/xenbus_comms.c | 4 + drivers/xen/xenbus/xenbus_xs.c | 9 +- fs/btrfs/block-group.c | 4 +- fs/btrfs/inode.c | 4 + fs/cifs/cifs_dfs_ref.c | 2 + fs/cifs/cifsfs.c | 2 + fs/cifs/file.c | 3 +- fs/cifs/smb2ops.c | 2 +- fs/eventpoll.c | 8 +- fs/inode.c | 1 + fs/io-wq.c | 20 ++-- fs/io_uring.c | 9 ++ fs/locks.c | 60 ++++++++---- include/linux/fs.h | 1 + include/linux/futex.h | 17 ++-- include/linux/page-flags.h | 2 +- include/linux/vmalloc.h | 5 +- init/Kconfig | 3 +- kernel/futex.c | 93 +++++++++++-------- kernel/notifier.c | 2 +- mm/madvise.c | 12 ++- mm/memcontrol.c | 103 +++++++++++++-------- mm/nommu.c | 10 +- mm/slub.c | 32 ++++--- mm/sparse.c | 8 +- mm/vmalloc.c | 11 ++- scripts/Kconfig.include | 7 ++ scripts/Makefile.extrawarn | 1 + scripts/export_report.pl | 2 +- scripts/mod/modpost.c | 27 +++--- scripts/parse-maintainers.pl | 0 sound/core/oss/pcm_plugin.c | 12 ++- sound/core/seq/oss/seq_oss_midi.c | 1 + sound/core/seq/seq_virmidi.c | 1 + sound/pci/hda/patch_realtek.c | 25 +++++ sound/soc/stm/stm32_sai_sub.c | 18 ++-- sound/usb/line6/driver.c | 2 +- sound/usb/line6/midibuf.c | 2 +- 118 files changed, 945 insertions(+), 595 deletions(-)

5 years, 7 months

4
125
0 0

[PATCH 5.5 000/189] 5.5.9-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.5.9 release. There are 189 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 12 Mar 2020 12:34:10 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.9-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.5.9-rc1 Aaro Koskinen <aaro.koskinen(a)nokia.com> net: stmmac: fix notifier registration Jason A. Donenfeld <Jason(a)zx2c4.com> efi: READ_ONCE rng seed size before munmap Ard Biesheuvel <ardb(a)kernel.org> efi/x86: Handle by-ref arguments covering multiple pages in mixed mode Ard Biesheuvel <ardb(a)kernel.org> efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper Desnes A. Nunes do Rosario <desnesn(a)linux.ibm.com> powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems Sherry Sun <sherry.sun(a)nxp.com> EDAC/synopsys: Do not print an error with back-to-back snprintf() calls Sébastien Szymanski <sebastien.szymanski(a)armadeus.com> dt-bindings: arm: fsl: fix APF6Dev compatible Tony Lindgren <tony(a)atomide.com> bus: ti-sysc: Fix 1-wire reset quirk Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson: fix gxm-khadas-vim2 wifi Vincent Guittot <vincent.guittot(a)linaro.org> sched/fair: Fix statistics for find_idlest_group() Dan Carpenter <dan.carpenter(a)oracle.com> dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() Cong Wang <xiyou.wangcong(a)gmail.com> dma-buf: free dmabuf->name in dma_buf_release() Dan Carpenter <dan.carpenter(a)oracle.com> hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() Oleksandr Suvorov <oleksandr.suvorov(a)toradex.com> ARM: dts: imx7-colibri: Fix frequency for sd/mmc Johan Hovold <johan(a)kernel.org> ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties Suman Anna <s-anna(a)ti.com> ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source Suman Anna <s-anna(a)ti.com> ARM: dts: am437x-idk-evm: Fix incorrect OPP node names Peng Fan <peng.fan(a)nxp.com> ARM: dts: imx7d: fix opp-supported-hw Ahmad Fatoum <a.fatoum(a)pengutronix.de> ARM: imx: build v7_cpu_resume() unconditionally Dennis Dalessandro <dennis.dalessandro(a)intel.com> IB/hfi1, qib: Ensure RCU is locked when accessing list Artemy Kovalyov <artemyko(a)mellanox.com> IB/mlx5: Fix implicit ODP race Jason Gunthorpe <jgg(a)ziepe.ca> RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() Petr Vorel <petr.vorel(a)gmail.com> regulator: qcom_spmi: Fix docs for PM8004 Fabrice Gasnier <fabrice.gasnier(a)st.com> regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling Maor Gottlieb <maorg(a)mellanox.com> RDMA/core: Fix protection fault in ib_mr_pool_destroy Bernard Metzler <bmt(a)zurich.ibm.com> RDMA/iwcm: Fix iwcm work deallocation Bernard Metzler <bmt(a)zurich.ibm.com> RDMA/siw: Fix failure handling during device creation Mark Zhang <markz(a)mellanox.com> RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/odp: Ensure the mm is still alive before creating an implicit child Max Gurtovoy <maxg(a)mellanox.com> RDMA/rw: Fix error flow during RDMA context initialization Parav Pandit <parav(a)mellanox.com> Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" Leonard Crestez <leonard.crestez(a)nxp.com> soc: imx-scu: Align imx sc msg structs to 4 Leonard Crestez <leonard.crestez(a)nxp.com> firmware: imx: Align imx_sc_msg_req_cpu_start to 4 Leonard Crestez <leonard.crestez(a)nxp.com> firmware: imx: scu-pd: Align imx sc msg structs to 4 Leonard Crestez <leonard.crestez(a)nxp.com> firmware: imx: misc: Align imx sc msg structs to 4 Fabio Estevam <festevam(a)gmail.com> arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY Marco Felsch <m.felsch(a)pengutronix.de> ARM: dts: imx6: phycore-som: fix emmc supply Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling Chris Wilson <chris(a)chris-wilson.co.uk> drm/i915/perf: Reintroduce wait on OA configuration completion Dan Carpenter <dan.carpenter(a)oracle.com> drm/i915/selftests: Fix return in assert_mmap_offset() Matt Roper <matthew.d.roper(a)intel.com> drm/i915: Program MBUS with rmw during initialization Jernej Skrabec <jernej.skrabec(a)siol.net> drm/sun4i: de2/de3: Remove unsupported VI layer formats Jernej Skrabec <jernej.skrabec(a)siol.net> drm/sun4i: Fix DE2 VI layer format support Jernej Skrabec <jernej.skrabec(a)siol.net> drm/sun4i: Add separate DE3 VI layer formats John Stultz <john.stultz(a)linaro.org> drm: kirin: Revert "Fix for hikey620 display offset problem" Ahzo <Ahzo(a)tutanota.com> drm/ttm: fix leaking fences via ttm_buffer_object_transfer Phong LE <ple(a)baylibre.com> drm/mediatek: Handle component type MTK_DISP_OVL_2L correctly Tomeu Vizoso <tomeu.vizoso(a)collabora.com> drm/panfrost: Don't try to map on error faults Tudor Ambarus <tudor.ambarus(a)microchip.com> spi: atmel-quadspi: fix possible MMIO window size overrun Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop() Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: dapm: Correct DAPM handling of active widgets during shutdown Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> ASoC: Intel: Skylake: Fix available clock counter incrementation Matthias Reichl <hias(a)horus.com> ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path Takashi Iwai <tiwai(a)suse.de> ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output Takashi Iwai <tiwai(a)suse.de> ASoC: intel: skl: Fix possible buffer overflow in debug outputs Takashi Iwai <tiwai(a)suse.de> ASoC: intel: skl: Fix pin debug prints Dan Carpenter <dan.carpenter(a)oracle.com> ASoC: SOF: Fix snd_sof_ipc_stream_posn() Dragos Tarcatu <dragos_tarcatu(a)mentor.com> ASoC: topology: Fix memleak in soc_tplg_manifest_load() Dragos Tarcatu <dragos_tarcatu(a)mentor.com> ASoC: topology: Fix memleak in soc_tplg_link_elems_load() John Bates <jbates(a)chromium.org> drm/virtio: fix resource id creation race Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> spi: bcm63xx-hsspi: Really keep pll clk enabled Vladimir Oltean <olteanv(a)gmail.com> ARM: dts: ls1021a: Restore MDIO compatible to gianfar Guillaume La Roque <glaroque(a)baylibre.com> arm64: dts: meson-sm1-sei610: add missing interrupt-names Hou Tao <houtao1(a)huawei.com> dm: fix congested_fn for request-based device Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> dm zoned: Fix reference counter initial value of chunk works Mikulas Patocka <mpatocka(a)redhat.com> dm writecache: verify watermark during resume Mikulas Patocka <mpatocka(a)redhat.com> dm: report suspended device during destroy Mikulas Patocka <mpatocka(a)redhat.com> dm cache: fix a crash due to incorrect work item cancelling Mikulas Patocka <mpatocka(a)redhat.com> dm integrity: fix invalid table returned due to argument count mismatch Mikulas Patocka <mpatocka(a)redhat.com> dm integrity: fix a deadlock due to offloading to an incorrect workqueue Mikulas Patocka <mpatocka(a)redhat.com> dm integrity: fix recalculation when moving from journal mode to bitmap mode Dmitry Osipenko <digetx(a)gmail.com> dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list Dmitry Osipenko <digetx(a)gmail.com> dmaengine: tegra-apb: Fix use-after-free Frieder Schrempf <frieder.schrempf(a)kontron.de> dmaengine: imx-sdma: Fix the event id check to include RX event for UART6 Martin Fuzzey <martin.fuzzey(a)flowbird.group> dmaengine: imx-sdma: fix context cache Prike Liang <Prike.Liang(a)amd.com> drm/amd/powerplay: fix pre-check condition for setting clock range Tianci.Yin <tianci.yin(a)amd.com> drm/amdgpu: disable 3D pipe 1 on Navi1x Gerd Hoffmann <kraxel(a)redhat.com> drm/shmem: add support for per object caching flags. Gerd Hoffmann <kraxel(a)redhat.com> drm/virtio: fix mmap page attributes Michael Ellerman <mpe(a)ellerman.id.au> powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() Christophe Leroy <christophe.leroy(a)c-s.fr> selftests: pidfd: Add pidfd_fdinfo_test in .gitignore Gerald Schaefer <gerald.schaefer(a)de.ibm.com> s390/mm: fix panic in gup_fast on large pud Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix unexpected write combine on resource Sean Christopherson <sean.j.christopherson(a)intel.com> x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes Juergen Gross <jgross(a)suse.com> x86/ioperm: Add new paravirt function update_io_bitmap() Lukas Wunner <lukas(a)wunner.de> spi: spidev: Fix CS polarity if GPIO descriptors are used Adrian Hunter <adrian.hunter(a)intel.com> perf arm-spe: Fix endless record after being terminated Wei Li <liwei391(a)huawei.com> perf cs-etm: Fix endless record after being terminated Wei Li <liwei391(a)huawei.com> perf intel-bts: Fix endless record after being terminated Wei Li <liwei391(a)huawei.com> perf intel-pt: Fix endless record after being terminated Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: v4l2-mem2mem.c: fix broken links Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vicodec: process all 4 components for RGB32 formats Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: mc-entity.c: use & to check pad flags, not == Ezequiel Garcia <ezequiel(a)collabora.com> media: hantro: Fix broken media controller links Jiri Slaby <jslaby(a)suse.cz> vt: selection, push sel_lock up Jiri Slaby <jslaby(a)suse.cz> vt: selection, push console lock down Jiri Slaby <jslaby(a)suse.cz> vt: selection, close sel_buffer race Ronald Tschalär <ronald(a)innovation.ch> serdev: Fix detection of UART devices on Apple machines. Jay Dolan <jay.dolan(a)accesio.com> serial: 8250_exar: add support for ACCES cards Michael Walle <michael(a)walle.cc> tty: serial: fsl_lpuart: free IDs allocated by IDA tangbin <tangbin(a)cmss.chinamobile.com> tty:serial:mvebu-uart:fix a wrong return Rikard Falkeborn <rikard.falkeborn(a)gmail.com> phy: allwinner: Fix GENMASK misuse Faiz Abbas <faiz_abbas(a)ti.com> arm: dts: dra76x: Fix mmc3 max-frequency Ley Foon Tan <ley.foon.tan(a)intel.com> arm64: dts: socfpga: agilex: Fix gmac compatible Omar Sandoval <osandov(a)fb.com> btrfs: fix RAID direct I/O reads with alternate csums OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> fat: fix uninit-memory access for partial initialized inode Vlastimil Babka <vbabka(a)suse.cz> mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled Kirill A. Shutemov <kirill(a)shutemov.name> mm: avoid data corruption on CoW fault into PFN-mapped VMA Huang Ying <ying.huang(a)intel.com> mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() Mel Gorman <mgorman(a)techsingularity.net> mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> vgacon: Fix a UAF in vgacon_invert_region Eugeniu Rosca <erosca(a)de.adit-jv.com> usb: core: port: do error out if usb_autopm_get_interface() fails Eugeniu Rosca <erosca(a)de.adit-jv.com> usb: core: hub: do error out if usb_autopm_get_interface() fails Eugeniu Rosca <erosca(a)de.adit-jv.com> usb: core: hub: fix unhandled return by employing a void function Peter Chen <peter.chen(a)nxp.com> usb: cdns3: gadget: toggle cycle bit before reset endpoint Peter Chen <peter.chen(a)nxp.com> usb: cdns3: gadget: link trb should point to next request Pratham Pratap <prathampratap(a)codeaurora.org> usb: dwc3: gadget: Update chain bit correctly when using sg list Dan Lazewatsky <dlaz(a)chromium.org> usb: quirks: add NO_LPM quirk for Logitech Screen Share Marco Felsch <m.felsch(a)pengutronix.de> usb: usb251xb: fix regulator probe and error handling Jim Lin <jilin(a)nvidia.com> usb: storage: Add quirk for Samsung Fit flash Aurelien Aptel <aaptel(a)suse.com> cifs: fix rename() by ensuring source handle opened with DELETE bit Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: don't leak -EAGAIN for stat() during reconnect Saravana Kannan <saravanak(a)google.com> driver core: Call sync_state() even if supplier has no consumers Jian-Hong Pan <jian-hong(a)endlessm.com> ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 Christian Lachner <gladiac(a)gmail.com> ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Add Headset Mic supported Christian Brauner <christian.brauner(a)ubuntu.com> binder: prevent UAF for binderfs devices II Christian Brauner <christian.brauner(a)ubuntu.com> binder: prevent UAF for binderfs devices Leonard Crestez <leonard.crestez(a)nxp.com> firmware: imx: scu: Ensure sequential TX Hangbin Liu <liuhangbin(a)gmail.com> selftests: forwarding: vxlan_bridge_1d: use more proper tos value Randy Dunlap <rdunlap(a)infradead.org> arch/csky: fix some Kconfig typos Guo Ren <guoren(a)linux.alibaba.com> csky: Fixup compile warning for three unimplemented syscalls Guo Ren <guoren(a)linux.alibaba.com> csky: Fixup ftrace modify panic Guo Ren <guoren(a)linux.alibaba.com> csky/smp: Fixup boot failed when CONFIG_SMP Guo Ren <guoren(a)linux.alibaba.com> csky: Set regs->usp to kernel sp, when the exception is from kernel Guo Ren <guoren(a)linux.alibaba.com> csky/mm: Fixup export invalid_pte_table symbol Tim Harvey <tharvey(a)gateworks.com> net: thunderx: workaround BGX TX Underflow issue Kees Cook <keescook(a)chromium.org> x86/xen: Distribute switch variables for initialization Michal Swiatkowski <michal.swiatkowski(a)intel.com> ice: Don't tell the OS that link is going down Keith Busch <kbusch(a)kernel.org> nvme: Fix uninitialized-variable warning Julian Wiedmann <jwi(a)linux.ibm.com> s390/qdio: fill SL with absolute addresses H.J. Lu <hjl.tools(a)gmail.com> x86/boot/compressed: Don't declare __force_order in kaslr_64.c Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nvme-pci: Use single IRQ vector for old Apple models Shyjumon N <shyjumon.n(a)intel.com> nvme/pci: Add sleep quirk for Samsung and Toshiba drives Kai-Heng Feng <kai.heng.feng(a)canonical.com> iommu/amd: Disable IOMMU on Stoney Ridge systems Hamdan Igbaria <hamdani(a)mellanox.com> net/mlx5: DR, Fix matching on vport gvmi Javier Martinez Canillas <javierm(a)redhat.com> efi: Only print errors about failing to get certs if EFI vars are found Masahiro Yamada <masahiroy(a)kernel.org> s390: make 'install' not depend on vmlinux Vasily Averin <vvs(a)virtuozzo.com> s390/cio: cio_ignore_proc_seq_next should increase position index Marco Felsch <m.felsch(a)pengutronix.de> watchdog: da9062: do not ping the hw during stop() Paul Cercueil <paul(a)crapouillou.net> net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt() Marek Vasut <marex(a)denx.de> net: ks8851-ml: Fix 16-bit IO operation Marek Vasut <marex(a)denx.de> net: ks8851-ml: Fix 16-bit data access Marek Vasut <marex(a)denx.de> net: ks8851-ml: Remove 8-bit bus accessors Egor Pomozov <epomozov(a)marvell.com> net: atlantic: ptp gpio adjustments Igor Russkikh <irusskikh(a)marvell.com> net: atlantic: check rpc result and wait for rpc address Hangbin Liu <liuhangbin(a)gmail.com> selftests: forwarding: vxlan_bridge_1d: fix tos value Hangbin Liu <liuhangbin(a)gmail.com> selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing Harigovindan P <harigovi(a)codeaurora.org> drm/msm/dsi/pll: call vco set rate explicitly Harigovindan P <harigovi(a)codeaurora.org> drm/msm/dsi: save pll state before dsi host is powered off Tomas Henzl <thenzl(a)redhat.com> scsi: megaraid_sas: silence a warning Stephan Gerhold <stephan(a)gerhold.net> drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters Stephan Gerhold <stephan(a)gerhold.net> drm/modes: Make sure to parse valid rotation value from cmdline John Stultz <john.stultz(a)linaro.org> drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI Brian Masney <masneyb(a)onstation.org> drm/msm/mdp5: rate limit pp done timeout warnings Oded Gabbay <oded.gabbay(a)gmail.com> habanalabs: patched cb equals user cb in device memset Omer Shpigelman <oshpigelman(a)habana.ai> habanalabs: do not halt CoreSight during hard reset Oded Gabbay <oded.gabbay(a)gmail.com> habanalabs: halt the engines before hard-reset Sergey Organov <sorganov(a)gmail.com> usb: gadget: serial: fix Tx stall after buffer overflow Lars-Peter Clausen <lars(a)metafoo.de> usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags Jack Pham <jackp(a)codeaurora.org> usb: gadget: composite: Support more than 500mA MaxPower Jiri Benc <jbenc(a)redhat.com> selftests: fix too long argument Nikita Sobolev <Nikita.Sobolev(a)synopsys.com> Kernel selftests: tpm2: check for tpm support Daniel Golle <daniel(a)makrotopia.org> serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: do not override bus codec_mask in link_get() Cong Wang <xiyou.wangcong(a)gmail.com> netfilter: xt_hashlimit: unregister proc file before releasing mutex Florian Westphal <fw(a)strlen.de> netfilter: hashlimit: do not use indirect calls during gc Cengiz Can <cengiz(a)kernel.wtf> blktrace: fix dereference after null check Nathan Chancellor <natechancellor(a)gmail.com> RDMA/core: Fix use of logical OR in get_new_pps Maor Gottlieb <maorg(a)mellanox.com> RDMA/core: Fix pkey and port assignment in get_new_pps Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec Theodore Ts'o <tytso(a)mit.edu> dm thin metadata: fix lockdep complaint Paolo Valente <paolo.valente(a)linaro.org> block, bfq: do not insert oom queue into position tree Paolo Valente <paolo.valente(a)linaro.org> block, bfq: get extra ref to prevent a queue from being freed during a group move Paolo Valente <paolo.valente(a)linaro.org> block, bfq: get a ref to a group when adding it to a service tree Jaroslav Kysela <perex(a)perex.cz> ASoC: intel/skl/hda - export number of digital microphones via control components ------------- Diffstat: Documentation/devicetree/bindings/arm/fsl.yaml | 2 +- .../bindings/regulator/qcom,spmi-regulator.txt | 2 +- Makefile | 4 +- arch/arm/boot/dts/am437x-idk-evm.dts | 4 +- arch/arm/boot/dts/dra76x.dtsi | 5 + arch/arm/boot/dts/dra7xx-clocks.dtsi | 12 +-- arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts | 4 +- arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi | 1 - arch/arm/boot/dts/imx7-colibri.dtsi | 1 - arch/arm/boot/dts/imx7d.dtsi | 6 +- arch/arm/boot/dts/ls1021a.dtsi | 4 +- arch/arm/mach-imx/Makefile | 2 + arch/arm/mach-imx/common.h | 4 +- arch/arm/mach-imx/resume-imx6.S | 24 +++++ arch/arm/mach-imx/suspend-imx6.S | 14 --- .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 1 + arch/arm64/boot/dts/freescale/imx8qxp-mek.dts | 5 - arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 6 +- arch/csky/Kconfig | 2 +- arch/csky/abiv1/inc/abi/entry.h | 19 +++- arch/csky/abiv2/inc/abi/entry.h | 11 +++ arch/csky/include/uapi/asm/unistd.h | 3 + arch/csky/kernel/atomic.S | 8 +- arch/csky/kernel/smp.c | 2 +- arch/csky/mm/Makefile | 2 + arch/csky/mm/init.c | 1 + arch/powerpc/kernel/cputable.c | 4 +- arch/powerpc/mm/mem.c | 2 + arch/s390/Makefile | 2 +- arch/s390/boot/Makefile | 2 +- arch/s390/include/asm/pgtable.h | 6 ++ arch/s390/include/asm/qdio.h | 2 +- arch/s390/pci/pci.c | 4 +- arch/x86/boot/compressed/kaslr_64.c | 3 - arch/x86/include/asm/io_bitmap.h | 9 +- arch/x86/include/asm/paravirt.h | 7 ++ arch/x86/include/asm/paravirt_types.h | 4 + arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/paravirt.c | 5 + arch/x86/kernel/process.c | 2 +- arch/x86/platform/efi/efi_64.c | 70 +++++++++----- arch/x86/xen/enlighten_pv.c | 32 ++++++- block/bfq-cgroup.c | 10 +- block/bfq-iosched.c | 4 + block/bfq-iosched.h | 1 + block/bfq-wf2q.c | 12 ++- drivers/android/binder.c | 9 ++ drivers/android/binder_internal.h | 2 + drivers/android/binderfs.c | 7 +- drivers/base/core.c | 23 +++-- drivers/bus/ti-sysc.c | 4 +- drivers/dma-buf/dma-buf.c | 1 + drivers/dma/coh901318.c | 4 - drivers/dma/imx-sdma.c | 5 +- drivers/dma/tegra20-apb-dma.c | 6 +- drivers/edac/synopsys_edac.c | 22 ++--- drivers/firmware/efi/efi.c | 4 +- drivers/firmware/imx/imx-scu.c | 27 ++++++ drivers/firmware/imx/misc.c | 8 +- drivers/firmware/imx/scu-pd.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 97 ++++++++++--------- drivers/gpu/drm/amd/powerplay/amdgpu_smu.c | 2 +- drivers/gpu/drm/amd/powerplay/smu_v12_0.c | 3 - drivers/gpu/drm/drm_client_modeset.c | 3 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 15 ++- drivers/gpu/drm/drm_modes.c | 7 ++ drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h | 1 - drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 20 ---- drivers/gpu/drm/i915/display/intel_display_power.c | 16 +++- drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c | 2 +- drivers/gpu/drm/i915/i915_perf.c | 58 ++++++++---- drivers/gpu/drm/i915/i915_perf_types.h | 3 +- drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 1 + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 7 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 - drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 6 ++ drivers/gpu/drm/panfrost/panfrost_mmu.c | 44 ++++----- drivers/gpu/drm/selftests/drm_cmdline_selftests.h | 1 + .../gpu/drm/selftests/test-drm_cmdline_parser.c | 15 ++- drivers/gpu/drm/sun4i/sun8i_mixer.c | 104 ++++++++++++++++++--- drivers/gpu/drm/sun4i/sun8i_mixer.h | 11 +++ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 66 +++++++++++-- drivers/gpu/drm/ttm/ttm_bo_util.c | 1 + drivers/gpu/drm/virtio/virtgpu_object.c | 5 +- drivers/hwmon/adt7462.c | 2 +- drivers/infiniband/core/cm.c | 1 + drivers/infiniband/core/cma.c | 15 ++- drivers/infiniband/core/core_priv.h | 15 +++ drivers/infiniband/core/iwcm.c | 4 +- drivers/infiniband/core/nldev.c | 2 + drivers/infiniband/core/rw.c | 31 +++--- drivers/infiniband/core/security.c | 14 ++- drivers/infiniband/core/umem_odp.c | 24 ++++- drivers/infiniband/core/uverbs_cmd.c | 10 -- drivers/infiniband/core/verbs.c | 10 -- drivers/infiniband/hw/hfi1/verbs.c | 4 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/odp.c | 17 ++-- drivers/infiniband/hw/qib/qib_verbs.c | 2 + drivers/infiniband/sw/siw/siw_main.c | 6 +- drivers/iommu/amd_iommu_init.c | 13 ++- drivers/md/dm-cache-target.c | 4 +- drivers/md/dm-integrity.c | 50 ++++++---- drivers/md/dm-thin-metadata.c | 2 +- drivers/md/dm-writecache.c | 14 ++- drivers/md/dm-zoned-target.c | 8 +- drivers/md/dm.c | 22 ++--- drivers/media/mc/mc-entity.c | 4 +- drivers/media/platform/vicodec/codec-v4l2-fwht.c | 34 ++----- drivers/media/v4l2-core/v4l2-mem2mem.c | 4 +- drivers/misc/habanalabs/device.c | 5 +- drivers/misc/habanalabs/goya/goya.c | 44 ++++++++- drivers/net/dsa/bcm_sf2.c | 3 +- drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 + .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 +- .../aquantia/atlantic/hw_atl/hw_atl_utils.c | 19 +++- .../aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c | 12 +++ drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 62 +++++++++++- drivers/net/ethernet/cavium/thunder/thunder_bgx.h | 9 ++ drivers/net/ethernet/davicom/dm9000.c | 2 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 7 -- .../ethernet/mellanox/mlx5/core/steering/dr_ste.c | 5 +- drivers/net/ethernet/micrel/ks8851_mll.c | 53 ++--------- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 ++- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 15 ++- drivers/phy/allwinner/phy-sun50i-usb3.c | 2 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 27 +++++- drivers/regulator/stm32-vrefbuf.c | 3 +- drivers/s390/cio/blacklist.c | 5 +- drivers/s390/cio/qdio_setup.c | 3 +- drivers/s390/net/qeth_core_main.c | 23 +++-- drivers/scsi/megaraid/megaraid_sas_fusion.c | 5 +- drivers/soc/imx/soc-imx-scu.c | 2 +- drivers/spi/atmel-quadspi.c | 11 +++ drivers/spi/spi-bcm63xx-hsspi.c | 1 - drivers/spi/spidev.c | 5 + drivers/staging/media/hantro/hantro_drv.c | 4 +- drivers/staging/speakup/selection.c | 2 - drivers/tty/serdev/core.c | 10 ++ drivers/tty/serial/8250/8250_exar.c | 33 +++++++ drivers/tty/serial/ar933x_uart.c | 8 ++ drivers/tty/serial/fsl_lpuart.c | 39 +++++--- drivers/tty/serial/mvebu-uart.c | 2 +- drivers/tty/vt/selection.c | 26 +++++- drivers/tty/vt/vt.c | 2 - drivers/usb/cdns3/gadget.c | 19 +++- drivers/usb/core/hub.c | 8 +- drivers/usb/core/port.c | 10 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 9 +- drivers/usb/gadget/composite.c | 24 +++-- drivers/usb/gadget/function/f_fs.c | 5 +- drivers/usb/gadget/function/u_serial.c | 4 +- drivers/usb/misc/usb251xb.c | 20 +++- drivers/usb/storage/unusual_devs.h | 6 ++ drivers/video/console/vgacon.c | 3 + drivers/watchdog/da9062_wdt.c | 7 -- fs/btrfs/inode.c | 4 +- fs/cifs/cifsglob.h | 7 ++ fs/cifs/cifsproto.h | 5 +- fs/cifs/cifssmb.c | 3 +- fs/cifs/file.c | 19 ++-- fs/cifs/inode.c | 12 ++- fs/cifs/smb1ops.c | 2 +- fs/cifs/smb2inode.c | 4 +- fs/cifs/smb2ops.c | 3 +- fs/cifs/smb2pdu.c | 1 + fs/fat/inode.c | 19 ++-- include/drm/drm_gem_shmem_helper.h | 5 + include/linux/mm.h | 4 + kernel/sched/fair.c | 2 + kernel/trace/blktrace.c | 5 +- mm/huge_memory.c | 3 +- mm/memory.c | 35 +++++-- mm/memory_hotplug.c | 8 +- mm/mprotect.c | 38 +++++++- net/netfilter/xt_hashlimit.c | 36 ++----- security/integrity/platform_certs/load_uefi.c | 40 +++++--- sound/hda/ext/hdac_ext_controller.c | 9 +- sound/pci/hda/patch_realtek.c | 31 +++++- sound/soc/codecs/pcm512x.c | 8 +- sound/soc/intel/boards/skl_hda_dsp_generic.c | 8 ++ sound/soc/intel/skylake/skl-debug.c | 32 ++++--- sound/soc/intel/skylake/skl-ssp-clk.c | 4 +- sound/soc/soc-component.c | 2 +- sound/soc/soc-dapm.c | 2 +- sound/soc/soc-pcm.c | 16 ++-- sound/soc/soc-topology.c | 17 ++-- sound/soc/sof/intel/hda.c | 3 +- sound/soc/sof/ipc.c | 2 +- tools/perf/arch/arm/util/cs-etm.c | 5 +- tools/perf/arch/arm64/util/arm-spe.c | 5 +- tools/perf/arch/x86/util/intel-bts.c | 5 +- tools/perf/arch/x86/util/intel-pt.c | 5 +- tools/testing/selftests/lib.mk | 23 +++-- .../testing/selftests/net/forwarding/mirror_gre.sh | 25 ++--- .../selftests/net/forwarding/vxlan_bridge_1d.sh | 6 +- tools/testing/selftests/pidfd/.gitignore | 1 + tools/testing/selftests/tpm2/test_smoke.sh | 13 ++- tools/testing/selftests/tpm2/test_space.sh | 9 +- 203 files changed, 1602 insertions(+), 739 deletions(-)

5 years, 7 months

7
205
0 0

Linux 5.5.13

by Greg KH

I'm announcing the release of the 5.5.13 kernel. All users of the 5.5 kernel series must upgrade. The updated 5.5.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.5.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 +- drivers/base/core.c | 4 +++- include/linux/device.h | 11 +++++++++++ 3 files changed, 15 insertions(+), 2 deletions(-) Greg Kroah-Hartman (1): Linux 5.5.13 Saravana Kannan (2): driver core: Add dev_has_sync_state() driver core: Skip unnecessary work when device doesn't have sync_state()

5 years, 7 months

1
1
0 0

Linux 5.5.12

by Greg KH

I'm announcing the release of the 5.5.12 kernel. All users of the 5.5 kernel series must upgrade. The updated 5.5.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.5.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/kbuild/modules.rst | 4 Makefile | 2 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts | 2 arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 arch/arm/boot/dts/dra7-l4.dtsi | 4 arch/arm/boot/dts/dra7.dtsi | 2 arch/arm/configs/bcm2835_defconfig | 1 arch/arm64/include/asm/unistd.h | 2 arch/arm64/kernel/smp.c | 25 ++ arch/powerpc/kernel/vmlinux.lds.S | 6 arch/riscv/Kconfig | 1 arch/riscv/include/asm/syscall.h | 7 arch/riscv/kernel/entry.S | 11 - arch/riscv/kernel/module.c | 16 + arch/riscv/kernel/ptrace.c | 11 - arch/riscv/mm/init.c | 2 arch/x86/mm/fault.c | 26 ++- drivers/acpi/apei/ghes.c | 2 drivers/android/binderfs.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++-- drivers/gpu/drm/drm_client_modeset.c | 72 -------- drivers/gpu/drm/drm_lease.c | 3 drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 - drivers/gpu/drm/exynos/exynos_hdmi.c | 22 +- drivers/gpu/drm/i915/gt/intel_lrc.c | 52 +----- drivers/gpu/drm/i915/gt/intel_workarounds.c | 25 ++ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 26 +-- drivers/hwtracing/intel_th/msu.c | 13 - drivers/hwtracing/intel_th/pci.c | 5 drivers/hwtracing/stm/p_sys-t.c | 6 drivers/iio/accel/adxl372.c | 1 drivers/iio/accel/st_accel_i2c.c | 2 drivers/iio/adc/at91-sama5d2_adc.c | 15 + drivers/iio/adc/stm32-dfsdm-adc.c | 43 +---- drivers/iio/chemical/Kconfig | 2 drivers/iio/light/vcnl4000.c | 15 - drivers/iio/magnetometer/ak8974.c | 2 drivers/iio/trigger/stm32-timer-trigger.c | 11 + drivers/md/dm-bio-record.h | 15 + drivers/md/dm-integrity.c | 32 +-- drivers/misc/altera-stapl/altera.c | 12 - drivers/misc/cardreader/rts5227.c | 2 drivers/misc/cardreader/rts5249.c | 2 drivers/misc/cardreader/rts5260.c | 2 drivers/misc/cardreader/rts5261.c | 2 drivers/mmc/host/rtsx_pci_sdmmc.c | 13 - drivers/mmc/host/sdhci-acpi.c | 84 +++++++++ drivers/mmc/host/sdhci-cadence.c | 18 +- drivers/mmc/host/sdhci-of-at91.c | 8 drivers/nvme/target/tcp.c | 12 + drivers/perf/arm_pmu_acpi.c | 7 drivers/perf/fsl_imx8_ddr_perf.c | 10 - drivers/phy/ti/phy-gmii-sel.c | 10 - drivers/rtc/Kconfig | 1 drivers/spi/spi-omap2-mcspi.c | 77 ++++---- drivers/spi/spi-pxa2xx.c | 23 ++ drivers/spi/spi-qup.c | 11 - drivers/spi/spi-zynqmp-gqspi.c | 3 drivers/spi/spi.c | 32 +-- drivers/staging/greybus/tools/loopback_test.c | 21 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 drivers/staging/speakup/main.c | 2 drivers/thunderbolt/switch.c | 2 drivers/tty/tty_io.c | 6 drivers/usb/chipidea/udc.c | 7 drivers/usb/class/cdc-acm.c | 34 ++- drivers/usb/core/quirks.c | 6 drivers/usb/host/xhci-pci.c | 3 drivers/usb/host/xhci-plat.c | 1 drivers/usb/host/xhci-trace.h | 23 -- drivers/usb/serial/option.c | 2 drivers/usb/serial/pl2303.c | 1 drivers/usb/serial/pl2303.h | 1 drivers/usb/typec/ucsi/displayport.c | 12 + drivers/xen/xenbus/xenbus_comms.c | 4 drivers/xen/xenbus/xenbus_xs.c | 9 - fs/btrfs/block-group.c | 4 fs/btrfs/inode.c | 4 fs/cifs/cifs_dfs_ref.c | 2 fs/cifs/cifsfs.c | 2 fs/cifs/file.c | 3 fs/cifs/smb2ops.c | 2 fs/eventpoll.c | 8 fs/inode.c | 1 fs/io-wq.c | 20 +- fs/io_uring.c | 9 + fs/locks.c | 60 +++++- include/linux/fs.h | 1 include/linux/futex.h | 17 + include/linux/page-flags.h | 2 include/linux/vmalloc.h | 5 init/Kconfig | 3 kernel/futex.c | 93 ++++++---- kernel/notifier.c | 2 mm/madvise.c | 12 + mm/memcontrol.c | 103 +++++++----- mm/nommu.c | 10 - mm/slub.c | 32 ++- mm/sparse.c | 8 mm/vmalloc.c | 11 - scripts/Kconfig.include | 7 scripts/Makefile.extrawarn | 1 scripts/export_report.pl | 2 scripts/mod/modpost.c | 27 +-- sound/core/oss/pcm_plugin.c | 12 + sound/core/seq/oss/seq_oss_midi.c | 1 sound/core/seq/seq_virmidi.c | 1 sound/pci/hda/patch_realtek.c | 25 ++ sound/soc/stm/stm32_sai_sub.c | 18 +- sound/usb/line6/driver.c | 2 sound/usb/line6/midibuf.c | 2 117 files changed, 944 insertions(+), 594 deletions(-) Aaro Koskinen (1): spi: spi_register_controller(): free bus id on error paths Alberto Mattea (1): usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c Alexander Shishkin (4): intel_th: msu: Fix the unexpected state warning intel_th: Fix user-visible error codes intel_th: pci: Add Elkhart Lake CPU support stm class: sys-t: Fix the use of time_after() Alexandre Ghiti (1): riscv: Fix range looking for kernel image memblock Alexandru Tachici (1): iio: accel: adxl372: Set iio_chan BE Anthony Mallet (2): USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL Baoquan He (1): mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case Bhawanpreet Lakha (1): drm/amd/display: Clear link settings on MST disable connector Caz Yokoyama (1): Revert "drm/i915/tgl: Add extra hdc flush workaround" Chris Down (2): mm, memcg: fix corruption on 64-bit divisor in memory.high throttling mm, memcg: throttle allocators based on ancestral memory.high Chris Wilson (1): drm/i915/execlists: Track active elements during dequeue Christian Brauner (1): binderfs: use refcount for binder control devices too Chunguang Xu (1): memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event Corentin Labbe (1): rtc: max8907: add missing select REGMAP_IRQ Cristian Marussi (2): arm64: smp: fix smp_send_stop() behaviour arm64: smp: fix crash_smp_send_stop() behaviour Damien Le Moal (1): riscv: Force flat memory model with no-mmu Dan Carpenter (1): thunderbolt: Fix error code in tb_port_is_width_supported() Daniel Axtens (1): altera-stapl: altera_get_note: prevent write beyond end of 'key' Daniele Palmas (1): USB: serial: option: add ME910G1 ECM composition 0x110b Dongli Zhang (2): xenbus: req->body should be updated before req->state xenbus: req->err should be updated before req->state Eric Biggers (2): tty: fix compat TIOCGSERIAL leaking uninitialized memory tty: fix compat TIOCGSERIAL checking wrong function ptr Eugen Hristev (1): iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode Evan Benn (1): drm/mediatek: Find the cursor plane instead of hard coding it Evan Green (1): spi: pxa2xx: Add CS control clock quirk Fabrice Gasnier (1): iio: trigger: stm32-timer: disable master mode when stopping Filipe Manana (2): btrfs: fix log context list corruption after rename whiteout error btrfs: fix removal of raid[56|1c34} incompat flags after removing block group Greg Kroah-Hartman (1): Linux 5.5.12 Grygorii Strashko (3): phy: ti: gmii-sel: fix set of copy-paste errors phy: ti: gmii-sel: do not fail in case of gmii ARM: dts: dra7-l4: mark timer13-16 as pwm capable Hans de Goede (3): usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320 mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012) Heikki Krogerus (2): usb: typec: ucsi: displayport: Fix NULL pointer dereference usb: typec: ucsi: displayport: Fix a potential race during registration Jernej Skrabec (1): drm/bridge: dw-hdmi: fix AVI frame colorimetry Jessica Yu (1): modpost: move the namespace field in Module.symvers last Jian-Hong Pan (2): ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 Joakim Zhang (1): drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition Joerg Roedel (1): x86/mm: split vmalloc_sync_all() Johan Hovold (3): staging: greybus: loopback_test: fix poll-mask build breakage staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix potential path truncations Jonathan Neuschäfer (1): parse-maintainers: Mark as executable Josip Pavic (1): drm/amd/display: fix dcc swath size calculations on dcn1 Kai-Heng Feng (2): USB: Disable LPM on WD19's Realtek Hub ALSA: hda/realtek: Fix pop noise on ALC225 Kishon Vijay Abraham I (1): ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Linus Torvalds (2): locks: reinstate locks_delete_block optimization mm: slub: be more careful about the double cmpxchg of freelist Marek Szyprowski (3): drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails Masahiro Yamada (3): mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier kconfig: introduce m32-flag and m64-flag int128: fix __uint128_t compiler test in Kconfig Matt Roper (1): drm/i915: Handle all MCR ranges Michael Straube (1): staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 Michal Hocko (1): mm: do not allow MADV_PAGEOUT for CoW pages Michał Mirosław (1): mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 Mike Snitzer (2): dm bio record: save/restore bi_end_io and bi_integrity dm integrity: use dm_bio_record and dm_bio_restore Murphy Zhou (1): CIFS: fiemap: do not return EINVAL if get nothing Nathan Chancellor (1): kbuild: Disable -Wpointer-to-enum-cast Naveen N. Rao (1): powerpc: Include .BTF section Olivier Moysan (2): ASoC: stm32: sai: manage rebind issue iio: adc: stm32-dfsdm: fix sleep in atomic context Paulo Alcantara (SUSE) (1): cifs: fix potential mismatch of UNC paths Pavel Begunkov (3): io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation io_uring: fix lockup with timeouts io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN} Peter Chen (1): usb: chipidea: udc: fix sleeping function called from invalid context Peter Zijlstra (1): futex: Fix inode life-time issue Petr Štetiar (1): iio: chemical: sps30: fix missing triggered buffer dependency Qian Cai (1): page-flags: fix a crash at SetPageError(THP_SWAP) Qiujun Huang (1): drm/lease: fix WARNING in idr_destroy Ran Wang (1): usb: host: xhci-plat: add a shutdown Ricky Wu (1): mmc: rtsx_pci: Fix support for speed-modes that relies on tuning Roman Penyaev (1): epoll: fix possible lost wakeup on epoll_ctl() path Sagi Grimberg (1): nvmet-tcp: set MSG_MORE only if we actually have more to send Samuel Thibault (1): staging/speakup: fix get_word non-space look-ahead Sasha Levin (1): Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present" Scott Chen (1): USB: serial: pl2303: add device-id for HP LD381 Sean Paul (1): drm/mediatek: Ensure the cursor plane is on top of other overlays Stefan Wahren (2): ARM: dts: bcm283x: Add missing properties to the PWR LED ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS Stephan Gerhold (1): iio: magnetometer: ak8974: Fix negative raw values in sysfs Steve French (1): cifs: add missing mount option to /proc/mounts Steven Rostedt (VMware) (1): xhci: Do not open code __print_symbolic() in xhci trace events Takashi Iwai (5): ALSA: line6: Fix endless MIDI read loop ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Thomas Gleixner (1): futex: Unbreak futex hashing Thommy Jakobsson (1): spi/zynqmp: remove entry that causes a cs glitch Tom St Denis (1): drm/amd/amdgpu: Fix GPR read from debugfs (v2) Tomas Novotny (2): iio: light: vcnl4000: update sampling periods for vcnl4200 iio: light: vcnl4000: update sampling periods for vcnl4040 Tycho Andersen (1): riscv: fix seccomp reject syscall code path Vignesh Raghavendra (1): spi: spi-omap2-mcspi: Support probe deferral for DMA channels Vincent Chen (1): riscv: avoid the PIC offset of static percpu data in module beyond 2G limits Vincenzo Frascino (1): arm64: compat: Fix syscall number of compat_clock_getres Vlastimil Babka (1): mm, slub: prevent kmalloc_node crashes and memory leaks Wen-chien Jesse Sung (1): iio: st_sensors: remap SMO8840 to LIS2DH12 Xiao Yang (1): modpost: Get proper section index by get_secindex() instead of st_shndx Yintian Tao (1): drm/amdgpu: clean wptr on wb when gpu recovery Yuji Sasaki (1): spi: qup: call spi_qup_pm_resume_runtime before suspending luanshi (1): drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer yangerkun (1): locks: fix a potential use-after-free problem when wakeup a waiter

5 years, 7 months

1
1
0 0

Linux 5.4.28

by Greg KH

I'm announcing the release of the 5.4.28 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/kbuild/modules.rst | 4 Makefile | 2 arch/arm/boot/dts/dra7-l4.dtsi | 4 arch/arm/boot/dts/dra7.dtsi | 2 arch/arm64/include/asm/unistd.h | 2 arch/arm64/kernel/smp.c | 25 ++ arch/powerpc/kernel/vmlinux.lds.S | 6 arch/riscv/Kconfig | 1 arch/riscv/kernel/module.c | 16 + arch/riscv/mm/init.c | 2 arch/x86/mm/fault.c | 26 ++- block/bfq-cgroup.c | 9 - drivers/acpi/apei/ghes.c | 2 drivers/android/binderfs.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++-- drivers/gpu/drm/drm_client_modeset.c | 72 -------- drivers/gpu/drm/drm_lease.c | 3 drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 - drivers/gpu/drm/exynos/exynos_hdmi.c | 22 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 18 +- drivers/hwtracing/intel_th/msu.c | 13 - drivers/hwtracing/intel_th/pci.c | 5 drivers/hwtracing/stm/p_sys-t.c | 6 drivers/iio/accel/adxl372.c | 1 drivers/iio/accel/st_accel_i2c.c | 2 drivers/iio/adc/at91-sama5d2_adc.c | 15 + drivers/iio/adc/stm32-dfsdm-adc.c | 43 +---- drivers/iio/chemical/Kconfig | 2 drivers/iio/light/vcnl4000.c | 15 - drivers/iio/magnetometer/ak8974.c | 2 drivers/iio/trigger/stm32-timer-trigger.c | 11 + drivers/md/dm-bio-record.h | 15 + drivers/md/dm-integrity.c | 32 +-- drivers/misc/altera-stapl/altera.c | 12 - drivers/misc/cardreader/rts5227.c | 2 drivers/misc/cardreader/rts5249.c | 2 drivers/misc/cardreader/rts5260.c | 2 drivers/mmc/host/rtsx_pci_sdmmc.c | 13 - drivers/mmc/host/sdhci-cadence.c | 18 +- drivers/mmc/host/sdhci-of-at91.c | 8 drivers/nvme/target/tcp.c | 12 + drivers/perf/arm_pmu_acpi.c | 7 drivers/perf/fsl_imx8_ddr_perf.c | 10 - drivers/phy/ti/phy-gmii-sel.c | 10 - drivers/rtc/Kconfig | 1 drivers/spi/spi-omap2-mcspi.c | 77 ++++---- drivers/spi/spi-pxa2xx.c | 23 ++ drivers/spi/spi-qup.c | 11 - drivers/spi/spi-zynqmp-gqspi.c | 3 drivers/spi/spi.c | 32 +-- drivers/staging/greybus/tools/loopback_test.c | 21 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 drivers/staging/speakup/main.c | 2 drivers/tty/tty_io.c | 6 drivers/usb/class/cdc-acm.c | 34 ++- drivers/usb/core/quirks.c | 6 drivers/usb/host/xhci-pci.c | 3 drivers/usb/host/xhci-plat.c | 1 drivers/usb/host/xhci-trace.h | 23 -- drivers/usb/serial/option.c | 2 drivers/usb/serial/pl2303.c | 1 drivers/usb/serial/pl2303.h | 1 drivers/usb/typec/ucsi/displayport.c | 12 + drivers/xen/xenbus/xenbus_comms.c | 4 drivers/xen/xenbus/xenbus_xs.c | 9 - fs/btrfs/inode.c | 4 fs/cifs/cifs_dfs_ref.c | 2 fs/cifs/cifsfs.c | 2 fs/cifs/file.c | 3 fs/cifs/smb2ops.c | 2 fs/eventpoll.c | 8 fs/inode.c | 1 fs/locks.c | 60 +++++- include/linux/fs.h | 1 include/linux/futex.h | 17 + include/linux/page-flags.h | 2 include/linux/vmalloc.h | 5 kernel/futex.c | 93 ++++++---- kernel/notifier.c | 2 mm/madvise.c | 12 + mm/memcontrol.c | 103 +++++++----- mm/nommu.c | 10 - mm/slub.c | 32 ++- mm/sparse.c | 8 mm/vmalloc.c | 11 - scripts/Makefile.extrawarn | 1 scripts/export_report.pl | 2 scripts/mod/modpost.c | 24 +- sound/core/oss/pcm_plugin.c | 12 + sound/core/seq/oss/seq_oss_midi.c | 1 sound/core/seq/seq_virmidi.c | 1 sound/pci/hda/patch_realtek.c | 25 ++ sound/soc/stm/stm32_sai_sub.c | 18 +- sound/usb/line6/driver.c | 2 sound/usb/line6/midibuf.c | 2 100 files changed, 772 insertions(+), 513 deletions(-) Aaro Koskinen (1): spi: spi_register_controller(): free bus id on error paths Alberto Mattea (1): usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c Alexander Shishkin (4): intel_th: msu: Fix the unexpected state warning intel_th: Fix user-visible error codes intel_th: pci: Add Elkhart Lake CPU support stm class: sys-t: Fix the use of time_after() Alexandre Ghiti (1): riscv: Fix range looking for kernel image memblock Alexandru Tachici (1): iio: accel: adxl372: Set iio_chan BE Anthony Mallet (2): USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL Baoquan He (1): mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case Bhawanpreet Lakha (1): drm/amd/display: Clear link settings on MST disable connector Carlo Nonato (1): block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() Chris Down (2): mm, memcg: fix corruption on 64-bit divisor in memory.high throttling mm, memcg: throttle allocators based on ancestral memory.high Christian Brauner (1): binderfs: use refcount for binder control devices too Chunguang Xu (1): memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event Corentin Labbe (1): rtc: max8907: add missing select REGMAP_IRQ Cristian Marussi (2): arm64: smp: fix smp_send_stop() behaviour arm64: smp: fix crash_smp_send_stop() behaviour Damien Le Moal (1): riscv: Force flat memory model with no-mmu Daniel Axtens (1): altera-stapl: altera_get_note: prevent write beyond end of 'key' Daniele Palmas (1): USB: serial: option: add ME910G1 ECM composition 0x110b Dongli Zhang (2): xenbus: req->body should be updated before req->state xenbus: req->err should be updated before req->state Eric Biggers (2): tty: fix compat TIOCGSERIAL leaking uninitialized memory tty: fix compat TIOCGSERIAL checking wrong function ptr Eugen Hristev (1): iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode Evan Benn (1): drm/mediatek: Find the cursor plane instead of hard coding it Evan Green (1): spi: pxa2xx: Add CS control clock quirk Fabrice Gasnier (1): iio: trigger: stm32-timer: disable master mode when stopping Filipe Manana (1): btrfs: fix log context list corruption after rename whiteout error Greg Kroah-Hartman (1): Linux 5.4.28 Grygorii Strashko (3): phy: ti: gmii-sel: fix set of copy-paste errors phy: ti: gmii-sel: do not fail in case of gmii ARM: dts: dra7-l4: mark timer13-16 as pwm capable Hans de Goede (1): usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters Heikki Krogerus (2): usb: typec: ucsi: displayport: Fix NULL pointer dereference usb: typec: ucsi: displayport: Fix a potential race during registration Jernej Skrabec (1): drm/bridge: dw-hdmi: fix AVI frame colorimetry Jessica Yu (1): modpost: move the namespace field in Module.symvers last Jian-Hong Pan (2): ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 Joakim Zhang (1): drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition Joerg Roedel (1): x86/mm: split vmalloc_sync_all() Johan Hovold (3): staging: greybus: loopback_test: fix poll-mask build breakage staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix potential path truncations Jonathan Neuschäfer (1): parse-maintainers: Mark as executable Josip Pavic (1): drm/amd/display: fix dcc swath size calculations on dcn1 Kai-Heng Feng (2): USB: Disable LPM on WD19's Realtek Hub ALSA: hda/realtek: Fix pop noise on ALC225 Kishon Vijay Abraham I (1): ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Linus Torvalds (2): locks: reinstate locks_delete_block optimization mm: slub: be more careful about the double cmpxchg of freelist Marek Szyprowski (3): drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails Masahiro Yamada (1): mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier Michael Straube (1): staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 Michal Hocko (1): mm: do not allow MADV_PAGEOUT for CoW pages Michał Mirosław (1): mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 Mike Snitzer (2): dm bio record: save/restore bi_end_io and bi_integrity dm integrity: use dm_bio_record and dm_bio_restore Murphy Zhou (1): CIFS: fiemap: do not return EINVAL if get nothing Nathan Chancellor (1): kbuild: Disable -Wpointer-to-enum-cast Naveen N. Rao (1): powerpc: Include .BTF section Olivier Moysan (2): ASoC: stm32: sai: manage rebind issue iio: adc: stm32-dfsdm: fix sleep in atomic context Paulo Alcantara (SUSE) (1): cifs: fix potential mismatch of UNC paths Peter Zijlstra (1): futex: Fix inode life-time issue Petr Štetiar (1): iio: chemical: sps30: fix missing triggered buffer dependency Qian Cai (1): page-flags: fix a crash at SetPageError(THP_SWAP) Qiujun Huang (1): drm/lease: fix WARNING in idr_destroy Ran Wang (1): usb: host: xhci-plat: add a shutdown Ricky Wu (1): mmc: rtsx_pci: Fix support for speed-modes that relies on tuning Roman Penyaev (1): epoll: fix possible lost wakeup on epoll_ctl() path Sagi Grimberg (1): nvmet-tcp: set MSG_MORE only if we actually have more to send Samuel Thibault (1): staging/speakup: fix get_word non-space look-ahead Sasha Levin (1): Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present" Scott Chen (1): USB: serial: pl2303: add device-id for HP LD381 Stephan Gerhold (1): iio: magnetometer: ak8974: Fix negative raw values in sysfs Steve French (1): cifs: add missing mount option to /proc/mounts Steven Rostedt (VMware) (1): xhci: Do not open code __print_symbolic() in xhci trace events Takashi Iwai (5): ALSA: line6: Fix endless MIDI read loop ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Thomas Gleixner (1): futex: Unbreak futex hashing Thommy Jakobsson (1): spi/zynqmp: remove entry that causes a cs glitch Tom St Denis (1): drm/amd/amdgpu: Fix GPR read from debugfs (v2) Tomas Novotny (2): iio: light: vcnl4000: update sampling periods for vcnl4200 iio: light: vcnl4000: update sampling periods for vcnl4040 Vignesh Raghavendra (1): spi: spi-omap2-mcspi: Support probe deferral for DMA channels Vincent Chen (1): riscv: avoid the PIC offset of static percpu data in module beyond 2G limits Vincenzo Frascino (1): arm64: compat: Fix syscall number of compat_clock_getres Vlastimil Babka (1): mm, slub: prevent kmalloc_node crashes and memory leaks Wen-chien Jesse Sung (1): iio: st_sensors: remap SMO8840 to LIS2DH12 Yintian Tao (1): drm/amdgpu: clean wptr on wb when gpu recovery Yuji Sasaki (1): spi: qup: call spi_qup_pm_resume_runtime before suspending luanshi (1): drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer yangerkun (1): locks: fix a potential use-after-free problem when wakeup a waiter

5 years, 7 months

1
1
0 0

Linux 4.19.113

by Greg KH

I'm announcing the release of the 4.19.113 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/dra7.dtsi | 2 arch/arm64/kernel/smp.c | 25 ++- arch/powerpc/kernel/vmlinux.lds.S | 6 arch/riscv/kernel/module.c | 16 ++ arch/x86/mm/fault.c | 26 +++ block/bfq-cgroup.c | 9 - drivers/acpi/apei/ghes.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++-- drivers/gpu/drm/drm_lease.c | 3 drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 - drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 18 +- drivers/hwtracing/intel_th/msu.c | 6 drivers/hwtracing/intel_th/pci.c | 5 drivers/iio/accel/st_accel_i2c.c | 2 drivers/iio/adc/at91-sama5d2_adc.c | 15 + drivers/iio/light/vcnl4000.c | 7 drivers/iio/magnetometer/ak8974.c | 2 drivers/iio/trigger/stm32-timer-trigger.c | 11 + drivers/md/dm-bio-record.h | 15 + drivers/md/dm-integrity.c | 32 +--- drivers/misc/altera-stapl/altera.c | 12 - drivers/misc/cardreader/rts5227.c | 2 drivers/misc/cardreader/rts5249.c | 2 drivers/misc/cardreader/rts5260.c | 2 drivers/mmc/host/rtsx_pci_sdmmc.c | 13 + drivers/mmc/host/sdhci-of-at91.c | 8 - drivers/net/vrf.c | 19 +- drivers/perf/arm_pmu_acpi.c | 7 drivers/rtc/Kconfig | 1 drivers/spi/spi-pxa2xx.c | 23 ++ drivers/spi/spi-qup.c | 11 - drivers/spi/spi-zynqmp-gqspi.c | 3 drivers/staging/greybus/tools/loopback_test.c | 21 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 drivers/staging/speakup/main.c | 2 drivers/usb/class/cdc-acm.c | 34 ++-- drivers/usb/core/quirks.c | 6 drivers/usb/host/xhci-pci.c | 3 drivers/usb/host/xhci-plat.c | 1 drivers/usb/host/xhci-trace.h | 23 -- drivers/usb/serial/option.c | 2 drivers/usb/serial/pl2303.c | 1 drivers/usb/serial/pl2303.h | 1 drivers/xen/xenbus/xenbus_comms.c | 4 drivers/xen/xenbus/xenbus_xs.c | 9 - fs/btrfs/inode.c | 4 fs/inode.c | 1 include/linux/fs.h | 1 include/linux/futex.h | 17 +- include/linux/page-flags.h | 2 include/linux/vmalloc.h | 5 kernel/futex.c | 93 +++++++----- kernel/notifier.c | 2 mm/memcontrol.c | 10 + mm/nommu.c | 10 - mm/slub.c | 32 ++-- mm/vmalloc.c | 11 - net/ipv6/tcp_ipv6.c | 3 scripts/Makefile.extrawarn | 1 sound/core/oss/pcm_plugin.c | 12 + sound/core/seq/oss/seq_oss_midi.c | 1 sound/core/seq/seq_virmidi.c | 1 sound/pci/hda/patch_realtek.c | 2 sound/usb/line6/driver.c | 2 sound/usb/line6/midibuf.c | 2 69 files changed, 457 insertions(+), 239 deletions(-) Alberto Mattea (1): usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c Alexander Shishkin (2): intel_th: Fix user-visible error codes intel_th: pci: Add Elkhart Lake CPU support Anthony Mallet (2): USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL Bhawanpreet Lakha (1): drm/amd/display: Clear link settings on MST disable connector Carlo Nonato (1): block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() Chunguang Xu (1): memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event Corentin Labbe (1): rtc: max8907: add missing select REGMAP_IRQ Cristian Marussi (2): arm64: smp: fix smp_send_stop() behaviour arm64: smp: fix crash_smp_send_stop() behaviour Daniel Axtens (1): altera-stapl: altera_get_note: prevent write beyond end of 'key' Daniele Palmas (1): USB: serial: option: add ME910G1 ECM composition 0x110b Dongli Zhang (2): xenbus: req->body should be updated before req->state xenbus: req->err should be updated before req->state Eugen Hristev (1): iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode Evan Benn (1): drm/mediatek: Find the cursor plane instead of hard coding it Evan Green (1): spi: pxa2xx: Add CS control clock quirk Fabrice Gasnier (1): iio: trigger: stm32-timer: disable master mode when stopping Filipe Manana (1): btrfs: fix log context list corruption after rename whiteout error Greg Kroah-Hartman (1): Linux 4.19.113 Hans de Goede (1): usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters Jernej Skrabec (1): drm/bridge: dw-hdmi: fix AVI frame colorimetry Joerg Roedel (1): x86/mm: split vmalloc_sync_all() Johan Hovold (3): staging: greybus: loopback_test: fix poll-mask build breakage staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix potential path truncations Jonathan Neuschäfer (1): parse-maintainers: Mark as executable Josip Pavic (1): drm/amd/display: fix dcc swath size calculations on dcn1 Kai-Heng Feng (2): USB: Disable LPM on WD19's Realtek Hub ALSA: hda/realtek: Fix pop noise on ALC225 Kishon Vijay Abraham I (1): ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Linus Torvalds (1): mm: slub: be more careful about the double cmpxchg of freelist Marek Szyprowski (2): drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name Michael Straube (1): staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 Michał Mirosław (1): mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 Mike Snitzer (2): dm bio record: save/restore bi_end_io and bi_integrity dm integrity: use dm_bio_record and dm_bio_restore Nathan Chancellor (1): kbuild: Disable -Wpointer-to-enum-cast Naveen N. Rao (1): powerpc: Include .BTF section Peter Zijlstra (1): futex: Fix inode life-time issue Qian Cai (1): page-flags: fix a crash at SetPageError(THP_SWAP) Qiujun Huang (1): drm/lease: fix WARNING in idr_destroy Ran Wang (1): usb: host: xhci-plat: add a shutdown Ricky Wu (1): mmc: rtsx_pci: Fix support for speed-modes that relies on tuning Samuel Thibault (1): staging/speakup: fix get_word non-space look-ahead Sasha Levin (2): Revert "vrf: mark skb for multicast or link-local as enslaved to VRF" Revert "ipv6: Fix handling of LLA with VRF and sockets bound to VRF" Scott Chen (1): USB: serial: pl2303: add device-id for HP LD381 Stephan Gerhold (1): iio: magnetometer: ak8974: Fix negative raw values in sysfs Steven Rostedt (VMware) (1): xhci: Do not open code __print_symbolic() in xhci trace events Takashi Iwai (5): ALSA: line6: Fix endless MIDI read loop ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Thomas Gleixner (1): futex: Unbreak futex hashing Thommy Jakobsson (1): spi/zynqmp: remove entry that causes a cs glitch Tom St Denis (1): drm/amd/amdgpu: Fix GPR read from debugfs (v2) Tomas Novotny (1): iio: light: vcnl4000: update sampling periods for vcnl4200 Vincent Chen (1): riscv: avoid the PIC offset of static percpu data in module beyond 2G limits Vlastimil Babka (1): mm, slub: prevent kmalloc_node crashes and memory leaks Wen-chien Jesse Sung (1): iio: st_sensors: remap SMO8840 to LIS2DH12 Yuji Sasaki (1): spi: qup: call spi_qup_pm_resume_runtime before suspending luanshi (1): drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer

5 years, 7 months

1
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror