This is the start of the stable review cycle for the 4.19.70 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 06 Sep 2019 05:50:23 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.70-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.70-rc1
Stanislaw Gruszka <sgruszka(a)redhat.com>
mt76: mt76x0u: do not reset radio on resume
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
x86/ptrace: fix up botched merge of spectrev1 fix
Andrew Cooks <andrew.cooks(a)opengear.com>
i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Pass error information to the pgio error cleanup routine
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Clean up list moves of struct nfs_page
Marc Zyngier <maz(a)kernel.org>
KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
Heyi Guo <guoheyi(a)huawei.com>
KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
Alexey Kardashevskiy <aik(a)ozlabs.ru>
KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
Denis Kenzior <denkenz(a)gmail.com>
mac80211: Correctly set noencrypt for PAE frames
Denis Kenzior <denkenz(a)gmail.com>
mac80211: Don't memset RXCB prior to PAE intercept
Johannes Berg <johannes.berg(a)intel.com>
mac80211: fix possible sta leak
Hodaszi, Robert <Robert.Hodaszi(a)digi.com>
Revert "cfg80211: fix processing world regdomain when non modular"
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Ignore unconfigured CCP device on suspend/resume
Nadav Amit <namit(a)vmware.com>
VMCI: Release resource if the work is already queued
John Garry <john.garry(a)huawei.com>
bus: hisi_lpc: Add .remove method to avoid driver unbind crash
John Garry <john.garry(a)huawei.com>
bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free
Lyude Paul <lyude(a)redhat.com>
drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
drm/amdgpu: Add APTX quirk for Dell Latitude 5495
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Add logic_pio_unregister_range()
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Avoid possible overlap for unregistering regions
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Fix RCU usage
Eddie James <eajames(a)linux.ibm.com>
fsi: scom: Don't abort operations for minor errors
Colin Ian King <colin.king(a)canonical.com>
typec: tcpm: fix a typo in the comparison of pdo_max_voltage
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Tiger Lake support
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add support for another Lewisburg PCH
Ding Xiang <dingxiang(a)cmss.chinamobile.com>
stm class: Fix a double free of stm_source_device
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Fix init of SD cards reporting an invalid VDD range
Eugen Hristev <eugen.hristev(a)microchip.com>
mmc: sdhci-of-at91: add quirk for broken HS200
Tomas Winkler <tomas.winkler(a)intel.com>
mei: me: add Tiger Lake point LP device ID
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Whitelist auto-delink support
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Update module parameter description for auto_delink_en
Geert Uytterhoeven <geert+renesas(a)glider.be>
usb: host: xhci: rcar: Fix typo in compatible string matching
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: host: ohci: fix a race condition between shutdown and irq
Peter Chen <peter.chen(a)nxp.com>
usb: chipidea: udc: don't do hardware access if gadget has stopped
Schmid, Carsten <Carsten_Schmid(a)mentor.com>
usb: hcd: use managed device resources
Oliver Neukum <oneukum(a)suse.com>
USB: cdc-wdm: fix race between write and disconnect due to flag abuse
Henk van der Laan <opensource(a)henkvdlaan.com>
usb-storage: Add new JMS567 revision to unusual_devs
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ftrace: Check for empty hash and comment the race with registering probes
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Check for successful allocation of hash
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Fix NULL pointer dereference in t_probe_next()
Bandan Das <bsd(a)redhat.com>
x86/apic: Include the LDR when clearing out APIC registers
Bandan Das <bsd(a)redhat.com>
x86/apic: Do not initialize LDR and DFR for bigsmp
Sebastian Mayr <me(a)sam.st>
uprobes/x86: Fix detection of 32-bit user mode
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Don't update RIP or do single-step on faulting emulation
Radim Krcmar <rkrcmar(a)redhat.com>
kvm: x86: skip populating logical dest map if apic is not sw enabled
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix potential concurrent access to the deleted pool
Jeronimo Borque <jeronimo(a)borque.com.ar>
ALSA: hda - Fixes inverted Conexant GPIO mic mute led
Takashi Iwai <tiwai(a)suse.de>
ALSA: line6: Fix memory leak at line6_init_pcm() error path
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Check mixer unit bitmap yet more strictly
Andrew Morton <akpm(a)linux-foundation.org>
mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
Hangbin Liu <liuhangbin(a)gmail.com>
ipv4/icmp: fix rt dst dev null pointer dereference
Eric Dumazet <edumazet(a)google.com>
tcp: make sure EPOLLOUT wont be missed
Jason Baron <jbaron(a)akamai.com>
net/smc: make sure EPOLLOUT is raised
David Ahern <dsahern(a)gmail.com>
ipv6: Default fib6_type to RTN_UNICAST when not set
Hangbin Liu <liuhangbin(a)gmail.com>
ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
John Fastabend <john.fastabend(a)gmail.com>
net: tls, fix sk_write_space NULL write when tx disabled
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net/tls: swap sk_write_space on close
Vakul Garg <vakul.garg(a)nxp.com>
net/tls: Fixed return value when tls_complete_pending_work() fails
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Register cpufreq notifier after we have initialized crtc
Pedro Sousa <sousa(a)synopsys.com>
scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
Tomi Valkeinen <tomi.valkeinen(a)ti.com>
drm/bridge: tfp410: fix memleak in get_modes()
Stefan Wahren <wahrenst(a)gmx.net>
watchdog: bcm2835_wdt: Fix module autoload
Lionel Landwerlin <lionel.g.landwerlin(a)intel.com>
drm/i915: fix broadwell EU computation
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fix KVP and VSS daemons exit code
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
Hans Ulli Kroll <ulli.kroll(a)googlemail.com>
usb: host: fotg2: restart hcd after port reset
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: Fixed reboot test may cause system hanged
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: emev2: avoid race when unregistering slave client
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: rcar: avoid race when unregistering slave client
Will Deacon <will(a)kernel.org>
arm64: cpufeature: Don't treat granule sizes as strict
Wenwen Wang <wenwen(a)cs.uga.edu>
xen/blkback: fix memory leaks
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: composite: Clear "suspended" on reset/disconnect
Robin Murphy <robin.murphy(a)arm.com>
iommu/dma: Handle SG length overflow better
Hans Verkuil <hverkuil(a)xs4all.nl>
omap-dma/omap_vout_vrfb: fix off-by-one fi value
Jia-Ju Bai <baijiaju1990(a)gmail.com>
dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler()
zhengbin <zhengbin13(a)huawei.com>
auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
soundwire: cadence_master: fix definitions for INTSTAT0/1
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
soundwire: cadence_master: fix register definition for SLAVE_STATE
Keith Busch <kbusch(a)kernel.org>
nvme-pci: Fix async probe remove race
Sagi Grimberg <sagi(a)grimberg.me>
nvme: fix a possible deadlock when passthru commands sent to a multipath device
Logan Gunthorpe <logang(a)deltatee.com>
nvmet-loop: Flush nvme_delete_wq when removing the port
David Howells <dhowells(a)redhat.com>
afs: Only update d_fsdata if different in afs_d_revalidate()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
fs: afs: Fix a possible null-pointer dereference in afs_put_read()
Marc Dionne <marc.dionne(a)auristor.com>
afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
David Howells <dhowells(a)redhat.com>
afs: Fix the CB.ProbeUuid service handler to reply correctly
Anthony Iliopoulos <ailiopoulos(a)suse.com>
nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
Arnd Bergmann <arnd(a)arndb.de>
dmaengine: ste_dma40: fix unneeded variable warning
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/kernel/cpufeature.c | 14 +++-
arch/powerpc/kvm/book3s_64_vio.c | 6 +-
arch/powerpc/kvm/book3s_64_vio_hv.c | 6 +-
arch/x86/kernel/apic/apic.c | 4 ++
arch/x86/kernel/apic/bigsmp_32.c | 24 +------
arch/x86/kernel/ptrace.c | 3 +-
arch/x86/kernel/uprobes.c | 17 +++--
arch/x86/kvm/lapic.c | 5 ++
arch/x86/kvm/x86.c | 9 +--
drivers/auxdisplay/panel.c | 2 +
drivers/block/xen-blkback/xenbus.c | 6 +-
drivers/bus/hisi_lpc.c | 47 ++++++++++++--
drivers/crypto/ccp/ccp-dev.c | 8 +++
drivers/dma/ste_dma40.c | 4 +-
drivers/dma/stm32-mdma.c | 2 +-
drivers/dma/ti/omap-dma.c | 4 +-
drivers/fsi/fsi-scom.c | 8 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 +
drivers/gpu/drm/ast/ast_main.c | 5 +-
drivers/gpu/drm/ast/ast_mode.c | 2 +-
drivers/gpu/drm/ast/ast_post.c | 2 +-
drivers/gpu/drm/bridge/ti-tfp410.c | 7 +-
drivers/gpu/drm/i915/i915_drv.c | 6 ++
drivers/gpu/drm/i915/i915_vgpu.c | 3 +
drivers/gpu/drm/i915/intel_device_info.c | 2 +-
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 +++++-----
drivers/hwtracing/intel_th/pci.c | 10 +++
drivers/hwtracing/stm/core.c | 1 -
drivers/i2c/busses/i2c-emev2.c | 16 +++--
drivers/i2c/busses/i2c-piix4.c | 12 ++--
drivers/i2c/busses/i2c-rcar.c | 11 ++--
drivers/iommu/dma-iommu.c | 2 +-
drivers/media/platform/omap/omap_vout_vrfb.c | 3 +-
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/vmw_vmci/vmci_doorbell.c | 6 +-
drivers/mmc/core/sd.c | 6 ++
drivers/mmc/host/sdhci-of-at91.c | 3 +
drivers/net/wireless/mediatek/mt76/mt76x0/init.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h | 2 +-
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 4 +-
drivers/nvme/host/core.c | 6 ++
drivers/nvme/host/multipath.c | 30 +++++++++
drivers/nvme/host/nvme.h | 12 ++++
drivers/nvme/host/pci.c | 3 +-
drivers/nvme/target/loop.c | 8 +++
drivers/scsi/ufs/unipro.h | 2 +-
drivers/soundwire/cadence_master.c | 8 +--
drivers/usb/chipidea/udc.c | 32 ++++++---
drivers/usb/class/cdc-wdm.c | 16 +++--
drivers/usb/core/hcd-pci.c | 30 +++------
drivers/usb/gadget/composite.c | 1 +
drivers/usb/gadget/function/f_mass_storage.c | 28 +++++---
drivers/usb/host/fotg210-hcd.c | 4 ++
drivers/usb/host/ohci-hcd.c | 15 ++++-
drivers/usb/host/xhci-rcar.c | 2 +-
drivers/usb/storage/realtek_cr.c | 15 +++--
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/usb/typec/tcpm.c | 2 +-
drivers/watchdog/bcm2835_wdt.c | 1 +
fs/afs/cmservice.c | 10 +--
fs/afs/dir.c | 3 +-
fs/afs/file.c | 12 ++--
fs/afs/vlclient.c | 11 ++--
fs/nfs/direct.c | 34 ++++++----
fs/nfs/pagelist.c | 32 ++++-----
fs/nfs/read.c | 2 +-
fs/nfs/write.c | 11 +++-
include/linux/logic_pio.h | 1 +
include/linux/nfs_page.h | 10 +++
include/linux/nfs_xdr.h | 2 +-
kernel/trace/ftrace.c | 17 +++++
lib/logic_pio.c | 73 +++++++++++++++------
mm/zsmalloc.c | 2 +
net/core/stream.c | 16 +++--
net/ipv4/icmp.c | 8 ++-
net/ipv6/addrconf.c | 3 +-
net/ipv6/route.c | 2 +-
net/mac80211/cfg.c | 9 +--
net/mac80211/rx.c | 6 +-
net/smc/smc_tx.c | 6 +-
net/tls/tls_main.c | 2 +
net/tls/tls_sw.c | 10 +--
net/wireless/reg.c | 2 +-
sound/core/seq/seq_clientmgr.c | 3 +-
sound/core/seq/seq_fifo.c | 17 +++++
sound/core/seq/seq_fifo.h | 2 +
sound/pci/hda/patch_conexant.c | 17 ++---
sound/usb/line6/pcm.c | 18 +++---
sound/usb/mixer.c | 36 ++++++++---
sound/usb/mixer_quirks.c | 8 +--
sound/usb/pcm.c | 1 +
tools/hv/hv_kvp_daemon.c | 2 +
tools/hv/hv_vss_daemon.c | 2 +
tools/hv/lsvmbus | 75 ++++++++++++----------
virt/kvm/arm/vgic/vgic-mmio.c | 18 ++++++
virt/kvm/arm/vgic/vgic-v2.c | 5 +-
virt/kvm/arm/vgic/vgic-v3.c | 5 +-
virt/kvm/arm/vgic/vgic.c | 7 ++
100 files changed, 699 insertions(+), 337 deletions(-)
I'm announcing the release of the 4.19.71 kernel.
Only users of the elantech driver need to upgrade to fix a regression in
a recent release.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/input/mouse/elantech.c | 54 ++++++++++++++++++++++-------------------
2 files changed, 30 insertions(+), 26 deletions(-)
Benjamin Tissoires (1):
Revert "Input: elantech - enable SMBus on new (2018+) systems"
Greg Kroah-Hartman (1):
Linux 4.19.71
This reverts commit 60956b018bfe23b879405a7d88103d0a8f06a5e3.
This patch depends on an other series:
https://patchwork.kernel.org/project/linux-input/list/?series=122327&state=…
It was a mistake to backport it in the v5.2 branch, as there
is a high chance we encounter a touchpad that needs the series
above.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204733
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204771
Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
---
Hi,
this is a stable only patch aimed at kernels v5.2 and v4.19 branches.
We already have 2 bug reports of a failing touchpad, and I don't think
it is worth trying to get a smoother touchpad if we randomly
break a few of them in the way.
Cheers,
Benjamin
---
drivers/input/mouse/elantech.c | 54 ++++++++++++++++++----------------
1 file changed, 29 insertions(+), 25 deletions(-)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index a47c7add4e0e..a4345052abd2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1807,30 +1807,6 @@ static int elantech_create_smbus(struct psmouse *psmouse,
leave_breadcrumbs);
}
-static bool elantech_use_host_notify(struct psmouse *psmouse,
- struct elantech_device_info *info)
-{
- if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
- return true;
-
- switch (info->bus) {
- case ETP_BUS_PS2_ONLY:
- /* expected case */
- break;
- case ETP_BUS_SMB_HST_NTFY_ONLY:
- case ETP_BUS_PS2_SMB_HST_NTFY:
- /* SMbus implementation is stable since 2018 */
- if (dmi_get_bios_year() >= 2018)
- return true;
- default:
- psmouse_dbg(psmouse,
- "Ignoring SMBus bus provider %d\n", info->bus);
- break;
- }
-
- return false;
-}
-
/**
* elantech_setup_smbus - called once the PS/2 devices are enumerated
* and decides to instantiate a SMBus InterTouch device.
@@ -1850,7 +1826,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
* i2c_blacklist_pnp_ids.
* Old ICs are up to the user to decide.
*/
- if (!elantech_use_host_notify(psmouse, info) ||
+ if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
return -ENXIO;
}
@@ -1870,6 +1846,34 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
return 0;
}
+static bool elantech_use_host_notify(struct psmouse *psmouse,
+ struct elantech_device_info *info)
+{
+ if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+ return true;
+
+ switch (info->bus) {
+ case ETP_BUS_PS2_ONLY:
+ /* expected case */
+ break;
+ case ETP_BUS_SMB_ALERT_ONLY:
+ /* fall-through */
+ case ETP_BUS_PS2_SMB_ALERT:
+ psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
+ break;
+ case ETP_BUS_SMB_HST_NTFY_ONLY:
+ /* fall-through */
+ case ETP_BUS_PS2_SMB_HST_NTFY:
+ return true;
+ default:
+ psmouse_dbg(psmouse,
+ "Ignoring SMBus bus provider %d.\n",
+ info->bus);
+ }
+
+ return false;
+}
+
int elantech_init_smbus(struct psmouse *psmouse)
{
struct elantech_device_info info;
--
2.21.0
This is the start of the stable review cycle for the 4.14.142 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 06 Sep 2019 05:50:23 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.142-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.142-rc1
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
x86/ptrace: fix up botched merge of spectrev1 fix
Andrew Cooks <andrew.cooks(a)opengear.com>
i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Pass error information to the pgio error cleanup routine
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Clean up list moves of struct nfs_page
Marc Zyngier <maz(a)kernel.org>
KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
Heyi Guo <guoheyi(a)huawei.com>
KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
Alexey Kardashevskiy <aik(a)ozlabs.ru>
KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
Johannes Berg <johannes.berg(a)intel.com>
mac80211: fix possible sta leak
Hodaszi, Robert <Robert.Hodaszi(a)digi.com>
Revert "cfg80211: fix processing world regdomain when non modular"
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Ignore unconfigured CCP device on suspend/resume
Nadav Amit <namit(a)vmware.com>
VMCI: Release resource if the work is already queued
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Tiger Lake support
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add support for another Lewisburg PCH
Ding Xiang <dingxiang(a)cmss.chinamobile.com>
stm class: Fix a double free of stm_source_device
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Fix init of SD cards reporting an invalid VDD range
Eugen Hristev <eugen.hristev(a)microchip.com>
mmc: sdhci-of-at91: add quirk for broken HS200
Sebastian Mayr <me(a)sam.st>
uprobes/x86: Fix detection of 32-bit user mode
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Whitelist auto-delink support
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Update module parameter description for auto_delink_en
Geert Uytterhoeven <geert+renesas(a)glider.be>
usb: host: xhci: rcar: Fix typo in compatible string matching
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: host: ohci: fix a race condition between shutdown and irq
Peter Chen <peter.chen(a)nxp.com>
usb: chipidea: udc: don't do hardware access if gadget has stopped
Oliver Neukum <oneukum(a)suse.com>
USB: cdc-wdm: fix race between write and disconnect due to flag abuse
Henk van der Laan <opensource(a)henkvdlaan.com>
usb-storage: Add new JMS567 revision to unusual_devs
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ftrace: Check for empty hash and comment the race with registering probes
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Check for successful allocation of hash
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Fix NULL pointer dereference in t_probe_next()
Bandan Das <bsd(a)redhat.com>
x86/apic: Include the LDR when clearing out APIC registers
Bandan Das <bsd(a)redhat.com>
x86/apic: Do not initialize LDR and DFR for bigsmp
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Don't update RIP or do single-step on faulting emulation
Radim Krcmar <rkrcmar(a)redhat.com>
kvm: x86: skip populating logical dest map if apic is not sw enabled
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix potential concurrent access to the deleted pool
Takashi Iwai <tiwai(a)suse.de>
ALSA: line6: Fix memory leak at line6_init_pcm() error path
Andrew Morton <akpm(a)linux-foundation.org>
mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
Eric Dumazet <edumazet(a)google.com>
tcp: make sure EPOLLOUT wont be missed
Jason Baron <jbaron(a)akamai.com>
net/smc: make sure EPOLLOUT is raised
Hui Peng <benquike(a)gmail.com>
ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
Hui Peng <benquike(a)gmail.com>
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
Tim Froidcoeur <tim.froidcoeur(a)tessares.net>
tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Register cpufreq notifier after we have initialized crtc
Pedro Sousa <sousa(a)synopsys.com>
scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
Tomi Valkeinen <tomi.valkeinen(a)ti.com>
drm/bridge: tfp410: fix memleak in get_modes()
Stefan Wahren <wahrenst(a)gmx.net>
watchdog: bcm2835_wdt: Fix module autoload
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fix KVP and VSS daemons exit code
Hans Ulli Kroll <ulli.kroll(a)googlemail.com>
usb: host: fotg2: restart hcd after port reset
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: Fixed reboot test may cause system hanged
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: emev2: avoid race when unregistering slave client
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: rcar: avoid race when unregistering slave client
Wenwen Wang <wenwen(a)cs.uga.edu>
xen/blkback: fix memory leaks
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: composite: Clear "suspended" on reset/disconnect
Robin Murphy <robin.murphy(a)arm.com>
iommu/dma: Handle SG length overflow better
zhengbin <zhengbin13(a)huawei.com>
auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
Arnd Bergmann <arnd(a)arndb.de>
dmaengine: ste_dma40: fix unneeded variable warning
-------------
Diffstat:
Makefile | 4 ++--
arch/powerpc/kvm/book3s_64_vio.c | 6 +++--
arch/powerpc/kvm/book3s_64_vio_hv.c | 6 +++--
arch/x86/kernel/apic/apic.c | 4 ++++
arch/x86/kernel/apic/bigsmp_32.c | 24 ++------------------
arch/x86/kernel/ptrace.c | 3 +--
arch/x86/kernel/uprobes.c | 17 ++++++++------
arch/x86/kvm/lapic.c | 5 ++++
arch/x86/kvm/x86.c | 9 ++++----
drivers/auxdisplay/panel.c | 2 ++
drivers/block/xen-blkback/xenbus.c | 6 ++---
drivers/crypto/ccp/ccp-dev.c | 8 +++++++
drivers/dma/ste_dma40.c | 4 ++--
drivers/gpu/drm/ast/ast_main.c | 5 +++-
drivers/gpu/drm/ast/ast_mode.c | 2 +-
drivers/gpu/drm/ast/ast_post.c | 2 +-
drivers/gpu/drm/bridge/ti-tfp410.c | 7 +++++-
drivers/gpu/drm/i915/i915_vgpu.c | 3 +++
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++--------------
drivers/hwtracing/intel_th/pci.c | 10 ++++++++
drivers/hwtracing/stm/core.c | 1 -
drivers/i2c/busses/i2c-emev2.c | 16 +++++++++----
drivers/i2c/busses/i2c-piix4.c | 12 ++++------
drivers/i2c/busses/i2c-rcar.c | 11 +++++----
drivers/iommu/dma-iommu.c | 2 +-
drivers/misc/vmw_vmci/vmci_doorbell.c | 6 +++--
drivers/mmc/core/sd.c | 6 +++++
drivers/mmc/host/sdhci-of-at91.c | 3 +++
drivers/scsi/ufs/unipro.h | 2 +-
drivers/usb/chipidea/udc.c | 32 +++++++++++++++++++-------
drivers/usb/class/cdc-wdm.c | 16 +++++++++----
drivers/usb/gadget/composite.c | 1 +
drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++++--------
drivers/usb/host/fotg210-hcd.c | 4 ++++
drivers/usb/host/ohci-hcd.c | 15 +++++++++---
drivers/usb/host/xhci-rcar.c | 2 +-
drivers/usb/storage/realtek_cr.c | 15 +++++++-----
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/watchdog/bcm2835_wdt.c | 1 +
fs/nfs/direct.c | 34 +++++++++++++++++-----------
fs/nfs/pagelist.c | 32 +++++++++++++-------------
fs/nfs/read.c | 2 +-
fs/nfs/write.c | 11 +++++++--
include/linux/nfs_page.h | 10 ++++++++
include/linux/nfs_xdr.h | 2 +-
include/net/tcp.h | 4 ++++
kernel/trace/ftrace.c | 17 ++++++++++++++
mm/zsmalloc.c | 2 ++
net/core/stream.c | 16 +++++++------
net/mac80211/cfg.c | 9 ++++----
net/smc/smc_tx.c | 6 ++---
net/wireless/reg.c | 2 +-
sound/core/seq/seq_clientmgr.c | 3 +--
sound/core/seq/seq_fifo.c | 17 ++++++++++++++
sound/core/seq/seq_fifo.h | 2 ++
sound/usb/line6/pcm.c | 18 +++++++--------
sound/usb/mixer.c | 30 ++++++++++++++++++++----
tools/hv/hv_kvp_daemon.c | 2 ++
tools/hv/hv_vss_daemon.c | 2 ++
virt/kvm/arm/vgic/vgic-mmio.c | 18 +++++++++++++++
virt/kvm/arm/vgic/vgic-v2.c | 5 +++-
virt/kvm/arm/vgic/vgic-v3.c | 5 +++-
virt/kvm/arm/vgic/vgic.c | 7 ++++++
63 files changed, 405 insertions(+), 187 deletions(-)
On Fri, Aug 23, 2019 at 1:35 AM Eric Biggers <ebiggers(a)kernel.org> wrote:
>
> From: Eric Biggers <ebiggers(a)google.com>
>
> When IOCB_CMD_POLL is used on the FUSE device, aio_poll() disables IRQs
> and takes kioctx::ctx_lock, then fuse_iqueue::waitq.lock.
Not in -linus.
Which tree was this reproduced with?
Thanks,
Miklos
These patches support upcoming UV systems that do not have a UV HUB.
* Save OEM_ID from ACPI MADT probe
* Return UV Hubless System Type
* Add return code to UV BIOS Init function
* Setup UV functions for Hubless UV Systems
* Add UV Hubbed/Hubless Proc FS Files
* Decode UVsystab Info
* Account for UV Hubless in is_uvX_hub Ops
--
From: Roderick Colenbrander <roderick.colenbrander(a)sony.com>
The sony driver is not properly cleaning up from potential failures in
sony_input_configured. Currently it calls hid_hw_stop, while hid_connect
is still running. This is not a good idea, instead hid_hw_stop should
be moved to sony_probe. Similar changes were recently made to Logitech
drivers, which were also doing improper cleanup.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander(a)sony.com>
CC: stable(a)vger.kernel.org
---
drivers/hid/hid-sony.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 31f1023214d3..09f2c617b09f 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2806,7 +2806,6 @@ static int sony_input_configured(struct hid_device *hdev,
sony_cancel_work_sync(sc);
sony_remove_dev_list(sc);
sony_release_device_id(sc);
- hid_hw_stop(hdev);
return ret;
}
@@ -2868,6 +2867,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
*/
if (!(hdev->claimed & HID_CLAIMED_INPUT)) {
hid_err(hdev, "failed to claim input\n");
+ hid_hw_stop(hdev);
return -ENODEV;
}
--
2.21.0
This is a note to let you know that I've just added the patch titled
serial: sprd: correct the wrong sequence of arguments
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 9c801e313195addaf11c16e155f50789d6ebfd19 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Thu, 5 Sep 2019 15:41:51 +0800
Subject: serial: sprd: correct the wrong sequence of arguments
The sequence of arguments which was passed to handle_lsr_errors() didn't
match the parameters defined in that function, &lsr was passed to flag
and &flag was passed to lsr, this patch fixed that.
Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20190905074151.5268-1-zhang.lyra@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/sprd_serial.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index f8db5c8e4e39..771d11196523 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -617,7 +617,7 @@ static inline void sprd_rx(struct uart_port *port)
if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
SPRD_LSR_FE | SPRD_LSR_OE))
- if (handle_lsr_errors(port, &lsr, &flag))
+ if (handle_lsr_errors(port, &flag, &lsr))
continue;
if (uart_handle_sysrq_char(port, ch))
continue;
--
2.23.0
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: videobuf-core.c: poll_wait needs a non-NULL buf pointer
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Wed Sep 4 06:04:07 2019 -0300
poll_wait uses &buf->done, but buf is NULL. Move the poll_wait to later
in the function once buf is correctly set and only call it if it is
non-NULL.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Fixes: bb436cbeb918 ("media: videobuf: fix epoll() by calling poll_wait first")
Cc: <stable(a)vger.kernel.org> # for v5.1 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/v4l2-core/videobuf-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 7ef3e4d22bf6..939fc11cf080 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -1123,7 +1123,6 @@ __poll_t videobuf_poll_stream(struct file *file,
struct videobuf_buffer *buf = NULL;
__poll_t rc = 0;
- poll_wait(file, &buf->done, wait);
videobuf_queue_lock(q);
if (q->streaming) {
if (!list_empty(&q->stream))
@@ -1143,7 +1142,9 @@ __poll_t videobuf_poll_stream(struct file *file,
}
buf = q->read_buf;
}
- if (!buf)
+ if (buf)
+ poll_wait(file, &buf->done, wait);
+ else
rc = EPOLLERR;
if (0 == rc) {
These patches support upcoming UV systems that do not have a UV HUB.
* Save OEM_ID from ACPI MADT probe
* Return UV Hubless System Type
* Add return code to UV BIOS Init function
* Setup UV functions for Hubless UV Systems
* Add UV Hubbed/Hubless Proc FS Files
* Decode UVsystab Info
* Account for UV Hubless in is_uvX_hub Ops
--
This is a note to let you know that I've just added the patch titled
serial: sprd: correct the wrong sequence of arguments
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 9c801e313195addaf11c16e155f50789d6ebfd19 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Thu, 5 Sep 2019 15:41:51 +0800
Subject: serial: sprd: correct the wrong sequence of arguments
The sequence of arguments which was passed to handle_lsr_errors() didn't
match the parameters defined in that function, &lsr was passed to flag
and &flag was passed to lsr, this patch fixed that.
Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20190905074151.5268-1-zhang.lyra@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/sprd_serial.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index f8db5c8e4e39..771d11196523 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -617,7 +617,7 @@ static inline void sprd_rx(struct uart_port *port)
if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
SPRD_LSR_FE | SPRD_LSR_OE))
- if (handle_lsr_errors(port, &lsr, &flag))
+ if (handle_lsr_errors(port, &flag, &lsr))
continue;
if (uart_handle_sysrq_char(port, ch))
continue;
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 8619e5bdeee8b2c685d686281f2d2a6017c4bc15 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This is a note to let you know that I've just added the patch titled
USB: usbcore: Fix slab-out-of-bounds bug during device reset
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 3dd550a2d36596a1b0ee7955da3b611c031d3873 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 4 Sep 2019 11:56:27 -0400
Subject: USB: usbcore: Fix slab-out-of-bounds bug during device reset
The syzbot fuzzer provoked a slab-out-of-bounds error in the USB core:
BUG: KASAN: slab-out-of-bounds in memcmp+0xa6/0xb0 lib/string.c:904
Read of size 1 at addr ffff8881d175bed6 by task kworker/0:3/2746
CPU: 0 PID: 2746 Comm: kworker/0:3 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
memcmp+0xa6/0xb0 lib/string.c:904
memcmp include/linux/string.h:400 [inline]
descriptors_changed drivers/usb/core/hub.c:5579 [inline]
usb_reset_and_verify_device+0x564/0x1300 drivers/usb/core/hub.c:5729
usb_reset_device+0x4c1/0x920 drivers/usb/core/hub.c:5898
rt2x00usb_probe+0x53/0x7af
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:806
The error occurs when the descriptors_changed() routine (called during
a device reset) attempts to compare the old and new BOS and capability
descriptors. The length it uses for the comparison is the
wTotalLength value stored in BOS descriptor, but this value is not
necessarily the same as the length actually allocated for the
descriptors. If it is larger the routine will call memcmp() with a
length that is too big, thus reading beyond the end of the allocated
region and leading to this fault.
The kernel reads the BOS descriptor twice: first to get the total
length of all the capability descriptors, and second to read it along
with all those other descriptors. A malicious (or very faulty) device
may send different values for the BOS descriptor fields each time.
The memory area will be allocated using the wTotalLength value read
the first time, but stored within it will be the value read the second
time.
To prevent this possibility from causing any errors, this patch
modifies the BOS descriptor after it has been read the second time:
It sets the wTotalLength field to the actual length of the descriptors
that were read in and validated. Then the memcpy() call, or any other
code using these descriptors, will be able to rely on wTotalLength
being valid.
Reported-and-tested-by: syzbot+35f4d916c623118d576e(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909041154260.1722-100000@iolanth…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/config.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 9d6cb709ca7b..151a74a54386 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -921,7 +921,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
struct usb_bos_descriptor *bos;
struct usb_dev_cap_header *cap;
struct usb_ssp_cap_descriptor *ssp_cap;
- unsigned char *buffer;
+ unsigned char *buffer, *buffer0;
int length, total_len, num, i, ssac;
__u8 cap_type;
int ret;
@@ -966,10 +966,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
ret = -ENOMSG;
goto err;
}
+
+ buffer0 = buffer;
total_len -= length;
+ buffer += length;
for (i = 0; i < num; i++) {
- buffer += length;
cap = (struct usb_dev_cap_header *)buffer;
if (total_len < sizeof(*cap) || total_len < cap->bLength) {
@@ -983,8 +985,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
break;
}
- total_len -= length;
-
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
dev_warn(ddev, "descriptor type invalid, skip\n");
continue;
@@ -1019,7 +1019,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
default:
break;
}
+
+ total_len -= length;
+ buffer += length;
}
+ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
return 0;
--
2.23.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/142252
One or more kernel tests failed:
aarch64:
❌ Boot test
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the d911cedb6528 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
usbtmc-more-sanity-checking-for-packet-size.patch
usb-storage-add-new-jms567-revision-to-unusual_devs.patch
usb-cdc-wdm-fix-race-between-write-and-disconnect-due-to-flag-abuse.patch
usb-hcd-use-managed-device-resources.patch
usb-chipidea-udc-don-t-do-hardware-access-if-gadget-has-stopped.patch
usb-host-ohci-fix-a-race-condition-between-shutdown-and-irq.patch
usb-host-xhci-rcar-fix-typo-in-compatible-string-matching.patch
usb-storage-ums-realtek-update-module-parameter-description-for-auto_delink_en.patch
usb-storage-ums-realtek-whitelist-auto-delink-support.patch
tools-power-turbostat-fix-caller-parameter-of-get_tdp_amd.patch
kvm-ppc-book3s-fix-incorrect-guest-to-user-translation-error-handling.patch
kvm-arm-arm64-vgic-fix-potential-deadlock-when-ap_list-is-long.patch
kvm-arm-arm64-vgic-v2-handle-sgi-bits-in-gicd_i-s-c-pendr0-as-wi.patch
mei-me-add-tiger-lake-point-lp-device-id.patch
revert-mmc-sdhci-tegra-drop-get_ro-implementation.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
❌ Boot test [0]
⚡⚡⚡ selinux-policy: serge-testsuite [19]
🚧 ⚡⚡⚡ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [21]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [1]
⚡⚡⚡ Podman system integration test (as user) [1]
⚡⚡⚡ Loopdev Sanity [2]
⚡⚡⚡ jvm test suite [3]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [4]
⚡⚡⚡ LTP: openposix test suite [5]
⚡⚡⚡ Ethernet drivers sanity [6]
⚡⚡⚡ Networking socket: fuzz [7]
⚡⚡⚡ Networking: igmp conformance test [8]
⚡⚡⚡ audit: audit testsuite test [9]
⚡⚡⚡ httpd: mod_ssl smoke sanity [10]
⚡⚡⚡ iotop: sanity [11]
⚡⚡⚡ tuned: tune-processes-through-perf [12]
⚡⚡⚡ pciutils: sanity smoke test [22]
⚡⚡⚡ Usex - version 1.9-29 [13]
⚡⚡⚡ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ⚡⚡⚡ Memory function: kaslr [16]
🚧 ⚡⚡⚡ Networking ipsec: basic netns transport [17]
🚧 ⚡⚡⚡ Networking ipsec: basic netns tunnel [17]
🚧 ⚡⚡⚡ trace: ftrace/tracer [18]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch
regulator: Defer init completion for a while after late_initcall
has been applied to the regulator tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git for-5.4
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From 55576cf1853798e86f620766e23b604c9224c19c Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie(a)kernel.org>
Date: Wed, 4 Sep 2019 13:42:50 +0100
Subject: [PATCH] regulator: Defer init completion for a while after
late_initcall
The kernel has no way of knowing when we have finished instantiating
drivers, between deferred probe and systems that build key drivers as
modules we might be doing this long after userspace has booted. This has
always been a bit of an issue with regulator_init_complete since it can
power off hardware that's not had it's driver loaded which can result in
user visible effects, the main case is powering off displays. Practically
speaking it's not been an issue in real systems since most systems that
use the regulator API are embedded and build in key drivers anyway but
with Arm laptops coming on the market it's becoming more of an issue so
let's do something about it.
In the absence of any better idea just defer the powering off for 30s
after late_initcall(), this is obviously a hack but it should mask the
issue for now and it's no more arbitrary than late_initcall() itself.
Ideally we'd have some heuristics to detect if we're on an affected
system and tune or skip the delay appropriately, and there may be some
need for a command line option to be added.
Link: https://lore.kernel.org/r/20190904124250.25844-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Tested-by: Lee Jones <lee.jones(a)linaro.org>
Cc: stable(a)vger.kernel.org
---
drivers/regulator/core.c | 42 +++++++++++++++++++++++++++++-----------
1 file changed, 31 insertions(+), 11 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 4a27a46ec6e7..340db986b67f 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5644,7 +5644,7 @@ static int __init regulator_init(void)
/* init early to allow our consumers to complete system booting */
core_initcall(regulator_init);
-static int __init regulator_late_cleanup(struct device *dev, void *data)
+static int regulator_late_cleanup(struct device *dev, void *data)
{
struct regulator_dev *rdev = dev_to_rdev(dev);
const struct regulator_ops *ops = rdev->desc->ops;
@@ -5693,17 +5693,8 @@ static int __init regulator_late_cleanup(struct device *dev, void *data)
return 0;
}
-static int __init regulator_init_complete(void)
+static void regulator_init_complete_work_function(struct work_struct *work)
{
- /*
- * Since DT doesn't provide an idiomatic mechanism for
- * enabling full constraints and since it's much more natural
- * with DT to provide them just assume that a DT enabled
- * system has full constraints.
- */
- if (of_have_populated_dt())
- has_full_constraints = true;
-
/*
* Regulators may had failed to resolve their input supplies
* when were registered, either because the input supply was
@@ -5721,6 +5712,35 @@ static int __init regulator_init_complete(void)
*/
class_for_each_device(®ulator_class, NULL, NULL,
regulator_late_cleanup);
+}
+
+static DECLARE_DELAYED_WORK(regulator_init_complete_work,
+ regulator_init_complete_work_function);
+
+static int __init regulator_init_complete(void)
+{
+ /*
+ * Since DT doesn't provide an idiomatic mechanism for
+ * enabling full constraints and since it's much more natural
+ * with DT to provide them just assume that a DT enabled
+ * system has full constraints.
+ */
+ if (of_have_populated_dt())
+ has_full_constraints = true;
+
+ /*
+ * We punt completion for an arbitrary amount of time since
+ * systems like distros will load many drivers from userspace
+ * so consumers might not always be ready yet, this is
+ * particularly an issue with laptops where this might bounce
+ * the display off then on. Ideally we'd get a notification
+ * from userspace when this happens but we don't so just wait
+ * a bit and hope we waited long enough. It'd be better if
+ * we'd only do this on systems that need it, and a kernel
+ * command line option might be useful.
+ */
+ schedule_delayed_work(®ulator_init_complete_work,
+ msecs_to_jiffies(30000));
return 0;
}
--
2.20.1
This is a note to let you know that I've just added the patch titled
USB: usbcore: Fix slab-out-of-bounds bug during device reset
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 3dd550a2d36596a1b0ee7955da3b611c031d3873 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 4 Sep 2019 11:56:27 -0400
Subject: USB: usbcore: Fix slab-out-of-bounds bug during device reset
The syzbot fuzzer provoked a slab-out-of-bounds error in the USB core:
BUG: KASAN: slab-out-of-bounds in memcmp+0xa6/0xb0 lib/string.c:904
Read of size 1 at addr ffff8881d175bed6 by task kworker/0:3/2746
CPU: 0 PID: 2746 Comm: kworker/0:3 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
memcmp+0xa6/0xb0 lib/string.c:904
memcmp include/linux/string.h:400 [inline]
descriptors_changed drivers/usb/core/hub.c:5579 [inline]
usb_reset_and_verify_device+0x564/0x1300 drivers/usb/core/hub.c:5729
usb_reset_device+0x4c1/0x920 drivers/usb/core/hub.c:5898
rt2x00usb_probe+0x53/0x7af
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:806
The error occurs when the descriptors_changed() routine (called during
a device reset) attempts to compare the old and new BOS and capability
descriptors. The length it uses for the comparison is the
wTotalLength value stored in BOS descriptor, but this value is not
necessarily the same as the length actually allocated for the
descriptors. If it is larger the routine will call memcmp() with a
length that is too big, thus reading beyond the end of the allocated
region and leading to this fault.
The kernel reads the BOS descriptor twice: first to get the total
length of all the capability descriptors, and second to read it along
with all those other descriptors. A malicious (or very faulty) device
may send different values for the BOS descriptor fields each time.
The memory area will be allocated using the wTotalLength value read
the first time, but stored within it will be the value read the second
time.
To prevent this possibility from causing any errors, this patch
modifies the BOS descriptor after it has been read the second time:
It sets the wTotalLength field to the actual length of the descriptors
that were read in and validated. Then the memcpy() call, or any other
code using these descriptors, will be able to rely on wTotalLength
being valid.
Reported-and-tested-by: syzbot+35f4d916c623118d576e(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909041154260.1722-100000@iolanth…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/config.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 9d6cb709ca7b..151a74a54386 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -921,7 +921,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
struct usb_bos_descriptor *bos;
struct usb_dev_cap_header *cap;
struct usb_ssp_cap_descriptor *ssp_cap;
- unsigned char *buffer;
+ unsigned char *buffer, *buffer0;
int length, total_len, num, i, ssac;
__u8 cap_type;
int ret;
@@ -966,10 +966,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
ret = -ENOMSG;
goto err;
}
+
+ buffer0 = buffer;
total_len -= length;
+ buffer += length;
for (i = 0; i < num; i++) {
- buffer += length;
cap = (struct usb_dev_cap_header *)buffer;
if (total_len < sizeof(*cap) || total_len < cap->bLength) {
@@ -983,8 +985,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
break;
}
- total_len -= length;
-
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
dev_warn(ddev, "descriptor type invalid, skip\n");
continue;
@@ -1019,7 +1019,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
default:
break;
}
+
+ total_len -= length;
+ buffer += length;
}
+ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
return 0;
--
2.23.0
From: Ilya Leoshkevich <iii(a)linux.ibm.com>
[ Upstream commit bb2d267c448f4bc3a3389d97c56391cb779178ae ]
"masking, test in bounds 3" fails on s390, because
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0) ignores the top 32 bits of
BPF_REG_2. The reason is that JIT emits lcgfr instead of lcgr.
The associated comment indicates that the code was intended to
emit lcgr in the first place, it's just that the wrong opcode
was used.
Fix by using the correct opcode.
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Ilya Leoshkevich <iii(a)linux.ibm.com>
Acked-by: Vasily Gorbik <gor(a)linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/s390/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 727693e283da2..e53d410e88703 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -886,7 +886,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
break;
case BPF_ALU64 | BPF_NEG: /* dst = -dst */
/* lcgr %dst,%dst */
- EMIT4(0xb9130000, dst_reg, dst_reg);
+ EMIT4(0xb9030000, dst_reg, dst_reg);
break;
/*
* BPF_FROM_BE/LE
--
2.20.1
This ThinkCentre machine has a new realtek codec alc222, it is not
in the support list, we add it in the realtek.c then this machine
can apply FIXUPs for the realtek codec.
And this machine has two front mics which can't be handled
by PA so far, it uses the pin 0x18 and 0x19 as the front mics, as
a result the existing FIXUP ALC294_FIXUP_LENOVO_MIC_LOCATION doesn't
work on this machine. Fortunately another FIXUP
ALC283_FIXUP_HEADSET_MIC also can change the location for one of the
two mics on this machine.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang(a)canonical.com>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3b9583aa63c1..74697c1dd1d5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7151,6 +7151,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
@@ -9038,6 +9039,7 @@ static int patch_alc680(struct hda_codec *codec)
static const struct hda_device_id snd_hda_id_realtek[] = {
HDA_CODEC_ENTRY(0x10ec0215, "ALC215", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0221, "ALC221", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0222, "ALC222", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269),
--
2.17.1
S-35390A RTC chip allows to set the lower two digit of the Western calendar year (00 to 99) and links together with the auto calendar from the year 2000 to the year 2099. If we try to set year earlier than 2000 then hardware clock get reset to "epoch". This patch check for year value between 2000 to 2099 otherwise returns "EINVAL" error. In conclusion this patch restricts system to set hardware clock to set year below and above the year 2000 and 2099 respectively.
Signed-off-by: Aashish P Sonawane mailto:AashishPSonawane@eaton.com
Suggested-by: Meghan Saitwal mailto:MeghanSaitwal@eaton.com
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
index 84806ff763cf..aea52548571e 100644
--- a/drivers/rtc/rtc-s35390a.c
+++ b/drivers/rtc/rtc-s35390a.c
@@ -214,6 +214,9 @@ static int s35390a_rtc_set_time(struct device *dev, struct rtc_time *tm)
int i, err;
char buf[7], status;
+ if (tm->tm_year < 100 || tm->tm_year > 199)
+ return EINVAL;
+
dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d mday=%d, "
"mon=%d, year=%d, wday=%d\n", __func__, tm->tm_sec,
tm->tm_min, tm->tm_hour, tm->tm_mday, tm->tm_mon, tm->tm_year,
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 8619e5bdeee8b2c685d686281f2d2a6017c4bc15 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From d616b75cb793a0707345ccf4c6f239b6d16e1e5b Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From e1b19733d5a9e0aed3f5594a51b21601b4618578 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This bit was fliped on for "syncing dependencies between camera and
graphics". BSpec has no recollection why, and it is causing
unrecoverable GPU hangs with Vulkan compute workloads.
>From BSpec, setting bit5 to 0 enables relaxed padding requiremets for
buffers, 1D and 2D non-array, non-MSAA, non-mip-mapped linear surfaces;
and *must* be set to 0h on skl+ to ensure "Out of Bounds" case is
suppressed.
Reported-by: Jason Ekstrand <jason(a)jlekstrand.net>
Suggested-by: Jason Ekstrand <jason(a)jlekstrand.net>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110998
Fixes: 8424171e135c ("drm/i915/gen9: h/w w/a: syncing dependencies between camera and graphics")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Tested-by: denys.kostin(a)globallogic.com
Cc: Jason Ekstrand <jason(a)jlekstrand.net>
Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v4.1+
---
drivers/gpu/drm/i915/gt/intel_workarounds.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
index 8639fcccdb42..243d3f77be13 100644
--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
@@ -297,11 +297,6 @@ static void gen9_ctx_workarounds_init(struct intel_engine_cs *engine,
FLOW_CONTROL_ENABLE |
PARTIAL_INSTRUCTION_SHOOTDOWN_DISABLE);
- /* Syncing dependencies between camera and graphics:skl,bxt,kbl */
- if (!IS_COFFEELAKE(i915))
- WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN3,
- GEN9_DISABLE_OCL_OOB_SUPPRESS_LOGIC);
-
/* WaEnableYV12BugFixInHalfSliceChicken7:skl,bxt,kbl,glk,cfl */
/* WaEnableSamplerGPGPUPreemptionSupport:skl,bxt,kbl,cfl */
WA_SET_BIT_MASKED(GEN9_HALF_SLICE_CHICKEN7,
--
2.23.0
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b9500577d361522a3d9f14da8cf41dc1d824904e Mon Sep 17 00:00:00 2001
From: Luca Coelho <luciano.coelho(a)intel.com>
Date: Wed, 21 Aug 2019 20:17:32 +0300
Subject: [PATCH] iwlwifi: pcie: handle switching killer Qu B0 NICs to C0
We need to use a different firmware for C0 versions of killer Qu NICs.
Add structures for them and handle them in the if block that detects
C0 revisions.
Additionally, instead of having an inclusive check for QnJ devices,
make the selection exclusive, so that switching to QnJ is the
exception, not the default. This prevents us from having to add all
the non-QnJ cards to an exclusion list. To do so, only go into the
QnJ block if the device has an RF ID type HR and HW revision QnJ.
Cc: stable(a)vger.kernel.org # 5.2
Signed-off-by: Luca Coelho <luciano.coelho(a)intel.com>
Link: https://lore.kernel.org/r/20190821171732.2266-1-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index 1f500cddb3a7..55b713255b8e 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -556,6 +556,30 @@ const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0 = {
.max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
};
+const struct iwl_cfg killer1650s_2ax_cfg_qu_c0_hr_b0 = {
+ .name = "Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW)",
+ .fw_name_pre = IWL_QU_C_HR_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+ * so we need to restrict the size of transmitted aggregation to the
+ * HT size; mac80211 would otherwise pick the HE max (256) by default.
+ */
+ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg killer1650i_2ax_cfg_qu_c0_hr_b0 = {
+ .name = "Killer(R) Wi-Fi 6 AX1650s 160MHz Wireless Network Adapter (201D2W)",
+ .fw_name_pre = IWL_QU_C_HR_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+ * so we need to restrict the size of transmitted aggregation to the
+ * HT size; mac80211 would otherwise pick the HE max (256) by default.
+ */
+ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
const struct iwl_cfg iwl22000_2ax_cfg_jf = {
.name = "Intel(R) Dual Band Wireless AX 22000",
.fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index 1c1bf1b281cd..6c04f8223aff 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -577,6 +577,8 @@ extern const struct iwl_cfg iwl_ax1650i_cfg_quz_hr;
extern const struct iwl_cfg iwl_ax1650s_cfg_quz_hr;
extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
extern const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0;
+extern const struct iwl_cfg killer1650s_2ax_cfg_qu_c0_hr_b0;
+extern const struct iwl_cfg killer1650i_2ax_cfg_qu_c0_hr_b0;
extern const struct iwl_cfg killer1650x_2ax_cfg;
extern const struct iwl_cfg killer1650w_2ax_cfg;
extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 7c5aaeaf7fe5..d9ed53b7c768 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1062,6 +1062,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
iwl_trans->cfg = &iwl9560_2ac_cfg_qu_c0_jf_b0;
else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
iwl_trans->cfg = &iwl9560_2ac_160_cfg_qu_c0_jf_b0;
+ else if (iwl_trans->cfg == &killer1650s_2ax_cfg_qu_b0_hr_b0)
+ iwl_trans->cfg = &killer1650s_2ax_cfg_qu_c0_hr_b0;
+ else if (iwl_trans->cfg == &killer1650i_2ax_cfg_qu_b0_hr_b0)
+ iwl_trans->cfg = &killer1650i_2ax_cfg_qu_c0_hr_b0;
}
/* same thing for QuZ... */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 935e35dafce5..db62c8314603 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3602,12 +3602,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
}
} else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
- ((trans->cfg != &iwl_ax200_cfg_cc &&
- trans->cfg != &iwl_ax201_cfg_qu_hr &&
- trans->cfg != &killer1650x_2ax_cfg &&
- trans->cfg != &killer1650w_2ax_cfg &&
- trans->cfg != &iwl_ax201_cfg_quz_hr) ||
- trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
+ trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
u32 hw_status;
hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS);
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ddfd151f3def9258397fcde7a372205a2d661903 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Date: Mon, 26 Aug 2019 14:55:20 +1000
Subject: [PATCH] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation
error handling
H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from
a guest. Although we verify correctness of TCEs before we do anything
with the existing tables, there is a small window when a check in
kvmppc_tce_validate might pass and right after that the guest alters
the page of TCEs, causing an early exit from the handler and leaving
srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap)
(real mode) locked.
This fixes the bug by jumping to the common exit code with an appropriate
unlock.
Cc: stable(a)vger.kernel.org # v4.11+
Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index e99a14798ab0..c4b606fe73eb 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -660,8 +660,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
}
tce = be64_to_cpu(tce);
- if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua))
- return H_PARAMETER;
+ if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index f50bbeedfc66..b4f20f13b860 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -556,8 +556,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
unsigned long tce = be64_to_cpu(((u64 *)tces)[i]);
ua = 0;
- if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL))
- return H_PARAMETER;
+ if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
This is a note to let you know that I've just added the patch titled
phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From e6839c31a608e79f2057fab987dd814f5d3477e6 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Date: Tue, 6 Aug 2019 17:51:19 +0900
Subject: phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
The hardware manual should be revised, but the initial value of
VBCTRL.OCCLREN is set to 1 actually. If the bit is set, the hardware
clears VBCTRL.VBOUT and ADPCTRL.DRVVBUS registers automatically
when the hardware detects over-current signal from a USB power switch.
However, since the hardware doesn't have any registers which
indicates over-current, the driver cannot handle it at all. So, if
"is_otg_channel" hardware detects over-current, since ADPCTRL.DRVVBUS
register is cleared automatically, the channel cannot be used after
that.
To resolve this behavior, this patch sets the VBCTRL.OCCLREN to 0
to keep ADPCTRL.DRVVBUS even if the "is_otg_channel" hardware
detects over-current. (We assume a USB power switch itself protects
over-current and turns the VBUS off.)
This patch is inspired by a BSP patch from Kazuya Mizuguchi.
Fixes: 1114e2d31731 ("phy: rcar-gen3-usb2: change the mode to OTG on the combined channel")
Cc: <stable(a)vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 8ffba67568ec..b7f6b1324395 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -61,6 +61,7 @@
USB2_OBINT_IDDIGCHG)
/* VBCTRL */
+#define USB2_VBCTRL_OCCLREN BIT(16)
#define USB2_VBCTRL_DRVVBUSSEL BIT(8)
/* LINECTRL1 */
@@ -374,6 +375,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
writel(val, usb2_base + USB2_LINECTRL1);
val = readl(usb2_base + USB2_VBCTRL);
+ val &= ~USB2_VBCTRL_OCCLREN;
writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
val = readl(usb2_base + USB2_ADPCTRL);
writel(val | USB2_ADPCTRL_IDPULLUP, usb2_base + USB2_ADPCTRL);
--
2.23.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/142301
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 407a62af1176 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
usbtmc-more-sanity-checking-for-packet-size.patch
usb-storage-add-new-jms567-revision-to-unusual_devs.patch
usb-cdc-wdm-fix-race-between-write-and-disconnect-due-to-flag-abuse.patch
usb-hcd-use-managed-device-resources.patch
usb-chipidea-udc-don-t-do-hardware-access-if-gadget-has-stopped.patch
usb-host-ohci-fix-a-race-condition-between-shutdown-and-irq.patch
usb-host-xhci-rcar-fix-typo-in-compatible-string-matching.patch
usb-storage-ums-realtek-update-module-parameter-description-for-auto_delink_en.patch
usb-storage-ums-realtek-whitelist-auto-delink-support.patch
tools-power-turbostat-fix-caller-parameter-of-get_tdp_amd.patch
kvm-ppc-book3s-fix-incorrect-guest-to-user-translation-error-handling.patch
kvm-arm-arm64-vgic-fix-potential-deadlock-when-ap_list-is-long.patch
kvm-arm-arm64-vgic-v2-handle-sgi-bits-in-gicd_i-s-c-pendr0-as-wi.patch
mei-me-add-tiger-lake-point-lp-device-id.patch
revert-mmc-sdhci-tegra-drop-get_ro-implementation.patch
mmc-sdhci-of-at91-add-quirk-for-broken-hs200.patch
mmc-sdhci-cadence-enable-v4_mode-to-fix-adma-64-bit-addressing.patch
mmc-core-fix-init-of-sd-cards-reporting-an-invalid-vdd-range.patch
mmc-sdhci-sprd-fixed-incorrect-clock-divider.patch
mmc-sdhci-sprd-add-sdhci_quirk2_preset_value_broken.patch
stm-class-fix-a-double-free-of-stm_source_device.patch
intel_th-pci-add-support-for-another-lewisburg-pch.patch
intel_th-pci-add-tiger-lake-support.patch
typec-tcpm-fix-a-typo-in-the-comparison-of-pdo_max_voltage.patch
fsi-scom-don-t-abort-operations-for-minor-errors.patch
lkdtm-bugs-fix-build-error-in-lkdtm_exhaust_stack.patch
nfsv4-pnfs-fix-a-page-lock-leak-in-nfs_pageio_resend.patch
nfs-ensure-o_direct-reports-an-error-if-the-bytes-read-written-is-0.patch
revert-nfsv4-flexfiles-abort-i-o-early-if-the-layout-segment-was-invalidated.patch
lib-logic_pio-fix-rcu-usage.patch
lib-logic_pio-avoid-possible-overlap-for-unregistering-regions.patch
lib-logic_pio-add-logic_pio_unregister_range.patch
drm-amdgpu-add-aptx-quirk-for-dell-latitude-5495.patch
drm-amdgpu-fix-gfxoff-on-picasso-and-raven2.patch
drm-i915-don-t-deballoon-unused-ggtt-drm_mm_node-in-linux-guest.patch
drm-i915-call-dma_set_max_seg_size-in-i915_driver_hw_probe.patch
i2c-piix4-fix-port-selection-for-amd-family-16h-model-30h.patch
bus-hisi_lpc-unregister-logical-pio-range-to-avoid-potential-use-after-free.patch
bus-hisi_lpc-add-.remove-method-to-avoid-driver-unbind-crash.patch
vmci-release-resource-if-the-work-is-already-queued.patch
crypto-ccp-ignore-unconfigured-ccp-device-on-suspend-resume.patch
sunrpc-don-t-handle-errors-if-the-bind-connect-succeeded.patch
mt76-mt76x0u-do-not-reset-radio-on-resume.patch
mms-sdhci-sprd-add-sdhci_quirk_broken_card_detection.patch
mm-memcg-partially-revert-mm-memcontrol.c-keep-local-vm-counters-in-sync-with-the-hierarchical-ones.patch
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [21]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [1]
⚡⚡⚡ Podman system integration test (as user) [1]
⚡⚡⚡ Loopdev Sanity [2]
⚡⚡⚡ jvm test suite [3]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [4]
⚡⚡⚡ LTP: openposix test suite [5]
⚡⚡⚡ Ethernet drivers sanity [6]
⚡⚡⚡ Networking socket: fuzz [7]
⚡⚡⚡ Networking: igmp conformance test [8]
⚡⚡⚡ audit: audit testsuite test [9]
⚡⚡⚡ httpd: mod_ssl smoke sanity [10]
⚡⚡⚡ iotop: sanity [11]
⚡⚡⚡ tuned: tune-processes-through-perf [12]
⚡⚡⚡ pciutils: sanity smoke test [22]
⚡⚡⚡ Usex - version 1.9-29 [13]
⚡⚡⚡ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ⚡⚡⚡ Memory function: kaslr [16]
🚧 ⚡⚡⚡ Networking ipsec: basic netns transport [17]
🚧 ⚡⚡⚡ Networking ipsec: basic netns tunnel [17]
🚧 ⚡⚡⚡ trace: ftrace/tracer [18]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
On Thu, Aug 29, 2019 at 09:59:48AM +0000, David Laight wrote:
> From: Nathan Chancellor
> > Sent: 28 August 2019 19:45
> ...
> > However, I think that -fno-builtin-* would be appropriate here because
> > we are providing our own setjmp implementation, meaning clang should not
> > be trying to do anything with the builtin implementation like building a
> > declaration for it.
>
> Isn't implementing setjmp impossible unless you tell the compiler that
> you function is 'setjmp-like' ?
No idea, PowerPC is the only architecture that does such a thing.
https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/tree/arch…
Goes back all the way to before git history (all the way to ppc64's
addition actually):
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id…https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/arc…
I would just like this warning fixed given that PowerPC builds with
-Werror by default so it is causing a build failure in our CI.
Cheers,
Nathan
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c7c06a1532f3fe106687ac82a13492c6a619ff1c Mon Sep 17 00:00:00 2001
From: Andrew Cooks <andrew.cooks(a)opengear.com>
Date: Fri, 2 Aug 2019 14:52:46 +0200
Subject: [PATCH] i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Family 16h Model 30h SMBus controller needs the same port selection fix
as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port
selection for AMD Family 17h chips")
commit 6befa3fde65f ("i2c: piix4: Support alternative port selection
register") also fixed the port selection for Hudson2, but unfortunately
this is not the exact same device and the AMD naming and PCI Device IDs
aren't particularly helpful here.
The SMBus port selection register is common to the following Families
and models, as documented in AMD's publicly available BIOS and Kernel
Developer Guides:
50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS)
The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared
between Bolton FCH and Family 16h Model 30h, but the location of the
SmBus0Sel port selection bits are different:
51192 - Bolton Register Reference Guide
We distinguish between Bolton and Family 16h Model 30h using the PCI
Revision ID:
Bolton is device 0x780b, revision 0x15
Family 16h Model 30h is device 0x780b, revision 0x1F
Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A.
The following additional public AMD BKDG documents were checked and do
not share the same port selection register:
42301 - Family 15h Model 00h-0Fh doesn't mention any
42300 - Family 15h Model 10h-1Fh doesn't mention any
49125 - Family 15h Model 30h-3Fh doesn't mention any
48751 - Family 16h Model 00h-0Fh uses the previously supported
index register SB800_PIIX4_PORT_IDX_ALT at 0x2e
Signed-off-by: Andrew Cooks <andrew.cooks(a)opengear.com>
Signed-off-by: Jean Delvare <jdelvare(a)suse.de>
Cc: stable(a)vger.kernel.org [v4.6+]
Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index c46c4bddc7ca..cba325eb852f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -91,7 +91,7 @@
#define SB800_PIIX4_PORT_IDX_MASK 0x06
#define SB800_PIIX4_PORT_IDX_SHIFT 1
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
#define SB800_PIIX4_PORT_IDX_KERNCZ 0x02
#define SB800_PIIX4_PORT_IDX_MASK_KERNCZ 0x18
#define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ 3
@@ -358,18 +358,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
/* Find which register is used for port selection */
if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD ||
PIIX4_dev->vendor == PCI_VENDOR_ID_HYGON) {
- switch (PIIX4_dev->device) {
- case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+ if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+ (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+ PIIX4_dev->revision >= 0x1F)) {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
- break;
- case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
- default:
+ } else {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
- break;
}
} else {
if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5b6eefd667847ca6bd6925f7bd1afcecc457c889 Mon Sep 17 00:00:00 2001
From: Manasi Navare <manasi.d.navare(a)intel.com>
Date: Wed, 21 Aug 2019 14:59:50 -0700
Subject: [PATCH] drm/i915/dp: Fix DSC enable code to use cpu_transcoder
instead of encoder->type
This patch fixes the intel_configure_pps_for_dsc_encoder() function to use
cpu_transcoder instead of encoder->type to select the correct DSC registers
that was wrongly used in the original patch for one DSC register isntance.
Fixes: 7182414e2530 ("drm/i915/dp: Configure i915 Picture parameter Set registers during DSC enabling")
Cc: Ville Syrjala <ville.syrjala(a)linux.intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v5.0+
Signed-off-by: Manasi Navare <manasi.d.navare(a)intel.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190821215950.24223-1-manasi…
(cherry picked from commit d4c61c4a16decd8ace8660f22c81609a539fccba)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c
index ffec807b8960..f413904a3e96 100644
--- a/drivers/gpu/drm/i915/display/intel_vdsc.c
+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c
@@ -541,7 +541,7 @@ static void intel_configure_pps_for_dsc_encoder(struct intel_encoder *encoder,
pps_val |= DSC_PIC_HEIGHT(vdsc_cfg->pic_height) |
DSC_PIC_WIDTH(vdsc_cfg->pic_width / num_vdsc_instances);
DRM_INFO("PPS2 = 0x%08x\n", pps_val);
- if (encoder->type == INTEL_OUTPUT_EDP) {
+ if (cpu_transcoder == TRANSCODER_EDP) {
I915_WRITE(DSCA_PICTURE_PARAMETER_SET_2, pps_val);
/*
* If 2 VDSC instances are needed, configure PPS for second
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ed5fa90660d63bcec4c3a62b03fed9427418b53d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Tue, 20 Aug 2019 19:16:57 +0300
Subject: [PATCH] drm/i915: Do not create a new max_bpc prop for MST connectors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We're not allowed to create new properties after device registration
so for MST connectors we need to either create the max_bpc property
earlier, or we reuse one we already have. Let's do the latter apporach
since the corresponding SST connector already has the prop and its
min/max are correct also for the MST connector.
The problem was highlighted by commit 4f5368b5541a ("drm/kms:
Catch mode_object lifetime errors") which results in the following
spew:
[ 1330.878941] WARNING: CPU: 2 PID: 1554 at drivers/gpu/drm/drm_mode_object.c:45 __drm_mode_object_add+0xa0/0xb0 [drm]
...
[ 1330.879008] Call Trace:
[ 1330.879023] drm_property_create+0xba/0x180 [drm]
[ 1330.879036] drm_property_create_range+0x15/0x30 [drm]
[ 1330.879048] drm_connector_attach_max_bpc_property+0x62/0x80 [drm]
[ 1330.879086] intel_dp_add_mst_connector+0x11f/0x140 [i915]
[ 1330.879094] drm_dp_add_port.isra.20+0x20b/0x440 [drm_kms_helper]
...
Cc: stable(a)vger.kernel.org
Cc: Lyude Paul <lyude(a)redhat.com>
Cc: sunpeng.li(a)amd.com
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <sean(a)poorly.run>
Fixes: 5ca0ef8a56b8 ("drm/i915: Add max_bpc property for DP MST")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190820161657.9658-1-ville.s…
Reviewed-by: José Roberto de Souza <jose.souza(a)intel.com>
Reviewed-by: Lyude Paul <lyude(a)redhat.com>
(cherry picked from commit 1b9bd09630d4db4827cc04d358a41a16a6bc2cb0)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c
index 60652ebbdf61..18e4cba76720 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
@@ -539,7 +539,15 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
intel_attach_force_audio_property(connector);
intel_attach_broadcast_rgb_property(connector);
- drm_connector_attach_max_bpc_property(connector, 6, 12);
+
+ /*
+ * Reuse the prop from the SST connector because we're
+ * not allowed to create new props after device registration.
+ */
+ connector->max_bpc_property =
+ intel_dp->attached_connector->base.max_bpc_property;
+ if (connector->max_bpc_property)
+ drm_connector_attach_max_bpc_property(connector, 6, 12);
return connector;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2f765c175e1d1acae911f889e71e5933c6488929 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Wed, 28 Aug 2019 10:17:36 +0800
Subject: [PATCH] mmc: sdhci-sprd: clear the UHS-I modes read from registers
sprd's sd host controller supports SDR50/SDR104/DDR50 though, the UHS-I
mode used by the specific card can be selected via devicetree only.
Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Reviewed-by: Baolin Wang <baolin.wang(a)linaro.org>
Tested-by: Baolin Wang <baolin.wang(a)linaro.org>
Cc: stable(a)vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org>
diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index ba777f0c77d1..d07b9793380f 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -509,7 +509,8 @@ static void sdhci_sprd_phy_param_parse(struct sdhci_sprd_host *sprd_host,
static const struct sdhci_pltfm_data sdhci_sprd_pdata = {
.quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
- SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+ SDHCI_QUIRK_MISSING_CAPS,
.quirks2 = SDHCI_QUIRK2_BROKEN_HS200 |
SDHCI_QUIRK2_USE_32BIT_BLK_CNT |
SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
@@ -614,6 +615,16 @@ static int sdhci_sprd_probe(struct platform_device *pdev)
sdhci_enable_v4_mode(host);
+ /*
+ * Supply the existing CAPS, but clear the UHS-I modes. This
+ * will allow these modes to be specified only by device
+ * tree properties through mmc_of_parse().
+ */
+ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
+ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_SDR104 |
+ SDHCI_SUPPORT_DDR50);
+
ret = sdhci_setup_host(host);
if (ret)
goto pm_runtime_disable;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
This is a note to let you know that I've just added the patch titled
phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From e6839c31a608e79f2057fab987dd814f5d3477e6 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Date: Tue, 6 Aug 2019 17:51:19 +0900
Subject: phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
The hardware manual should be revised, but the initial value of
VBCTRL.OCCLREN is set to 1 actually. If the bit is set, the hardware
clears VBCTRL.VBOUT and ADPCTRL.DRVVBUS registers automatically
when the hardware detects over-current signal from a USB power switch.
However, since the hardware doesn't have any registers which
indicates over-current, the driver cannot handle it at all. So, if
"is_otg_channel" hardware detects over-current, since ADPCTRL.DRVVBUS
register is cleared automatically, the channel cannot be used after
that.
To resolve this behavior, this patch sets the VBCTRL.OCCLREN to 0
to keep ADPCTRL.DRVVBUS even if the "is_otg_channel" hardware
detects over-current. (We assume a USB power switch itself protects
over-current and turns the VBUS off.)
This patch is inspired by a BSP patch from Kazuya Mizuguchi.
Fixes: 1114e2d31731 ("phy: rcar-gen3-usb2: change the mode to OTG on the combined channel")
Cc: <stable(a)vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 8ffba67568ec..b7f6b1324395 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -61,6 +61,7 @@
USB2_OBINT_IDDIGCHG)
/* VBCTRL */
+#define USB2_VBCTRL_OCCLREN BIT(16)
#define USB2_VBCTRL_DRVVBUSSEL BIT(8)
/* LINECTRL1 */
@@ -374,6 +375,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
writel(val, usb2_base + USB2_LINECTRL1);
val = readl(usb2_base + USB2_VBCTRL);
+ val &= ~USB2_VBCTRL_OCCLREN;
writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
val = readl(usb2_base + USB2_ADPCTRL);
writel(val | USB2_ADPCTRL_IDPULLUP, usb2_base + USB2_ADPCTRL);
--
2.23.0
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c1c280805ded72eceb2afc1a0d431b256608554 Mon Sep 17 00:00:00 2001
From: Shakeel Butt <shakeelb(a)google.com>
Date: Fri, 30 Aug 2019 16:04:53 -0700
Subject: [PATCH] mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the
current cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a247cb163245..9ec5e12486a7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c7c06a1532f3fe106687ac82a13492c6a619ff1c Mon Sep 17 00:00:00 2001
From: Andrew Cooks <andrew.cooks(a)opengear.com>
Date: Fri, 2 Aug 2019 14:52:46 +0200
Subject: [PATCH] i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Family 16h Model 30h SMBus controller needs the same port selection fix
as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port
selection for AMD Family 17h chips")
commit 6befa3fde65f ("i2c: piix4: Support alternative port selection
register") also fixed the port selection for Hudson2, but unfortunately
this is not the exact same device and the AMD naming and PCI Device IDs
aren't particularly helpful here.
The SMBus port selection register is common to the following Families
and models, as documented in AMD's publicly available BIOS and Kernel
Developer Guides:
50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS)
The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared
between Bolton FCH and Family 16h Model 30h, but the location of the
SmBus0Sel port selection bits are different:
51192 - Bolton Register Reference Guide
We distinguish between Bolton and Family 16h Model 30h using the PCI
Revision ID:
Bolton is device 0x780b, revision 0x15
Family 16h Model 30h is device 0x780b, revision 0x1F
Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A.
The following additional public AMD BKDG documents were checked and do
not share the same port selection register:
42301 - Family 15h Model 00h-0Fh doesn't mention any
42300 - Family 15h Model 10h-1Fh doesn't mention any
49125 - Family 15h Model 30h-3Fh doesn't mention any
48751 - Family 16h Model 00h-0Fh uses the previously supported
index register SB800_PIIX4_PORT_IDX_ALT at 0x2e
Signed-off-by: Andrew Cooks <andrew.cooks(a)opengear.com>
Signed-off-by: Jean Delvare <jdelvare(a)suse.de>
Cc: stable(a)vger.kernel.org [v4.6+]
Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index c46c4bddc7ca..cba325eb852f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -91,7 +91,7 @@
#define SB800_PIIX4_PORT_IDX_MASK 0x06
#define SB800_PIIX4_PORT_IDX_SHIFT 1
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
#define SB800_PIIX4_PORT_IDX_KERNCZ 0x02
#define SB800_PIIX4_PORT_IDX_MASK_KERNCZ 0x18
#define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ 3
@@ -358,18 +358,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
/* Find which register is used for port selection */
if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD ||
PIIX4_dev->vendor == PCI_VENDOR_ID_HYGON) {
- switch (PIIX4_dev->device) {
- case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+ if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+ (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+ PIIX4_dev->revision >= 0x1F)) {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
- break;
- case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
- default:
+ } else {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
- break;
}
} else {
if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}