From: Luca Coelho <luciano.coelho(a)intel.com>
Firmware versions before 41 don't support the GEO_TX_POWER_LIMIT
command, and sending it to the firmware will cause a firmware crash.
We allow this via debugfs, so we need to return an error value in case
it's not supported.
This had already been fixed during init, when we send the command if
the ACPI WGDS table is present. Fix it also for the other,
userspace-triggered case.
Cc: stable(a)vger.kernel.org
Signed-off-by: Luca Coelho <luciano.coelho(a)intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 22 ++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 1d608e9e9101..a837cf40afde 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -880,6 +880,17 @@ int iwl_mvm_sar_select_profile(struct iwl_mvm *mvm, int prof_a, int prof_b)
return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
}
+static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
+{
+ /*
+ * The GEO_TX_POWER_LIMIT command is not supported on earlier
+ * firmware versions. Unfortunately, we don't have a TLV API
+ * flag to rely on, so rely on the major version which is in
+ * the first byte of ucode_ver.
+ */
+ return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 41;
+}
+
int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
{
struct iwl_geo_tx_power_profiles_resp *resp;
@@ -909,6 +920,9 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
.data = { data },
};
+ if (!iwl_mvm_sar_geo_support(mvm))
+ return -EOPNOTSUPP;
+
ret = iwl_mvm_send_cmd(mvm, &cmd);
if (ret) {
IWL_ERR(mvm, "Failed to get geographic profile info %d\n", ret);
@@ -934,13 +948,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
int ret, i, j;
u16 cmd_wide_id = WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
- /*
- * This command is not supported on earlier firmware versions.
- * Unfortunately, we don't have a TLV API flag to rely on, so
- * rely on the major version which is in the first byte of
- * ucode_ver.
- */
- if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
+ if (!iwl_mvm_sar_geo_support(mvm))
return 0;
ret = iwl_mvm_sar_get_wgds_table(mvm);
--
2.20.1
This is the start of the stable review cycle for the 4.19.60 release.
There are 47 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.60-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.60-rc1
Jiri Slaby <jslaby(a)suse.cz>
x86/entry/32: Fix ENDPROC of common_spurious
Dave Airlie <airlied(a)redhat.com>
drm/udl: move to embedding drm device inside udl device.
Thomas Zimmermann <tzimmermann(a)suse.de>
drm/udl: Replace drm_dev_unref with drm_dev_put
Dave Airlie <airlied(a)redhat.com>
drm/udl: introduce a macro to convert dev to udl.
Mark Zhang <markz(a)nvidia.com>
regmap-irq: do not write mask register if mask_base is zero
Haren Myneni <haren(a)linux.vnet.ibm.com>
crypto/NX: Set receive window credits to max number of CRBs in RxFIFO
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix hash on SEC1.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - move struct talitos_edesc into talitos.h
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Seperate unused system vectors from spurious entry again
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Handle spurious interrupt after shutdown gracefully
Thomas Gleixner <tglx(a)linutronix.de>
x86/ioapic: Implement irq_get_irqchip_state() callback
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Add optional hardware synchronization for shutdown
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Fix misleading synchronize_irq() documentation
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Delay deactivation in free_irq()
Vinod Koul <vkoul(a)kernel.org>
linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL
Nicolas Boichat <drinkcat(a)chromium.org>
pinctrl: mediatek: Update cur_mask in mask/mask ops
Eiichi Tsukata <devel(a)etsukata.com>
cpu/hotplug: Fix out-of-bounds read when setting fail state
Nicolas Boichat <drinkcat(a)chromium.org>
pinctrl: mediatek: Ignore interrupts that are wake only during resume
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: multitouch: Add pointstick support for ALPS Touchpad
Oleksandr Natalenko <oleksandr(a)redhat.com>
HID: chicony: add another quirk for PixArt mouse
Kirill A. Shutemov <kirill(a)shutemov.name>
x86/boot/64: Add missing fixup_pointer() for next_early_pgt access
Kirill A. Shutemov <kirill(a)shutemov.name>
x86/boot/64: Fix crash if kernel image crosses page table boundary
Milan Broz <gmazyland(a)gmail.com>
dm verity: use message limit for data block corruption message
Jerome Marchand <jmarchan(a)redhat.com>
dm table: don't copy from a NULL pointer in realloc_argv()
Phil Reid <preid(a)electromag.com.au>
pinctrl: mcp23s08: Fix add_data and irqchip_add_nested call order
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ARM: dts: imx6ul: fix PWM[1-4] interrupts
Sergej Benilov <sergej.benilov(a)googlemail.com>
sis900: fix TX completion
Takashi Iwai <tiwai(a)suse.de>
ppp: mppe: Add softdep to arc4
Petr Oros <poros(a)redhat.com>
be2net: fix link failure after ethtool offline test
Colin Ian King <colin.king(a)canonical.com>
x86/apic: Fix integer overflow on 10 bit left shift of cpu_khz
David Howells <dhowells(a)redhat.com>
afs: Fix uninitialised spinlock afs_volume::cb_break_lock
Arnd Bergmann <arnd(a)arndb.de>
ARM: omap2: remove incorrect __init annotation
Linus Walleij <linus.walleij(a)linaro.org>
ARM: dts: gemini Fix up DNS-313 compatible string
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix perf_sample_regs_user() mm check
Hans de Goede <hdegoede(a)redhat.com>
efi/bgrt: Drop BGRT status field reserved bits check
Tony Lindgren <tony(a)atomide.com>
clk: ti: clkctrl: Fix returning uninitialized data
Heyi Guo <guoheyi(a)huawei.com>
irqchip/gic-v3-its: Fix command queue pointer comparison bug
Sven Van Asbroeck <thesven73(a)gmail.com>
firmware: improve LSM/IMA security behaviour
James Morse <james.morse(a)arm.com>
drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT
Masahiro Yamada <yamada.masahiro(a)socionext.com>
nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
Cole Rogers <colerogers(a)disroot.org>
Input: synaptics - enable SMBUS on T480 thinkpad trackpad
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Revert "e1000e: fix cyclic resets at link up with active tx"
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 ++-
arch/arm/boot/dts/gemini-dlink-dns-313.dts | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 8 +--
arch/arm/mach-omap2/prm3xxx.c | 2 +-
arch/s390/include/asm/facility.h | 21 ++++--
arch/x86/entry/entry_32.S | 24 +++++++
arch/x86/entry/entry_64.S | 30 ++++++--
arch/x86/include/asm/hw_irq.h | 5 +-
arch/x86/kernel/apic/apic.c | 36 ++++++----
arch/x86/kernel/apic/io_apic.c | 46 ++++++++++++
arch/x86/kernel/apic/vector.c | 4 +-
arch/x86/kernel/head64.c | 20 +++---
arch/x86/kernel/idt.c | 3 +-
arch/x86/kernel/irq.c | 2 +-
drivers/base/cacheinfo.c | 3 +-
drivers/base/firmware_loader/fallback.c | 2 +-
drivers/base/regmap/regmap-irq.c | 6 ++
drivers/clk/ti/clkctrl.c | 7 +-
drivers/crypto/nx/nx-842-powernv.c | 8 ++-
drivers/crypto/talitos.c | 99 +++++++++++---------------
drivers/crypto/talitos.h | 30 ++++++++
drivers/firmware/efi/efi-bgrt.c | 5 --
drivers/gpu/drm/udl/udl_drv.c | 56 ++++++++++++---
drivers/gpu/drm/udl/udl_drv.h | 9 +--
drivers/gpu/drm/udl/udl_fb.c | 12 ++--
drivers/gpu/drm/udl/udl_gem.c | 2 +-
drivers/gpu/drm/udl/udl_main.c | 35 +++------
drivers/hid/hid-ids.h | 2 +
drivers/hid/hid-multitouch.c | 4 ++
drivers/hid/hid-quirks.c | 1 +
drivers/input/mouse/synaptics.c | 1 +
drivers/irqchip/irq-gic-v3-its.c | 35 ++++++---
drivers/md/dm-table.c | 2 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 ++++++--
drivers/net/ethernet/intel/e1000e/netdev.c | 21 +++---
drivers/net/ethernet/sis/sis900.c | 16 ++---
drivers/net/ppp/ppp_mppe.c | 1 +
drivers/pinctrl/mediatek/mtk-eint.c | 34 +++++----
drivers/pinctrl/pinctrl-mcp23s08.c | 8 +--
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
fs/afs/callback.c | 4 +-
fs/afs/internal.h | 2 +-
fs/afs/volume.c | 1 +
include/linux/cpuhotplug.h | 1 +
include/linux/kernel.h | 3 +-
include/uapi/linux/nilfs2_ondisk.h | 24 +++----
kernel/cpu.c | 3 +
kernel/events/core.c | 2 +-
kernel/irq/autoprobe.c | 6 +-
kernel/irq/chip.c | 6 ++
kernel/irq/cpuhotplug.c | 2 +-
kernel/irq/internals.h | 5 ++
kernel/irq/manage.c | 88 +++++++++++++++++------
56 files changed, 534 insertions(+), 267 deletions(-)
If a KVM guest is reset while running a nested guest, free_nested will
disable the shadow VMCS execution control in the vmcs01. However,
on the next KVM_RUN vmx_vcpu_run would nevertheless try to sync
the VMCS12 to the shadow VMCS which has since been freed.
This causes a vmptrld of a NULL pointer on my machime, but Jan reports
the host to hang altogether. Let's see how much this trivial patch fixes.
Reported-by: Jan Kiszka <jan.kiszka(a)siemens.com>
Cc: Liran Alon <liran.alon(a)oracle.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
---
arch/x86/kvm/vmx/nested.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 4f23e34f628b..0f1378789bd0 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -194,6 +194,7 @@ static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
{
secondary_exec_controls_clearbit(vmx, SECONDARY_EXEC_SHADOW_VMCS);
vmcs_write64(VMCS_LINK_POINTER, -1ull);
+ vmx->nested.need_vmcs12_to_shadow_sync = false;
}
static inline void nested_release_evmcs(struct kvm_vcpu *vcpu)
@@ -1341,6 +1342,9 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
unsigned long val;
int i;
+ if (WARN_ON(!shadow_vmcs))
+ return;
+
preempt_disable();
vmcs_load(shadow_vmcs);
@@ -1373,6 +1377,9 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
unsigned long val;
int i, q;
+ if (WARN_ON(!shadow_vmcs))
+ return;
+
vmcs_load(shadow_vmcs);
for (q = 0; q < ARRAY_SIZE(fields); q++) {
@@ -4436,7 +4443,6 @@ static inline void nested_release_vmcs12(struct kvm_vcpu *vcpu)
/* copy to memory all shadowed fields in case
they were modified */
copy_shadow_to_vmcs12(vmx);
- vmx->nested.need_vmcs12_to_shadow_sync = false;
vmx_disable_shadow_vmcs(vmx);
}
vmx->nested.posted_intr_nv = -1;
--
1.8.3.1
The livelock can be triggerred in the following pattern,
while (index < end && pagevec_lookup_entries(&pvec, mapping, index,
min(end - index, (pgoff_t)PAGEVEC_SIZE),
indices)) {
...
for (i = 0; i < pagevec_count(&pvec); i++) {
index = indices[i];
...
}
index++; /* BUG */
}
multi order exceptional entry is not specially considered in
invalidate_inode_pages2_range() and it ended up with a livelock because
both index 0 and index 1 finds the same pmd, but this pmd is binded to
index 0, so index is set to 0 again.
This introduces a helper to take the pmd entry's length into account when
deciding the next index.
Note that there're other users of the above pattern which doesn't need to
fix,
- dax_layout_busy_page
It's been fixed in commit d7782145e1ad
("filesystem-dax: Fix dax_layout_busy_page() livelock")
- truncate_inode_pages_range
This won't loop forever since the exceptional entries are immediately
removed from radix tree after the search.
Fixes: 642261a ("dax: add struct iomap based DAX PMD support")
Cc: <stable(a)vger.kernel.org> since 4.9 to 4.19
Signed-off-by: Liu Bo <bo.liu(a)linux.alibaba.com>
---
The problem is gone after commit f280bf092d48 ("page cache: Convert
find_get_entries to XArray"), but since xarray seems too new to backport
to 4.19, I made this fix based on radix tree implementation.
fs/dax.c | 19 +++++++++++++++++++
include/linux/dax.h | 8 ++++++++
mm/truncate.c | 26 ++++++++++++++++++++++++--
3 files changed, 51 insertions(+), 2 deletions(-)
diff --git a/fs/dax.c b/fs/dax.c
index ac334bc..cd05337 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -764,6 +764,25 @@ int dax_invalidate_mapping_entry_sync(struct address_space *mapping,
return __dax_invalidate_mapping_entry(mapping, index, false);
}
+pgoff_t dax_get_multi_order(struct address_space *mapping, pgoff_t index,
+ void *entry)
+{
+ struct radix_tree_root *pages = &mapping->i_pages;
+ pgoff_t nr_pages = 1;
+
+ if (!dax_mapping(mapping))
+ return nr_pages;
+
+ xa_lock_irq(pages);
+ entry = get_unlocked_mapping_entry(mapping, index, NULL);
+ if (entry)
+ nr_pages = 1UL << dax_radix_order(entry);
+ put_unlocked_mapping_entry(mapping, index, entry);
+ xa_unlock_irq(pages);
+
+ return nr_pages;
+}
+
static int copy_user_dax(struct block_device *bdev, struct dax_device *dax_dev,
sector_t sector, size_t size, struct page *to,
unsigned long vaddr)
diff --git a/include/linux/dax.h b/include/linux/dax.h
index a846184..f3c95c6 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -91,6 +91,8 @@ int dax_writeback_mapping_range(struct address_space *mapping,
struct page *dax_layout_busy_page(struct address_space *mapping);
bool dax_lock_mapping_entry(struct page *page);
void dax_unlock_mapping_entry(struct page *page);
+pgoff_t dax_get_multi_order(struct address_space *mapping, pgoff_t index,
+ void *entry);
#else
static inline bool bdev_dax_supported(struct block_device *bdev,
int blocksize)
@@ -134,6 +136,12 @@ static inline bool dax_lock_mapping_entry(struct page *page)
static inline void dax_unlock_mapping_entry(struct page *page)
{
}
+
+static inline pgoff_t dax_get_multi_order(struct address_space *mapping,
+ pgoff_t index, void *entry)
+{
+ return 1;
+}
#endif
int dax_read_lock(void);
diff --git a/mm/truncate.c b/mm/truncate.c
index 71b65aa..835911f 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -557,6 +557,8 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
while (index <= end && pagevec_lookup_entries(&pvec, mapping, index,
min(end - index, (pgoff_t)PAGEVEC_SIZE - 1) + 1,
indices)) {
+ pgoff_t nr_pages = 1;
+
for (i = 0; i < pagevec_count(&pvec); i++) {
struct page *page = pvec.pages[i];
@@ -568,6 +570,15 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
if (radix_tree_exceptional_entry(page)) {
invalidate_exceptional_entry(mapping, index,
page);
+ /*
+ * Account for multi-order entries at
+ * the end of the pagevec.
+ */
+ if (i < pagevec_count(&pvec) - 1)
+ continue;
+
+ nr_pages = dax_get_multi_order(mapping, index,
+ page);
continue;
}
@@ -607,7 +618,7 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
pagevec_remove_exceptionals(&pvec);
pagevec_release(&pvec);
cond_resched();
- index++;
+ index += nr_pages;
}
return count;
}
@@ -688,6 +699,8 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
while (index <= end && pagevec_lookup_entries(&pvec, mapping, index,
min(end - index, (pgoff_t)PAGEVEC_SIZE - 1) + 1,
indices)) {
+ pgoff_t nr_pages = 1;
+
for (i = 0; i < pagevec_count(&pvec); i++) {
struct page *page = pvec.pages[i];
@@ -700,6 +713,15 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
if (!invalidate_exceptional_entry2(mapping,
index, page))
ret = -EBUSY;
+ /*
+ * Account for multi-order entries at
+ * the end of the pagevec.
+ */
+ if (i < pagevec_count(&pvec) - 1)
+ continue;
+
+ nr_pages = dax_get_multi_order(mapping, index,
+ page);
continue;
}
@@ -739,7 +761,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
pagevec_remove_exceptionals(&pvec);
pagevec_release(&pvec);
cond_resched();
- index++;
+ index += nr_pages;
}
/*
* For DAX we invalidate page tables after invalidating radix tree. We
--
1.8.3.1
The patch titled
Subject: mm/hmm: fix bad subpage pointer in try_to_unmap_one
has been added to the -mm tree. Its filename is
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hmm-fix-bad-subpage-pointer-in-…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hmm-fix-bad-subpage-pointer-in-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Ralph Campbell <rcampbell(a)nvidia.com>
Subject: mm/hmm: fix bad subpage pointer in try_to_unmap_one
When migrating an anonymous private page to a ZONE_DEVICE private page,
the source page->mapping and page->index fields are copied to the
destination ZONE_DEVICE struct page and the page_mapcount() is increased.
This is so rmap_walk() can be used to unmap and migrate the page back to
system memory. However, try_to_unmap_one() computes the subpage pointer
from a swap pte which computes an invalid page pointer and a kernel panic
results such as:
BUG: unable to handle page fault for address: ffffea1fffffffc8
Currently, only single pages can be migrated to device private memory so
no subpage computation is needed and it can be set to "page".
Link: http://lkml.kernel.org/r/20190719192955.30462-4-rcampbell@nvidia.com
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/rmap.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/rmap.c~mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one
+++ a/mm/rmap.c
@@ -1476,6 +1476,7 @@ static bool try_to_unmap_one(struct page
* No need to invalidate here it will synchronize on
* against the special swap migration pte.
*/
+ subpage = page;
goto discard;
}
_
Patches currently in -mm which might be from rcampbell(a)nvidia.com are
mm-document-zone-device-struct-page-field-usage.patch
mm-hmm-fix-zone_device-anon-page-mapping-reuse.patch
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
The patch titled
Subject: mm/hmm: fix ZONE_DEVICE anon page mapping reuse
has been added to the -mm tree. Its filename is
mm-hmm-fix-zone_device-anon-page-mapping-reuse.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hmm-fix-zone_device-anon-page-m…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hmm-fix-zone_device-anon-page-m…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Ralph Campbell <rcampbell(a)nvidia.com>
Subject: mm/hmm: fix ZONE_DEVICE anon page mapping reuse
When a ZONE_DEVICE private page is freed, the page->mapping field can be
set. If this page is reused as an anonymous page, the previous value can
prevent the page from being inserted into the CPU's anon rmap table. For
example, when migrating a pte_none() page to device memory:
migrate_vma(ops, vma, start, end, src, dst, private)
migrate_vma_collect()
src[] = MIGRATE_PFN_MIGRATE
migrate_vma_prepare()
/* no page to lock or isolate so OK */
migrate_vma_unmap()
/* no page to unmap so OK */
ops->alloc_and_copy()
/* driver allocates ZONE_DEVICE page for dst[] */
migrate_vma_pages()
migrate_vma_insert_page()
page_add_new_anon_rmap()
__page_set_anon_rmap()
/* This check sees the page's stale mapping field */
if (PageAnon(page))
return
/* page->mapping is not updated */
The result is that the migration appears to succeed but a subsequent CPU
fault will be unable to migrate the page back to system memory or worse.
Clear the page->mapping field when freeing the ZONE_DEVICE page so stale
pointer data doesn't affect future page use.
Link: http://lkml.kernel.org/r/20190719192955.30462-3-rcampbell@nvidia.com
Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Jan Kara <jack(a)suse.cz>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
Cc: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/memremap.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/kernel/memremap.c~mm-hmm-fix-zone_device-anon-page-mapping-reuse
+++ a/kernel/memremap.c
@@ -397,6 +397,30 @@ void __put_devmap_managed_page(struct pa
mem_cgroup_uncharge(page);
+ /*
+ * When a device_private page is freed, the page->mapping field
+ * may still contain a (stale) mapping value. For example, the
+ * lower bits of page->mapping may still identify the page as
+ * an anonymous page. Ultimately, this entire field is just
+ * stale and wrong, and it will cause errors if not cleared.
+ * One example is:
+ *
+ * migrate_vma_pages()
+ * migrate_vma_insert_page()
+ * page_add_new_anon_rmap()
+ * __page_set_anon_rmap()
+ * ...checks page->mapping, via PageAnon(page) call,
+ * and incorrectly concludes that the page is an
+ * anonymous page. Therefore, it incorrectly,
+ * silently fails to set up the new anon rmap.
+ *
+ * For other types of ZONE_DEVICE pages, migration is either
+ * handled differently or not done at all, so there is no need
+ * to clear page->mapping.
+ */
+ if (is_device_private_page(page))
+ page->mapping = NULL;
+
page->pgmap->ops->page_free(page);
} else if (!count)
__put_page(page);
_
Patches currently in -mm which might be from rcampbell(a)nvidia.com are
mm-document-zone-device-struct-page-field-usage.patch
mm-hmm-fix-zone_device-anon-page-mapping-reuse.patch
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
The patch titled
Subject: mm: document zone device struct page field usage
has been added to the -mm tree. Its filename is
mm-document-zone-device-struct-page-field-usage.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-document-zone-device-struct-pag…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-document-zone-device-struct-pag…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Ralph Campbell <rcampbell(a)nvidia.com>
Subject: mm: document zone device struct page field usage
Struct page for ZONE_DEVICE private pages uses the page->mapping and and
page->index fields while the source anonymous pages are migrated to device
private memory. This is so rmap_walk() can find the page when migrating
the ZONE_DEVICE private page back to system memory. ZONE_DEVICE pmem
backed fsdax pages also use the page->mapping and page->index fields when
files are mapped into a process address space.
Restructure struct page and add comments to make this more clear.
Link: http://lkml.kernel.org/r/20190719192955.30462-2-rcampbell@nvidia.com
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Reviewed-by: John Hubbard <jhubbard(a)nvidia.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Jérôme Glisse <jglisse(a)redhat.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
Cc: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/mm_types.h | 42 +++++++++++++++++++++++++------------
1 file changed, 29 insertions(+), 13 deletions(-)
--- a/include/linux/mm_types.h~mm-document-zone-device-struct-page-field-usage
+++ a/include/linux/mm_types.h
@@ -76,13 +76,35 @@ struct page {
* avoid collision and false-positive PageTail().
*/
union {
- struct { /* Page cache and anonymous pages */
- /**
- * @lru: Pageout list, eg. active_list protected by
- * pgdat->lru_lock. Sometimes used as a generic list
- * by the page owner.
- */
- struct list_head lru;
+ struct { /* Page cache, anonymous, ZONE_DEVICE pages */
+ union {
+ /**
+ * @lru: Pageout list, e.g., active_list
+ * protected by pgdat->lru_lock. Sometimes
+ * used as a generic list by the page owner.
+ */
+ struct list_head lru;
+ /**
+ * ZONE_DEVICE pages are never on the lru
+ * list so they reuse the list space.
+ * ZONE_DEVICE private pages are counted as
+ * being mapped so the @mapping and @index
+ * fields are used while the page is migrated
+ * to device private memory.
+ * ZONE_DEVICE MEMORY_DEVICE_FS_DAX pages also
+ * use the @mapping and @index fields when pmem
+ * backed DAX files are mapped.
+ */
+ struct {
+ /**
+ * @pgmap: Points to the hosting
+ * device page map.
+ */
+ struct dev_pagemap *pgmap;
+ /** @zone_device_data: opaque data. */
+ void *zone_device_data;
+ };
+ };
/* See page-flags.h for PAGE_MAPPING_FLAGS */
struct address_space *mapping;
pgoff_t index; /* Our offset within mapping. */
@@ -155,12 +177,6 @@ struct page {
spinlock_t ptl;
#endif
};
- struct { /* ZONE_DEVICE pages */
- /** @pgmap: Points to the hosting device page map. */
- struct dev_pagemap *pgmap;
- void *zone_device_data;
- unsigned long _zd_pad_1; /* uses mapping */
- };
/** @rcu_head: You can use this to free a page by RCU. */
struct rcu_head rcu_head;
_
Patches currently in -mm which might be from rcampbell(a)nvidia.com are
mm-document-zone-device-struct-page-field-usage.patch
mm-hmm-fix-zone_device-anon-page-mapping-reuse.patch
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
The patch titled
Subject: mm/hmm: fix bad subpage pointer in try_to_unmap_one
has been removed from the -mm tree. Its filename was
mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Ralph Campbell <rcampbell(a)nvidia.com>
Subject: mm/hmm: fix bad subpage pointer in try_to_unmap_one
When migrating a ZONE device private page from device memory to system
memory, the subpage pointer is initialized from a swap pte which computes
an invalid page pointer. A kernel panic results such as:
BUG: unable to handle page fault for address: ffffea1fffffffc8
Initialize subpage correctly before calling page_remove_rmap().
Link: http://lkml.kernel.org/r/20190709223556.28908-1-rcampbell@nvidia.com
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/rmap.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/rmap.c~mm-hmm-fix-bad-subpage-pointer-in-try_to_unmap_one
+++ a/mm/rmap.c
@@ -1476,6 +1476,7 @@ static bool try_to_unmap_one(struct page
* No need to invalidate here it will synchronize on
* against the special swap migration pte.
*/
+ subpage = page;
goto discard;
}
_
Patches currently in -mm which might be from rcampbell(a)nvidia.com are
When migrating an anonymous private page to a ZONE_DEVICE private page,
the source page->mapping and page->index fields are copied to the
destination ZONE_DEVICE struct page and the page_mapcount() is increased.
This is so rmap_walk() can be used to unmap and migrate the page back to
system memory. However, try_to_unmap_one() computes the subpage pointer
from a swap pte which computes an invalid page pointer and a kernel panic
results such as:
BUG: unable to handle page fault for address: ffffea1fffffffc8
Currently, only single pages can be migrated to device private memory so
no subpage computation is needed and it can be set to "page".
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/rmap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/rmap.c b/mm/rmap.c
index e5dfe2ae6b0d..ec1af8b60423 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1476,6 +1476,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
* No need to invalidate here it will synchronize on
* against the special swap migration pte.
*/
+ subpage = page;
goto discard;
}
--
2.20.1
When migrating an anonymous private page to a ZONE_DEVICE private page,
the source page->mapping and page->index fields are copied to the
destination ZONE_DEVICE struct page and the page_mapcount() is increased.
This is so rmap_walk() can be used to unmap and migrate the page back to
system memory. However, try_to_unmap_one() computes the subpage pointer
from a swap pte which computes an invalid page pointer and a kernel panic
results such as:
BUG: unable to handle page fault for address: ffffea1fffffffc8
Currently, only single pages can be migrated to device private memory so
no subpage computation is needed and it can be set to "page".
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/rmap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/rmap.c b/mm/rmap.c
index e5dfe2ae6b0d..ec1af8b60423 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1476,6 +1476,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
* No need to invalidate here it will synchronize on
* against the special swap migration pte.
*/
+ subpage = page;
goto discard;
}
--
2.20.1
When a ZONE_DEVICE private page is freed, the page->mapping field can be
set. If this page is reused as an anonymous page, the previous value can
prevent the page from being inserted into the CPU's anon rmap table.
For example, when migrating a pte_none() page to device memory:
migrate_vma(ops, vma, start, end, src, dst, private)
migrate_vma_collect()
src[] = MIGRATE_PFN_MIGRATE
migrate_vma_prepare()
/* no page to lock or isolate so OK */
migrate_vma_unmap()
/* no page to unmap so OK */
ops->alloc_and_copy()
/* driver allocates ZONE_DEVICE page for dst[] */
migrate_vma_pages()
migrate_vma_insert_page()
page_add_new_anon_rmap()
__page_set_anon_rmap()
/* This check sees the page's stale mapping field */
if (PageAnon(page))
return
/* page->mapping is not updated */
The result is that the migration appears to succeed but a subsequent CPU
fault will be unable to migrate the page back to system memory or worse.
Clear the page->mapping field when freeing the ZONE_DEVICE page so stale
pointer data doesn't affect future page use.
Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Jan Kara <jack(a)suse.cz>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
---
kernel/memremap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/memremap.c b/kernel/memremap.c
index bea6f887adad..238ae5d0ae8a 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -408,6 +408,10 @@ void __put_devmap_managed_page(struct page *page)
mem_cgroup_uncharge(page);
+ /* Clear anonymous page mapping to prevent stale pointers */
+ if (is_device_private_page(page))
+ page->mapping = NULL;
+
page->pgmap->ops->page_free(page);
} else if (!count)
__put_page(page);
--
2.20.1
This is the start of the stable review cycle for the 5.2.2 release.
There are 21 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.2.2-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.2.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.2.2-rc1
Jiri Slaby <jslaby(a)suse.cz>
x86/entry/32: Fix ENDPROC of common_spurious
Haren Myneni <haren(a)linux.vnet.ibm.com>
crypto/NX: Set receive window credits to max number of CRBs in RxFIFO
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix hash on SEC1.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - move struct talitos_edesc into talitos.h
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Philipp Rudo <prudo(a)linux.ibm.com>
s390/ipl: Fix detection of has_secure attribute
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Seperate unused system vectors from spurious entry again
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Handle spurious interrupt after shutdown gracefully
Thomas Gleixner <tglx(a)linutronix.de>
x86/ioapic: Implement irq_get_irqchip_state() callback
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Add optional hardware synchronization for shutdown
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Fix misleading synchronize_irq() documentation
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Delay deactivation in free_irq()
Sven Van Asbroeck <thesven73(a)gmail.com>
firmware: improve LSM/IMA security behaviour
James Morse <james.morse(a)arm.com>
drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT
Masahiro Yamada <yamada.masahiro(a)socionext.com>
nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
Cole Rogers <colerogers(a)disroot.org>
Input: synaptics - enable SMBUS on T480 thinkpad trackpad
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Revert "e1000e: fix cyclic resets at link up with active tx"
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 ++-
arch/s390/include/asm/facility.h | 21 ++++---
arch/s390/include/asm/sclp.h | 1 -
arch/s390/kernel/ipl.c | 7 +--
arch/x86/entry/entry_32.S | 24 ++++++++
arch/x86/entry/entry_64.S | 30 +++++++--
arch/x86/include/asm/hw_irq.h | 5 +-
arch/x86/kernel/apic/apic.c | 33 ++++++----
arch/x86/kernel/apic/io_apic.c | 46 ++++++++++++++
arch/x86/kernel/apic/vector.c | 4 +-
arch/x86/kernel/idt.c | 3 +-
arch/x86/kernel/irq.c | 2 +-
drivers/base/cacheinfo.c | 3 +-
drivers/base/firmware_loader/fallback.c | 2 +-
drivers/crypto/nx/nx-842-powernv.c | 8 ++-
drivers/crypto/talitos.c | 99 +++++++++++++-----------------
drivers/crypto/talitos.h | 30 +++++++++
drivers/input/mouse/synaptics.c | 1 +
drivers/net/ethernet/intel/e1000e/netdev.c | 21 ++++---
drivers/s390/char/sclp_early.c | 1 -
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
include/linux/cpuhotplug.h | 1 +
include/uapi/linux/nilfs2_ondisk.h | 24 ++++----
kernel/irq/autoprobe.c | 6 +-
kernel/irq/chip.c | 6 ++
kernel/irq/cpuhotplug.c | 2 +-
kernel/irq/internals.h | 5 ++
kernel/irq/manage.c | 90 ++++++++++++++++++++-------
30 files changed, 342 insertions(+), 153 deletions(-)
Hi,
When one request is dispatched to LLD via dm-rq, if the result is
BLK_STS_*RESOURCE, dm-rq will free the request. However, LLD may allocate
private stuff for this request, so this way will cause memory leak.
Add .cleanup_rq() callback and implement it in SCSI for fixing the issue.
And SCSI is the only driver which allocates private stuff in .queue_rq()
path.
Another use case of this callback is to free the request and re-submit
bios during cpu hotplug when the hctx is dead, see the following link:
https://lore.kernel.org/linux-block/f122e8f2-5ede-2d83-9ca0-bc713ce66d01@hu…
Ming Lei (2):
blk-mq: add callback of .cleanup_rq
scsi: implement .cleanup_rq callback
drivers/md/dm-rq.c | 1 +
drivers/scsi/scsi_lib.c | 15 +++++++++++++++
include/linux/blk-mq.h | 13 +++++++++++++
3 files changed, 29 insertions(+)
Cc: Ewan D. Milne <emilne(a)redhat.com>
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Hannes Reinecke <hare(a)suse.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Mike Snitzer <snitzer(a)redhat.com>
Cc: dm-devel(a)redhat.com
Cc: <stable(a)vger.kernel.org>
Fixes: 396eaf21ee17 ("blk-mq: improve DM's blk-mq IO merging via blk_insert_cloned_request feedback")
--
2.20.1
VAG power control is improved to fit the manual [1]. This patchset fixes as
minimum one bug: if customer muxes Headphone to Line-In right after boot,
the VAG power remains off that leads to poor sound quality from line-in.
I.e. after boot:
- Connect sound source to Line-In jack;
- Connect headphone to HP jack;
- Run following commands:
$ amixer set 'Headphone' 80%
$ amixer set 'Headphone Mux' LINE_IN
Also this series includes fixes of non-important bugs in sgtl5000 codec
driver.
[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf
Changes in v6:
- Code optimization
Changes in v5:
- Add explicit stable tag
- Improve commit message
Changes in v4:
- CC the patch to kernel-stable
- Code optimization, simplify function signature
(thanks to Cezary Rojewski <cezary.rojewski(a)intel.com> for an idea)
- Add a Fixes tag
Changes in v3:
- Add the reference to NXP SGTL5000 data sheet to commit message
- Fix multi-line comment format
Changes in v2:
- Fix patch formatting
Oleksandr Suvorov (6):
ASoC: Define a set of DAPM pre/post-up events
ASoC: sgtl5000: Improve VAG power and mute control
ASoC: sgtl5000: Fix definition of VAG Ramp Control
ASoC: sgtl5000: add ADC mute control
ASoC: sgtl5000: Fix of unmute outputs on probe
ASoC: sgtl5000: Fix charge pump source assignment
include/sound/soc-dapm.h | 2 +
sound/soc/codecs/sgtl5000.c | 250 ++++++++++++++++++++++++++++++------
sound/soc/codecs/sgtl5000.h | 2 +-
3 files changed, 213 insertions(+), 41 deletions(-)
--
2.20.1
On 7/19/2019 3:45 AM, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 67c2315def06 crypto: caam - add Queue Interface (QI) backend support.
>
> The bot has tested the following trees: v5.2.1, v5.1.18, v4.19.59, v4.14.133.
>
> v5.2.1: Build OK!
> v5.1.18: Build OK!
> v4.19.59: Failed to apply! Possible dependencies:
> 94cebd9da42c ("crypto: caam - add Queue Interface v2 error codes")
>
> v4.14.133: Failed to apply! Possible dependencies:
> 94cebd9da42c ("crypto: caam - add Queue Interface v2 error codes")
>
Indeed, the dependency is correct. Thanks!
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
>
In the next version we'll remove the # v4.12+ requirement and
we'll separately send backports once patch will be merged upstream.
Thanks,
Horia
In the function alps_is_cs19_trackpoint(), we check if the param[1] is
in the 0x20~0x2f range, but the code we wrote for this checking is not
correct:
(param[1] & 0x20) does not mean param[1] is in the range of 0x20~0x2f,
it also means the param[1] is in the range of 0x30~0x3f, 0x60~0x6f...
Now fix it with a new condition checking ((param[1] & 0xf0) == 0x20).
Fixes: 7e4935ccc323 ("Input: alps - don't handle ALPS cs19 trackpoint-only device")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hui Wang <hui.wang(a)canonical.com>
---
drivers/input/mouse/alps.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 62ffea00902a..34700eda0429 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2876,7 +2876,7 @@ static bool alps_is_cs19_trackpoint(struct psmouse *psmouse)
* trackpoint-only devices have their variant_ids equal
* TP_VARIANT_ALPS and their firmware_ids are in 0x20~0x2f range.
*/
- return param[0] == TP_VARIANT_ALPS && (param[1] & 0x20);
+ return param[0] == TP_VARIANT_ALPS && ((param[1] & 0xf0) == 0x20);
}
static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
--
2.17.1
From: Fei Yang <fei.yang(a)intel.com>
If scatter-gather operation is allowed, a large USB request would be split
into multiple TRBs. These TRBs are chained up by setting DWC3_TRB_CTRL_CHN
bit except the last one which has DWC3_TRB_CTRL_IOC bit set instead.
Since only the last TRB has IOC set, dwc3_gadget_ep_reclaim_completed_trb()
would be called only once for the whole USB request, thus all the TRBs need
to be reclaimed within this single call. However that is not what the current
code does.
This patch addresses the issue by checking each TRB in function
dwc3_gadget_ep_reclaim_trb_sg() and reclaiming the chained ones right there.
Only the last TRB gets passed to dwc3_gadget_ep_reclaim_completed_trb(). This
would guarantee all TRBs are reclaimed and trb_dequeue/num_trbs are updated
properly.
Signed-off-by: Fei Yang <fei.yang(a)intel.com>
Cc: stable <stable(a)vger.kernel.org>
---
V2: Better solution is to reclaim chained TRBs in dwc3_gadget_ep_reclaim_trb_sg()
and leave the last TRB to the dwc3_gadget_ep_reclaim_completed_trb().
---
drivers/usb/dwc3/gadget.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 173f532..c0662c2 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2404,7 +2404,7 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
struct dwc3_request *req, const struct dwc3_event_depevt *event,
int status)
{
- struct dwc3_trb *trb = &dep->trb_pool[dep->trb_dequeue];
+ struct dwc3_trb *trb;
struct scatterlist *sg = req->sg;
struct scatterlist *s;
unsigned int pending = req->num_pending_sgs;
@@ -2419,7 +2419,15 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
req->sg = sg_next(s);
req->num_pending_sgs--;
+ if (!(trb->ctrl & DWC3_TRB_CTRL_IOC)) {
+ /* reclaim the TRB without calling
+ * dwc3_gadget_ep_reclaim_completed_trb */
+ dwc3_ep_inc_deq(dep);
+ req->num_trbs--;
+ continue;
+ }
+ /* Only the last TRB in the sg list would reach here */
ret = dwc3_gadget_ep_reclaim_completed_trb(dep, req,
trb, event, status, true);
if (ret)
--
2.7.4
VAG power control is improved to fit the manual [1]. This patchset fixes as
minimum one bug: if customer muxes Headphone to Line-In right after boot,
the VAG power remains off that leads to poor sound quality from line-in.
I.e. after boot:
- Connect sound source to Line-In jack;
- Connect headphone to HP jack;
- Run following commands:
$ amixer set 'Headphone' 80%
$ amixer set 'Headphone Mux' LINE_IN
Also this series includes fixes of non-important bugs in sgtl5000 codec
driver.
[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf
Changes in v5:
- Add explicit stable tag
- Improve commit message
- Add explicit stable tag
Changes in v4:
- CC the patch to kernel-stable
- Code optimization, simplify function signature
(thanks to Cezary Rojewski <cezary.rojewski(a)intel.com> for an idea)
- CC the patch to kernel-stable
- Add a Fixes tag
Changes in v3:
- Add the reference to NXP SGTL5000 data sheet to commit message
- Add the reference to NXP SGTL5000 data sheet to commit message
- Fix multi-line comment format
Changes in v2:
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
Oleksandr Suvorov (6):
ASoC: Define a set of DAPM pre/post-up events
ASoC: sgtl5000: Improve VAG power and mute control
ASoC: sgtl5000: Fix definition of VAG Ramp Control
ASoC: sgtl5000: add ADC mute control
ASoC: sgtl5000: Fix of unmute outputs on probe
ASoC: sgtl5000: Fix charge pump source assignment
include/sound/soc-dapm.h | 2 +
sound/soc/codecs/sgtl5000.c | 240 ++++++++++++++++++++++++++++++------
sound/soc/codecs/sgtl5000.h | 2 +-
3 files changed, 203 insertions(+), 41 deletions(-)
--
2.20.1
On Fri, Jul 19, 2019 at 12:45:23AM +0000, Sasha Levin wrote:
> v5.1.18: Failed to apply! Possible dependencies:
> Unable to calculate
>
> v4.19.59: Failed to apply! Possible dependencies:
<snip>
> How should we proceed with this patch?
I'll provide backported version of the patch for 4.19 and 5.1
after it will be merged to Linus' tree.
Stanislaw
This is the start of the stable review cycle for the 4.14.134 release.
There are 80 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.134-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.134-rc1
Dave Airlie <airlied(a)redhat.com>
drm/udl: move to embedding drm device inside udl device.
Dave Airlie <airlied(a)redhat.com>
drm/udl: introduce a macro to convert dev to udl.
Haren Myneni <haren(a)linux.vnet.ibm.com>
crypto/NX: Set receive window credits to max number of CRBs in RxFIFO
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Vinod Koul <vkoul(a)kernel.org>
linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL
Eiichi Tsukata <devel(a)etsukata.com>
cpu/hotplug: Fix out-of-bounds read when setting fail state
Kirill A. Shutemov <kirill(a)shutemov.name>
x86/boot/64: Fix crash if kernel image crosses page table boundary
Milan Broz <gmazyland(a)gmail.com>
dm verity: use message limit for data block corruption message
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ARM: dts: imx6ul: fix PWM[1-4] interrupts
Sergej Benilov <sergej.benilov(a)googlemail.com>
sis900: fix TX completion
Takashi Iwai <tiwai(a)suse.de>
ppp: mppe: Add softdep to arc4
Petr Oros <poros(a)redhat.com>
be2net: fix link failure after ethtool offline test
Arnd Bergmann <arnd(a)arndb.de>
ARM: omap2: remove incorrect __init annotation
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix perf_sample_regs_user() mm check
Hans de Goede <hdegoede(a)redhat.com>
efi/bgrt: Drop BGRT status field reserved bits check
Tony Lindgren <tony(a)atomide.com>
clk: ti: clkctrl: Fix returning uninitialized data
Sean Young <sean(a)mess.org>
MIPS: Remove superfluous check for __linux__
Vishnu DASA <vdasa(a)vmware.com>
VMCI: Fix integer overflow in VMCI handle arrays
Christian Lamparter <chunkeey(a)gmail.com>
carl9170: fix misuse of device driver API
Todd Kjos <tkjos(a)android.com>
binder: fix memory leak in error path
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: amplc_pci230: fix null pointer deref on interrupt
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: dt282x: fix a null pointer deref on interrupt
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: add a workaround for a race condition of workqueue
Kiruthika Varadarajan <Kiruthika.Varadarajan(a)harman.com>
usb: gadget: ether: Fix race between gether_disconnect and rx_submit
Alan Stern <stern(a)rowland.harvard.edu>
p54usb: Fix race between disconnect and firmware loading
Oliver Barta <o.barta89(a)gmail.com>
Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add support for GosunCn ME3630 RNDIS mode
Andreas Fritiofson <andreas.fritiofson(a)unjo.com>
USB: serial: ftdi_sio: add ID for isodebug v1
Brian Norris <briannorris(a)chromium.org>
mwifiex: Don't abort on small, spec-compliant vendor IEs
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Abort at too short BSS descriptor element
Tim Chen <tim.c.chen(a)linux.intel.com>
Documentation: Add section about CPU vulnerabilities for Spectre
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/tls: Fix possible spectre-v1 in do_get_thread_area()
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
Douglas Anderson <dianders(a)chromium.org>
block, bfq: NULL out the bic when it's no longer valid
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Headphone Mic can't record after S3
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
Hongjie Fang <hongjiefang(a)asrmicro.com>
fscrypt: don't set policy for a dead directory
Lin Yi <teroincn(a)163.com>
net :sunrpc :clnt :Fix xps refcount imbalance on the error path
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge()
yangerkun <yangerkun(a)huawei.com>
quota: fix a problem about transfer quota
Colin Ian King <colin.king(a)canonical.com>
net: lio_core: fix potential sign-extension overflow on large shift
Xin Long <lucien.xin(a)gmail.com>
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
Dan Carpenter <dan.carpenter(a)oracle.com>
drm: return -EFAULT if copy_to_user() fails
Mauro S. M. Rodrigues <maurosr(a)linux.vnet.ibm.com>
bnx2x: Check if transceiver implements DDM before access
Mariusz Tkaczyk <mariusz.tkaczyk(a)intel.com>
md: fix for divide error in status_resync
Reinhard Speyerer <rspmn(a)arcor.de>
qmi_wwan: extend permitted QMAP mux_id value range
Reinhard Speyerer <rspmn(a)arcor.de>
qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode
Reinhard Speyerer <rspmn(a)arcor.de>
qmi_wwan: add support for QMAP padding in the RX path
Yibo Zhao <yiboz(a)codeaurora.org>
mac80211: only warn once on chanctx_conf being NULL
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da850-evm: call regulator_has_full_constraints()
Ido Schimmel <idosch(a)mellanox.com>
mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
Dave Martin <Dave.Martin(a)arm.com>
KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
Anson Huang <anson.huang(a)nxp.com>
Input: imx_keypad - make sure keyboard can always wake up system
Teresa Remmet <t.remmet(a)phytec.de>
ARM: dts: am335x phytec boards: Fix cd-gpios active level
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmvnic: Refresh device multicast list after reset
YueHaibing <yuehaibing(a)huawei.com>
can: af_can: Fix error path of can_init()
Eugen Hristev <eugen.hristev(a)microchip.com>
can: m_can: implement errata "Needless activation of MRAF irq"
Sean Nyekjaer <sean(a)geanix.com>
can: mcp251x: add support for mcp25625
Sean Nyekjaer <sean(a)geanix.com>
dt-bindings: can: mcp251x: add mcp25625 support
Guillaume Nault <gnault(a)redhat.com>
netfilter: ipv6: nf_defrag: accept duplicate fragments again
Guillaume Nault <gnault(a)redhat.com>
netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
Jia-Ju Bai <baijiaju1990(a)gmail.com>
iwlwifi: Fix double-free problems in iwl_req_fw_callback()
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix possible buffer overflows at parsing bss descriptor
Pradeep Kumar Chitrapu <pradeepc(a)codeaurora.org>
mac80211: free peer keys before vif down in mesh
Thomas Pedersen <thomas(a)eero.com>
mac80211: mesh: fix RCU warning
Melissa Wen <melissa.srw(a)gmail.com>
staging:iio:ad7150: fix threshold mode config bit
John Fastabend <john.fastabend(a)gmail.com>
bpf: sockmap, fix use after free from sleep in psock backlog workqueue
Chang-Hsien Tsai <luke.tw(a)gmail.com>
samples, bpf: fix to change the buffer size for read()
Aaron Ma <aaron.ma(a)canonical.com>
Input: elantech - enable middle button support on 2 ThinkPads
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - rename alternative AEAD algos.
James Morse <james.morse(a)arm.com>
drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT
Masahiro Yamada <yamada.masahiro(a)socionext.com>
nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
Cole Rogers <colerogers(a)disroot.org>
Input: synaptics - enable SMBUS on T480 thinkpad trackpad
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Revert "e1000e: fix cyclic resets at link up with active tx"
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-net-qmi | 4 +-
Documentation/admin-guide/hw-vuln/index.rst | 1 +
Documentation/admin-guide/hw-vuln/spectre.rst | 697 +++++++++++++++++++++
.../bindings/net/can/microchip,mcp251x.txt | 1 +
Documentation/userspace-api/spec_ctrl.rst | 2 +
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 +-
arch/arm/boot/dts/am335x-pcm-953.dtsi | 2 +-
arch/arm/boot/dts/am335x-wega.dtsi | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 8 +-
arch/arm/mach-davinci/board-da850-evm.c | 2 +
arch/arm/mach-davinci/devices-da8xx.c | 3 +
arch/arm/mach-omap2/prm3xxx.c | 2 +-
arch/mips/include/uapi/asm/sgidefs.h | 8 -
arch/s390/include/asm/facility.h | 21 +-
arch/x86/kernel/head64.c | 17 +-
arch/x86/kernel/ptrace.c | 5 +-
arch/x86/kernel/tls.c | 9 +-
block/bfq-iosched.c | 1 +
drivers/android/binder.c | 4 +-
drivers/base/cacheinfo.c | 3 +-
drivers/clk/ti/clkctrl.c | 7 +-
drivers/crypto/nx/nx-842-powernv.c | 8 +-
drivers/crypto/talitos.c | 16 +-
drivers/firmware/efi/efi-bgrt.c | 5 -
drivers/gpu/drm/drm_bufs.c | 5 +-
drivers/gpu/drm/drm_ioc32.c | 5 +-
drivers/gpu/drm/udl/udl_drv.c | 56 +-
drivers/gpu/drm/udl/udl_drv.h | 9 +-
drivers/gpu/drm/udl/udl_fb.c | 12 +-
drivers/gpu/drm/udl/udl_main.c | 35 +-
drivers/input/keyboard/imx_keypad.c | 18 +-
drivers/input/mouse/elantech.c | 2 +
drivers/input/mouse/synaptics.c | 1 +
drivers/md/dm-verity-target.c | 4 +-
drivers/md/md.c | 36 +-
drivers/misc/vmw_vmci/vmci_context.c | 80 +--
drivers/misc/vmw_vmci/vmci_handle_array.c | 38 +-
drivers/misc/vmw_vmci/vmci_handle_array.h | 29 +-
drivers/net/can/m_can/m_can.c | 21 +
drivers/net/can/spi/Kconfig | 5 +-
drivers/net/can/spi/mcp251x.c | 25 +-
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 2 +-
.../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 3 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h | 1 +
drivers/net/ethernet/cavium/liquidio/lio_core.c | 2 +-
drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 +-
drivers/net/ethernet/ibm/ibmvnic.c | 3 +
drivers/net/ethernet/intel/e1000e/netdev.c | 21 +-
drivers/net/ethernet/mellanox/mlxsw/reg.h | 2 +-
drivers/net/ethernet/sis/sis900.c | 16 +-
drivers/net/ppp/ppp_mppe.c | 1 +
drivers/net/usb/qmi_wwan.c | 27 +-
drivers/net/wireless/ath/carl9170/usb.c | 39 +-
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 -
drivers/net/wireless/intersil/p54/p54usb.c | 43 +-
drivers/net/wireless/marvell/mwifiex/fw.h | 12 +-
drivers/net/wireless/marvell/mwifiex/ie.c | 45 +-
drivers/net/wireless/marvell/mwifiex/scan.c | 31 +-
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 +-
drivers/net/wireless/marvell/mwifiex/wmm.c | 2 +-
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
drivers/staging/comedi/drivers/amplc_pci230.c | 3 +-
drivers/staging/comedi/drivers/dt282x.c | 3 +-
drivers/staging/iio/cdc/ad7150.c | 19 +-
drivers/tty/serial/8250/8250_port.c | 3 +-
drivers/usb/gadget/function/u_ether.c | 6 +-
drivers/usb/renesas_usbhs/fifo.c | 34 +-
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 +
drivers/usb/serial/option.c | 1 +
fs/crypto/policy.c | 2 +
fs/quota/dquot.c | 4 +-
fs/udf/inode.c | 93 ++-
include/linux/cpuhotplug.h | 1 +
include/linux/kernel.h | 3 +-
include/linux/vmw_vmci_defs.h | 11 +-
include/net/ip6_tunnel.h | 9 +-
include/uapi/linux/nilfs2_ondisk.h | 24 +-
kernel/cpu.c | 3 +
kernel/events/core.c | 2 +-
net/can/af_can.c | 24 +-
net/core/skbuff.c | 1 +
net/ipv6/netfilter/nf_conntrack_reasm.c | 22 +-
net/mac80211/ieee80211_i.h | 2 +-
net/mac80211/mesh.c | 6 +-
net/sunrpc/clnt.c | 1 +
samples/bpf/bpf_load.c | 2 +-
sound/pci/hda/patch_realtek.c | 2 +-
virt/kvm/arm/vgic/vgic-its.c | 1 +
91 files changed, 1393 insertions(+), 408 deletions(-)
This is the start of the stable review cycle for the 5.1.19 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.1.19-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.1.19-rc1
Jiri Slaby <jslaby(a)suse.cz>
x86/entry/32: Fix ENDPROC of common_spurious
Haren Myneni <haren(a)linux.vnet.ibm.com>
crypto/NX: Set receive window credits to max number of CRBs in RxFIFO
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix hash on SEC1.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - move struct talitos_edesc into talitos.h
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Seperate unused system vectors from spurious entry again
Thomas Gleixner <tglx(a)linutronix.de>
x86/irq: Handle spurious interrupt after shutdown gracefully
Thomas Gleixner <tglx(a)linutronix.de>
x86/ioapic: Implement irq_get_irqchip_state() callback
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Add optional hardware synchronization for shutdown
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Fix misleading synchronize_irq() documentation
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Delay deactivation in free_irq()
Vinod Koul <vkoul(a)kernel.org>
linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL
Andrea Arcangeli <aarcange(a)redhat.com>
fork,memcg: alloc_thread_stack_node needs to set tsk->stack
Yafang Shao <laoar.shao(a)gmail.com>
mm/oom_kill.c: fix uninitialized oc->constraint
Nicolas Boichat <drinkcat(a)chromium.org>
pinctrl: mediatek: Update cur_mask in mask/mask ops
Eiichi Tsukata <devel(a)etsukata.com>
cpu/hotplug: Fix out-of-bounds read when setting fail state
Nicolas Boichat <drinkcat(a)chromium.org>
pinctrl: mediatek: Ignore interrupts that are wake only during resume
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: multitouch: Add pointstick support for ALPS Touchpad
Kyle Godbey <me(a)kyle.ee>
HID: uclogic: Add support for Huion HS64 tablet
Oleksandr Natalenko <oleksandr(a)redhat.com>
HID: chicony: add another quirk for PixArt mouse
Kirill A. Shutemov <kirill(a)shutemov.name>
x86/boot/64: Add missing fixup_pointer() for next_early_pgt access
Kirill A. Shutemov <kirill(a)shutemov.name>
x86/boot/64: Fix crash if kernel image crosses page table boundary
Milan Broz <gmazyland(a)gmail.com>
dm verity: use message limit for data block corruption message
Jerome Marchand <jmarchan(a)redhat.com>
dm table: don't copy from a NULL pointer in realloc_argv()
Alexandre Belloni <alexandre.belloni(a)bootlin.com>
pinctrl: ocelot: fix pinmuxing for pins after 31
Alexandre Belloni <alexandre.belloni(a)bootlin.com>
pinctrl: ocelot: fix gpio direction for pins after 31
Phil Reid <preid(a)electromag.com.au>
pinctrl: mcp23s08: Fix add_data and irqchip_add_nested call order
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ARM: dts: imx6ul: fix PWM[1-4] interrupts
Sergej Benilov <sergej.benilov(a)googlemail.com>
sis900: fix TX completion
Takashi Iwai <tiwai(a)suse.de>
ppp: mppe: Add softdep to arc4
Petr Oros <poros(a)redhat.com>
be2net: fix link failure after ethtool offline test
Colin Ian King <colin.king(a)canonical.com>
x86/apic: Fix integer overflow on 10 bit left shift of cpu_khz
Qian Cai <cai(a)lca.pw>
x86/efi: fix a -Wtype-limits compilation warning
David Howells <dhowells(a)redhat.com>
afs: Fix uninitialised spinlock afs_volume::cb_break_lock
Arnd Bergmann <arnd(a)arndb.de>
ARM: omap2: remove incorrect __init annotation
Linus Walleij <linus.walleij(a)linaro.org>
ARM: dts: gemini Fix up DNS-313 compatible string
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix perf_sample_regs_user() mm check
Michael Ellerman <mpe(a)ellerman.id.au>
selftests/powerpc: Add test of fork with mapping above 512TB
Ran Wang <ran.wang_1(a)nxp.com>
arm64: dts: ls1028a: Fix CPU idle fail.
Hans de Goede <hdegoede(a)redhat.com>
efi/bgrt: Drop BGRT status field reserved bits check
Tony Lindgren <tony(a)atomide.com>
clk: ti: clkctrl: Fix returning uninitialized data
Heyi Guo <guoheyi(a)huawei.com>
irqchip/gic-v3-its: Fix command queue pointer comparison bug
Guo Ren <ren_guo(a)c-sky.com>
irqchip/irq-csky-mpintc: Support auto irq deliver to all cpus
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
ARM: dts: meson8b: fix the operating voltage of the Mali GPU
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
ARM: dts: meson8: fix GPU interrupts and drop an undocumented property
Sven Van Asbroeck <thesven73(a)gmail.com>
firmware: improve LSM/IMA security behaviour
James Morse <james.morse(a)arm.com>
drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT
Masahiro Yamada <yamada.masahiro(a)socionext.com>
nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
Cole Rogers <colerogers(a)disroot.org>
Input: synaptics - enable SMBUS on T480 thinkpad trackpad
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Revert "e1000e: fix cyclic resets at link up with active tx"
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 +-
arch/arm/boot/dts/gemini-dlink-dns-313.dts | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 8 +-
arch/arm/boot/dts/meson8.dtsi | 5 +-
arch/arm/boot/dts/meson8b.dtsi | 10 +--
arch/arm/mach-omap2/prm3xxx.c | 2 +-
arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 18 ++--
arch/s390/include/asm/facility.h | 21 +++--
arch/x86/entry/entry_32.S | 24 ++++++
arch/x86/entry/entry_64.S | 30 ++++++-
arch/x86/include/asm/hw_irq.h | 5 +-
arch/x86/kernel/apic/apic.c | 36 +++++---
arch/x86/kernel/apic/io_apic.c | 46 ++++++++++
arch/x86/kernel/apic/vector.c | 4 +-
arch/x86/kernel/head64.c | 20 +++--
arch/x86/kernel/idt.c | 3 +-
arch/x86/kernel/irq.c | 2 +-
arch/x86/platform/efi/quirks.c | 2 +-
drivers/base/cacheinfo.c | 3 +-
drivers/base/firmware_loader/fallback.c | 2 +-
drivers/clk/ti/clkctrl.c | 7 +-
drivers/crypto/nx/nx-842-powernv.c | 8 +-
drivers/crypto/talitos.c | 99 +++++++++-------------
drivers/crypto/talitos.h | 30 +++++++
drivers/firmware/efi/efi-bgrt.c | 5 --
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-multitouch.c | 4 +
drivers/hid/hid-quirks.c | 1 +
drivers/hid/hid-uclogic-core.c | 2 +
drivers/hid/hid-uclogic-params.c | 2 +
drivers/input/mouse/synaptics.c | 1 +
drivers/irqchip/irq-csky-mpintc.c | 15 +++-
drivers/irqchip/irq-gic-v3-its.c | 35 +++++---
drivers/md/dm-table.c | 2 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 ++++--
drivers/net/ethernet/intel/e1000e/netdev.c | 21 +++--
drivers/net/ethernet/sis/sis900.c | 16 ++--
drivers/net/ppp/ppp_mppe.c | 1 +
drivers/pinctrl/mediatek/mtk-eint.c | 34 ++++----
drivers/pinctrl/pinctrl-mcp23s08.c | 8 +-
drivers/pinctrl/pinctrl-ocelot.c | 18 ++--
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
fs/afs/callback.c | 4 +-
fs/afs/internal.h | 2 +-
fs/afs/volume.c | 1 +
include/linux/cpuhotplug.h | 1 +
include/linux/kernel.h | 3 +-
include/uapi/linux/nilfs2_ondisk.h | 24 +++---
kernel/cpu.c | 3 +
kernel/events/core.c | 2 +-
kernel/fork.c | 6 +-
kernel/irq/autoprobe.c | 6 +-
kernel/irq/chip.c | 6 ++
kernel/irq/cpuhotplug.c | 2 +-
kernel/irq/internals.h | 5 ++
kernel/irq/manage.c | 90 +++++++++++++++-----
mm/oom_kill.c | 12 ++-
tools/testing/selftests/powerpc/mm/.gitignore | 3 +-
tools/testing/selftests/powerpc/mm/Makefile | 4 +-
.../powerpc/mm/large_vm_fork_separation.c | 87 +++++++++++++++++++
63 files changed, 610 insertions(+), 258 deletions(-)
This is the start of the stable review cycle for the 4.9.186 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.186-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.186-rc1
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Milan Broz <gmazyland(a)gmail.com>
dm verity: use message limit for data block corruption message
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ARM: dts: imx6ul: fix PWM[1-4] interrupts
Sergej Benilov <sergej.benilov(a)googlemail.com>
sis900: fix TX completion
Takashi Iwai <tiwai(a)suse.de>
ppp: mppe: Add softdep to arc4
Petr Oros <poros(a)redhat.com>
be2net: fix link failure after ethtool offline test
Arnd Bergmann <arnd(a)arndb.de>
ARM: omap2: remove incorrect __init annotation
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix perf_sample_regs_user() mm check
Mark Rutland <mark.rutland(a)arm.com>
arm64: crypto: remove accidentally backported files
Masahiro Yamada <yamada.masahiro(a)socionext.com>
nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
Revert "e1000e: fix cyclic resets at link up with active tx"
Sean Young <sean(a)mess.org>
MIPS: Remove superfluous check for __linux__
Vishnu DASA <vdasa(a)vmware.com>
VMCI: Fix integer overflow in VMCI handle arrays
Christian Lamparter <chunkeey(a)gmail.com>
carl9170: fix misuse of device driver API
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: amplc_pci230: fix null pointer deref on interrupt
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: dt282x: fix a null pointer deref on interrupt
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: add a workaround for a race condition of workqueue
Kiruthika Varadarajan <Kiruthika.Varadarajan(a)harman.com>
usb: gadget: ether: Fix race between gether_disconnect and rx_submit
Alan Stern <stern(a)rowland.harvard.edu>
p54usb: Fix race between disconnect and firmware loading
Oliver Barta <o.barta89(a)gmail.com>
Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add support for GosunCn ME3630 RNDIS mode
Andreas Fritiofson <andreas.fritiofson(a)unjo.com>
USB: serial: ftdi_sio: add ID for isodebug v1
Brian Norris <briannorris(a)chromium.org>
mwifiex: Don't abort on small, spec-compliant vendor IEs
Hongjie Fang <hongjiefang(a)asrmicro.com>
fscrypt: don't set policy for a dead directory
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Abort at too short BSS descriptor element
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/tls: Fix possible spectre-v1 in do_get_thread_area()
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
Lin Yi <teroincn(a)163.com>
net :sunrpc :clnt :Fix xps refcount imbalance on the error path
Xin Long <lucien.xin(a)gmail.com>
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
Mauro S. M. Rodrigues <maurosr(a)linux.vnet.ibm.com>
bnx2x: Check if transceiver implements DDM before access
Mariusz Tkaczyk <mariusz.tkaczyk(a)intel.com>
md: fix for divide error in status_resync
Yibo Zhao <yiboz(a)codeaurora.org>
mac80211: only warn once on chanctx_conf being NULL
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da850-evm: call regulator_has_full_constraints()
Ido Schimmel <idosch(a)mellanox.com>
mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
Dave Martin <Dave.Martin(a)arm.com>
KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
Anson Huang <anson.huang(a)nxp.com>
Input: imx_keypad - make sure keyboard can always wake up system
Sean Nyekjaer <sean(a)geanix.com>
can: mcp251x: add support for mcp25625
Sean Nyekjaer <sean(a)geanix.com>
dt-bindings: can: mcp251x: add mcp25625 support
Guillaume Nault <gnault(a)redhat.com>
netfilter: ipv6: nf_defrag: accept duplicate fragments again
Guillaume Nault <gnault(a)redhat.com>
netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix possible buffer overflows at parsing bss descriptor
Pradeep Kumar Chitrapu <pradeepc(a)codeaurora.org>
mac80211: free peer keys before vif down in mesh
Thomas Pedersen <thomas(a)eero.com>
mac80211: mesh: fix RCU warning
Melissa Wen <melissa.srw(a)gmail.com>
staging:iio:ad7150: fix threshold mode config bit
Chang-Hsien Tsai <luke.tw(a)gmail.com>
samples, bpf: fix to change the buffer size for read()
Aaron Ma <aaron.ma(a)canonical.com>
Input: elantech - enable middle button support on 2 ThinkPads
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - rename alternative AEAD algos.
-------------
Diffstat:
.../bindings/net/can/microchip,mcp251x.txt | 1 +
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 +-
arch/arm/boot/dts/imx6ul.dtsi | 8 +-
arch/arm/mach-davinci/board-da850-evm.c | 2 +
arch/arm/mach-davinci/devices-da8xx.c | 3 +
arch/arm/mach-omap2/prm3xxx.c | 2 +-
arch/arm64/crypto/sha256-core.S | 2061 --------------------
arch/arm64/crypto/sha512-core.S | 1085 -----------
arch/mips/include/uapi/asm/sgidefs.h | 8 -
arch/s390/include/asm/facility.h | 21 +-
arch/x86/kernel/ptrace.c | 5 +-
arch/x86/kernel/tls.c | 9 +-
drivers/crypto/talitos.c | 16 +-
drivers/input/keyboard/imx_keypad.c | 18 +-
drivers/input/mouse/elantech.c | 2 +
drivers/md/dm-verity-target.c | 4 +-
drivers/md/md.c | 36 +-
drivers/misc/vmw_vmci/vmci_context.c | 80 +-
drivers/misc/vmw_vmci/vmci_handle_array.c | 38 +-
drivers/misc/vmw_vmci/vmci_handle_array.h | 29 +-
drivers/net/can/spi/Kconfig | 5 +-
drivers/net/can/spi/mcp251x.c | 25 +-
.../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 3 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h | 1 +
drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 21 +-
drivers/net/ethernet/mellanox/mlxsw/reg.h | 2 +-
drivers/net/ethernet/sis/sis900.c | 16 +-
drivers/net/ppp/ppp_mppe.c | 1 +
drivers/net/wireless/ath/carl9170/usb.c | 39 +-
drivers/net/wireless/intersil/p54/p54usb.c | 43 +-
drivers/net/wireless/marvell/mwifiex/fw.h | 12 +-
drivers/net/wireless/marvell/mwifiex/ie.c | 45 +-
drivers/net/wireless/marvell/mwifiex/scan.c | 31 +-
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 +-
drivers/net/wireless/marvell/mwifiex/wmm.c | 2 +-
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
drivers/staging/comedi/drivers/amplc_pci230.c | 3 +-
drivers/staging/comedi/drivers/dt282x.c | 3 +-
drivers/staging/iio/cdc/ad7150.c | 19 +-
drivers/tty/serial/8250/8250_port.c | 3 +-
drivers/usb/gadget/function/u_ether.c | 6 +-
drivers/usb/renesas_usbhs/fifo.c | 34 +-
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 +
drivers/usb/serial/option.c | 1 +
fs/crypto/policy.c | 2 +
fs/udf/inode.c | 93 +-
include/linux/vmw_vmci_defs.h | 11 +-
include/net/ip6_tunnel.h | 9 +-
include/uapi/linux/nilfs2_ondisk.h | 24 +-
kernel/events/core.c | 2 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 22 +-
net/mac80211/ieee80211_i.h | 2 +-
net/mac80211/mesh.c | 6 +-
net/sunrpc/clnt.c | 1 +
samples/bpf/bpf_load.c | 2 +-
virt/kvm/arm/vgic/vgic-its.c | 1 +
60 files changed, 516 insertions(+), 3461 deletions(-)
This is the start of the stable review cycle for the 4.4.186 release.
There are 40 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 20 Jul 2019 02:59:27 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.186-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.186-rc1
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: (re-)initialize tiqdio list entries
Heiko Carstens <heiko.carstens(a)de.ibm.com>
s390: fix stfle zero padding
Arnd Bergmann <arnd(a)arndb.de>
ARC: hide unused function unw_hdr_alloc
Paolo Bonzini <pbonzini(a)redhat.com>
kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR
Milan Broz <gmazyland(a)gmail.com>
dm verity: use message limit for data block corruption message
Sergej Benilov <sergej.benilov(a)googlemail.com>
sis900: fix TX completion
Takashi Iwai <tiwai(a)suse.de>
ppp: mppe: Add softdep to arc4
Petr Oros <poros(a)redhat.com>
be2net: fix link failure after ethtool offline test
Arnd Bergmann <arnd(a)arndb.de>
ARM: omap2: remove incorrect __init annotation
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix perf_sample_regs_user() mm check
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
e1000e: start network tx queue only when link is up
Sean Young <sean(a)mess.org>
MIPS: Remove superfluous check for __linux__
Vishnu DASA <vdasa(a)vmware.com>
VMCI: Fix integer overflow in VMCI handle arrays
Christian Lamparter <chunkeey(a)gmail.com>
carl9170: fix misuse of device driver API
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: amplc_pci230: fix null pointer deref on interrupt
Ian Abbott <abbotti(a)mev.co.uk>
staging: comedi: dt282x: fix a null pointer deref on interrupt
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: add a workaround for a race condition of workqueue
Kiruthika Varadarajan <Kiruthika.Varadarajan(a)harman.com>
usb: gadget: ether: Fix race between gether_disconnect and rx_submit
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add support for GosunCn ME3630 RNDIS mode
Andreas Fritiofson <andreas.fritiofson(a)unjo.com>
USB: serial: ftdi_sio: add ID for isodebug v1
Brian Norris <briannorris(a)chromium.org>
mwifiex: Don't abort on small, spec-compliant vendor IEs
Hongjie Fang <hongjiefang(a)asrmicro.com>
fscrypt: don't set policy for a dead directory
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Abort at too short BSS descriptor element
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/tls: Fix possible spectre-v1 in do_get_thread_area()
Dianzhang Chen <dianzhangchen0(a)gmail.com>
x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
Mauro S. M. Rodrigues <maurosr(a)linux.vnet.ibm.com>
bnx2x: Check if transceiver implements DDM before access
Mariusz Tkaczyk <mariusz.tkaczyk(a)intel.com>
md: fix for divide error in status_resync
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da850-evm: call regulator_has_full_constraints()
Anson Huang <anson.huang(a)nxp.com>
Input: imx_keypad - make sure keyboard can always wake up system
Sean Nyekjaer <sean(a)geanix.com>
can: mcp251x: add support for mcp25625
Sean Nyekjaer <sean(a)geanix.com>
dt-bindings: can: mcp251x: add mcp25625 support
Takashi Iwai <tiwai(a)suse.de>
mwifiex: Fix possible buffer overflows at parsing bss descriptor
Thomas Pedersen <thomas(a)eero.com>
mac80211: mesh: fix RCU warning
Chang-Hsien Tsai <luke.tw(a)gmail.com>
samples, bpf: fix to change the buffer size for read()
Aaron Ma <aaron.ma(a)canonical.com>
Input: elantech - enable middle button support on 2 ThinkPads
-------------
Diffstat:
.../bindings/net/can/microchip,mcp251x.txt | 1 +
Makefile | 4 +-
arch/arc/kernel/unwind.c | 9 +--
arch/arm/mach-davinci/board-da850-evm.c | 2 +
arch/arm/mach-davinci/devices-da8xx.c | 3 +
arch/arm/mach-omap2/prm3xxx.c | 2 +-
arch/mips/include/uapi/asm/sgidefs.h | 8 --
arch/s390/include/asm/facility.h | 21 +++--
arch/x86/kernel/ptrace.c | 5 +-
arch/x86/kernel/tls.c | 9 ++-
arch/x86/kvm/i8254.c | 5 +-
arch/x86/kvm/x86.c | 6 +-
drivers/input/keyboard/imx_keypad.c | 18 ++++-
drivers/input/mouse/elantech.c | 2 +
drivers/md/dm-verity.c | 4 +-
drivers/md/md.c | 36 +++++----
drivers/misc/vmw_vmci/vmci_context.c | 80 +++++++++++--------
drivers/misc/vmw_vmci/vmci_handle_array.c | 38 ++++++---
drivers/misc/vmw_vmci/vmci_handle_array.h | 29 ++++---
drivers/net/can/spi/Kconfig | 5 +-
drivers/net/can/spi/mcp251x.c | 25 +++---
.../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 3 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h | 1 +
drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 +++++--
drivers/net/ethernet/intel/e1000e/netdev.c | 6 +-
drivers/net/ethernet/sis/sis900.c | 16 ++--
drivers/net/ppp/ppp_mppe.c | 1 +
drivers/net/wireless/ath/carl9170/usb.c | 39 ++++-----
drivers/net/wireless/mwifiex/fw.h | 12 ++-
drivers/net/wireless/mwifiex/ie.c | 45 +++++++----
drivers/net/wireless/mwifiex/scan.c | 31 +++++++-
drivers/net/wireless/mwifiex/sta_ioctl.c | 4 +-
drivers/net/wireless/mwifiex/wmm.c | 2 +-
drivers/s390/cio/qdio_setup.c | 2 +
drivers/s390/cio/qdio_thinint.c | 5 +-
drivers/staging/comedi/drivers/amplc_pci230.c | 3 +-
drivers/staging/comedi/drivers/dt282x.c | 3 +-
drivers/usb/gadget/function/u_ether.c | 6 +-
drivers/usb/renesas_usbhs/fifo.c | 34 +++++---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 ++
drivers/usb/serial/option.c | 1 +
fs/ext4/crypto_policy.c | 2 +
fs/f2fs/crypto_policy.c | 2 +
fs/udf/inode.c | 93 ++++++++++++++--------
include/linux/vmw_vmci_defs.h | 11 ++-
kernel/events/core.c | 2 +-
net/mac80211/mesh.c | 5 +-
samples/bpf/bpf_load.c | 2 +-
49 files changed, 438 insertions(+), 240 deletions(-)
From: Dan Williams <dan.j.williams(a)intel.com>
Subject: libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
At namespace creation time there is the potential for the "expected to be
zero" fields of a 'pfn' info-block to be filled with indeterminate data.
While the kernel buffer is zeroed on allocation it is immediately
overwritten by nd_pfn_validate() filling it with the current contents of
the on-media info-block location. For fields like, 'flags' and the
'padding' it potentially means that future implementations can not rely on
those fields being zero.
In preparation to stop using the 'start_pad' and 'end_trunc' fields for
section alignment, arrange for fields that are not explicitly initialized
to be guaranteed zero. Bump the minor version to indicate it is safe to
assume the 'padding' and 'flags' are zero. Otherwise, this corruption is
expected to benign since all other critical fields are explicitly
initialized.
Note The cc: stable is about spreading this new policy to as many kernels
as possible not fixing an issue in those kernels. It is not until the
change titled "libnvdimm/pfn: Stop padding pmem namespaces to section
alignment" where this improper initialization becomes a problem. So if
someone decides to backport "libnvdimm/pfn: Stop padding pmem namespaces
to section alignment" (which is not tagged for stable), make sure this
pre-requisite is flagged.
Link: http://lkml.kernel.org/r/156092356065.979959.6681003754765958296.stgit@dwil…
Fixes: 32ab0a3f5170 ("libnvdimm, pmem: 'struct page' for pmem")
Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
Tested-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> [ppc64]
Cc: <stable(a)vger.kernel.org>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: Jane Chu <jane.chu(a)oracle.com>
Cc: Jeff Moyer <jmoyer(a)redhat.com>
Cc: Jérôme Glisse <jglisse(a)redhat.com>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Mike Rapoport <rppt(a)linux.ibm.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Pavel Tatashin <pasha.tatashin(a)soleen.com>
Cc: Toshi Kani <toshi.kani(a)hpe.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Wei Yang <richardw.yang(a)linux.intel.com>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/nvdimm/dax_devs.c | 2 +-
drivers/nvdimm/pfn.h | 1 +
drivers/nvdimm/pfn_devs.c | 18 +++++++++++++++---
3 files changed, 17 insertions(+), 4 deletions(-)
--- a/drivers/nvdimm/dax_devs.c~libnvdimm-pfn-fix-fsdax-mode-namespace-info-block-zero-fields
+++ a/drivers/nvdimm/dax_devs.c
@@ -118,7 +118,7 @@ int nd_dax_probe(struct device *dev, str
nvdimm_bus_unlock(&ndns->dev);
if (!dax_dev)
return -ENOMEM;
- pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
nd_pfn->pfn_sb = pfn_sb;
rc = nd_pfn_validate(nd_pfn, DAX_SIG);
dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
--- a/drivers/nvdimm/pfn_devs.c~libnvdimm-pfn-fix-fsdax-mode-namespace-info-block-zero-fields
+++ a/drivers/nvdimm/pfn_devs.c
@@ -412,6 +412,15 @@ static int nd_pfn_clear_memmap_errors(st
return 0;
}
+/**
+ * nd_pfn_validate - read and validate info-block
+ * @nd_pfn: fsdax namespace runtime state / properties
+ * @sig: 'devdax' or 'fsdax' signature
+ *
+ * Upon return the info-block buffer contents (->pfn_sb) are
+ * indeterminate when validation fails, and a coherent info-block
+ * otherwise.
+ */
int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
{
u64 checksum, offset;
@@ -557,7 +566,7 @@ int nd_pfn_probe(struct device *dev, str
nvdimm_bus_unlock(&ndns->dev);
if (!pfn_dev)
return -ENOMEM;
- pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
nd_pfn = to_nd_pfn(pfn_dev);
nd_pfn->pfn_sb = pfn_sb;
rc = nd_pfn_validate(nd_pfn, PFN_SIG);
@@ -693,7 +702,7 @@ static int nd_pfn_init(struct nd_pfn *nd
u64 checksum;
int rc;
- pfn_sb = devm_kzalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
+ pfn_sb = devm_kmalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
if (!pfn_sb)
return -ENOMEM;
@@ -702,11 +711,14 @@ static int nd_pfn_init(struct nd_pfn *nd
sig = DAX_SIG;
else
sig = PFN_SIG;
+
rc = nd_pfn_validate(nd_pfn, sig);
if (rc != -ENODEV)
return rc;
/* no info block, do init */;
+ memset(pfn_sb, 0, sizeof(*pfn_sb));
+
nd_region = to_nd_region(nd_pfn->dev.parent);
if (nd_region->ro) {
dev_info(&nd_pfn->dev,
@@ -759,7 +771,7 @@ static int nd_pfn_init(struct nd_pfn *nd
memcpy(pfn_sb->uuid, nd_pfn->uuid, 16);
memcpy(pfn_sb->parent_uuid, nd_dev_to_uuid(&ndns->dev), 16);
pfn_sb->version_major = cpu_to_le16(1);
- pfn_sb->version_minor = cpu_to_le16(2);
+ pfn_sb->version_minor = cpu_to_le16(3);
pfn_sb->start_pad = cpu_to_le32(start_pad);
pfn_sb->end_trunc = cpu_to_le32(end_trunc);
pfn_sb->align = cpu_to_le32(nd_pfn->align);
--- a/drivers/nvdimm/pfn.h~libnvdimm-pfn-fix-fsdax-mode-namespace-info-block-zero-fields
+++ a/drivers/nvdimm/pfn.h
@@ -28,6 +28,7 @@ struct nd_pfn_sb {
__le32 end_trunc;
/* minor-version-2 record the base alignment of the mapping */
__le32 align;
+ /* minor-version-3 guarantee the padding and flags are zero */
u8 padding[4000];
__le64 checksum;
};
_
From: Nadav Amit <namit(a)vmware.com>
Subject: resource: fix locking in find_next_iomem_res()
Since resources can be removed, locking should ensure that the resource is
not removed while accessing it. However, find_next_iomem_res() does not
hold the lock while copying the data of the resource.
Keep holding the lock while the data is copied. While at it, change the
return value to a more informative value. It is disregarded by the
callers.
[akpm(a)linux-foundation.org: fix find_next_iomem_res() documentation]
Link: http://lkml.kernel.org/r/20190613045903.4922-2-namit@vmware.com
Fixes: ff3cc952d3f00 ("resource: Add remove_resource interface")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Reviewed-by: Dan Williams <dan.j.williams(a)intel.com>
Cc: Borislav Petkov <bp(a)suse.de>
Cc: Toshi Kani <toshi.kani(a)hpe.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Ingo Molnar <mingo(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/resource.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/kernel/resource.c~resource-fix-locking-in-find_next_iomem_res
+++ a/kernel/resource.c
@@ -326,7 +326,7 @@ EXPORT_SYMBOL(release_resource);
*
* If a resource is found, returns 0 and @*res is overwritten with the part
* of the resource that's within [@start..@end]; if none is found, returns
- * -1 or -EINVAL for other invalid parameters.
+ * -ENODEV. Returns -EINVAL for invalid parameters.
*
* This function walks the whole tree and not just first level children
* unless @first_lvl is true.
@@ -365,16 +365,16 @@ static int find_next_iomem_res(resource_
break;
}
- read_unlock(&resource_lock);
- if (!p)
- return -1;
+ if (p) {
+ /* copy data */
+ res->start = max(start, p->start);
+ res->end = min(end, p->end);
+ res->flags = p->flags;
+ res->desc = p->desc;
+ }
- /* copy data */
- res->start = max(start, p->start);
- res->end = min(end, p->end);
- res->flags = p->flags;
- res->desc = p->desc;
- return 0;
+ read_unlock(&resource_lock);
+ return p ? 0 : -ENODEV;
}
static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
_
Servers can defer destaging any data and updating the mtime until close().
This means that if we do a setinfo to modify the mtime while other handles
are open for write the server may overwrite our setinfo timestamps when
if flushes the file on close() of the writeable handle.
To solve this we add an explicit flush when the mtime is about to
be updated.
This fixes "cp -p" to preserve mtime when copying a file onto an SMB2 share.
CC: Stable <stable(a)vger.kernel.org>
Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com>
---
fs/cifs/inode.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 1bffe029fb66..56ca4b8ccaba 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -2406,6 +2406,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
struct inode *inode = d_inode(direntry);
struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
struct cifsInodeInfo *cifsInode = CIFS_I(inode);
+ struct cifsFileInfo *wfile;
+ struct cifs_tcon *tcon;
char *full_path = NULL;
int rc = -EACCES;
__u32 dosattr = 0;
@@ -2452,6 +2454,20 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
mapping_set_error(inode->i_mapping, rc);
rc = 0;
+ if (attrs->ia_valid & ATTR_MTIME) {
+ rc = cifs_get_writable_file(cifsInode, false, &wfile);
+ if (!rc) {
+ tcon = tlink_tcon(wfile->tlink);
+ rc = tcon->ses->server->ops->flush(xid, tcon, &wfile->fid);
+ cifsFileInfo_put(wfile);
+ if (rc)
+ return rc;
+ } else if (rc != -EBADF)
+ return rc;
+ else
+ rc = 0;
+ }
+
if (attrs->ia_valid & ATTR_SIZE) {
rc = cifs_set_file_size(inode, attrs, xid, full_path);
if (rc != 0)
--
2.13.6
The patch titled
Subject: mm: compaction: avoid 100% CPU usage during compaction when a task is killed
has been added to the -mm tree. Its filename is
mm-compaction-avoid-100%-cpu-usage-during-compaction-when-a-task-is-killed.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-compaction-avoid-100%25-cpu-usa…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-compaction-avoid-100%25-cpu-usa…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Mel Gorman <mgorman(a)techsingularity.net>
Subject: mm: compaction: avoid 100% CPU usage during compaction when a task is killed
"howaboutsynergy" reported via kernel buzilla number 204165 that
compact_zone_order was consuming 100% CPU during a stress test for
prolonged periods of time. Specifically the following command, which
should exit in 10 seconds, was taking an excessive time to finish while
the CPU was pegged at 100%.
stress -m 220 --vm-bytes 1000000000 --timeout 10
Tracing indicated a pattern as follows
stress-3923 [007] 519.106208: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106212: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106216: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106219: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106223: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106227: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106231: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106235: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106238: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
stress-3923 [007] 519.106242: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0
Note that compaction is entered in rapid succession while scanning and
isolating nothing. The problem is that when a task that is compacting
receives a fatal signal, it retries indefinitely instead of exiting while
making no progress as a fatal signal is pending.
It's not easy to trigger this condition although enabling zswap helps on
the basis that the timing is altered. A very small window has to be hit
for the problem to occur (signal delivered while compacting and isolating
a PFN for migration that is not aligned to SWAP_CLUSTER_MAX).
This was reproduced locally -- 16G single socket system, 8G swap, 30%
zswap configured, vm-bytes 22000000000 using Colin Kings stress-ng
implementation from github running in a loop until the problem hits).
Tracing recorded the problem occurring almost 200K times in a short
window. With this patch, the problem hit 4 times but the task existed
normally instead of consuming CPU.
This problem has existed for some time but it was made worse by
cf66f0700c8f ("mm, compaction: do not consider a need to reschedule as
contention"). Before that commit, if the same condition was hit then
locks would be quickly contended and compaction would exit that way.
The reporter's real name is unknown. This was caught and repaired due to
their testing and tracing.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204165
Link: http://lkml.kernel.org/r/20190718085708.GE24383@techsingularity.net
Fixes: cf66f0700c8f ("mm, compaction: do not consider a need to reschedule as contention")
Signed-off-by: Mel Gorman <mgorman(a)techsingularity.net>
Reported-by: <howaboutsynergy(a)protonmail.com>
Tested-by: <howaboutsynergy(a)protonmail.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: <stable(a)vger.kernel.org> [5.1+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/compaction.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/mm/compaction.c~mm-compaction-avoid-100%-cpu-usage-during-compaction-when-a-task-is-killed
+++ a/mm/compaction.c
@@ -842,13 +842,15 @@ isolate_migratepages_block(struct compac
/*
* Periodically drop the lock (if held) regardless of its
- * contention, to give chance to IRQs. Abort async compaction
- * if contended.
+ * contention, to give chance to IRQs. Abort completely if
+ * a fatal signal is pending.
*/
if (!(low_pfn % SWAP_CLUSTER_MAX)
&& compact_unlock_should_abort(&pgdat->lru_lock,
- flags, &locked, cc))
- break;
+ flags, &locked, cc)) {
+ low_pfn = 0;
+ goto fatal_pending;
+ }
if (!pfn_valid_within(low_pfn))
goto isolate_fail;
@@ -1060,6 +1062,7 @@ isolate_abort:
trace_mm_compaction_isolate_migratepages(start_pfn, low_pfn,
nr_scanned, nr_isolated);
+fatal_pending:
cc->total_migrate_scanned += nr_scanned;
if (nr_isolated)
count_compact_events(COMPACTISOLATED, nr_isolated);
_
Patches currently in -mm which might be from mgorman(a)techsingularity.net are
mm-compaction-avoid-100%-cpu-usage-during-compaction-when-a-task-is-killed.patch
The patch titled
Subject: mm: migrate: fix reference check race between __find_get_block() and migration
has been added to the -mm tree. Its filename is
mm-migrate-fix-reference-check-race-between-__find_get_block-and-migration.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-migrate-fix-reference-check-rac…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-migrate-fix-reference-check-rac…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Jan Kara <jack(a)suse.cz>
Subject: mm: migrate: fix reference check race between __find_get_block() and migration
buffer_migrate_page_norefs() can race with bh users in the following way:
CPU1 CPU2
buffer_migrate_page_norefs()
buffer_migrate_lock_buffers()
checks bh refs
spin_unlock(&mapping->private_lock)
__find_get_block()
spin_lock(&mapping->private_lock)
grab bh ref
spin_unlock(&mapping->private_lock)
move page do bh work
This can result in various issues like lost updates to buffers (i.e.
metadata corruption) or use after free issues for the old page.
This patch closes the race by holding mapping->private_lock while the
mapping is being moved to a new page. Ordinarily, a reference can be
taken outside of the private_lock using the per-cpu BH LRU but the
references are checked and the LRU invalidated if necessary. The
private_lock is held once the references are known so the buffer lookup
slow path will spin on the private_lock. Between the page lock and
private_lock, it should be impossible for other references to be acquired
and updates to happen during the migration.
A user had reported data corruption issues on a distribution kernel with a
similar page migration implementation as mainline. The data corruption
could not be reproduced with this patch applied. A small number of
migration-intensive tests were run and no performance problems were noted.
[mgorman(a)techsingularity.net: Changelog, removed tracing]
Link: http://lkml.kernel.org/r/20190718090238.GF24383@techsingularity.net
Fixes: 89cb0888ca14 "mm: migrate: provide buffer_migrate_page_norefs()"
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Mel Gorman <mgorman(a)techsingularity.net>
Cc: <stable(a)vger.kernel.org> [5.0+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/migrate.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/migrate.c~mm-migrate-fix-reference-check-race-between-__find_get_block-and-migration
+++ a/mm/migrate.c
@@ -768,12 +768,12 @@ recheck_buffers:
}
bh = bh->b_this_page;
} while (bh != head);
- spin_unlock(&mapping->private_lock);
if (busy) {
if (invalidated) {
rc = -EAGAIN;
goto unlock_buffers;
}
+ spin_unlock(&mapping->private_lock);
invalidate_bh_lrus();
invalidated = true;
goto recheck_buffers;
@@ -806,6 +806,8 @@ recheck_buffers:
rc = MIGRATEPAGE_SUCCESS;
unlock_buffers:
+ if (check_refs)
+ spin_unlock(&mapping->private_lock);
bh = head;
do {
unlock_buffer(bh);
_
Patches currently in -mm which might be from jack(a)suse.cz are
mm-migrate-fix-reference-check-race-between-__find_get_block-and-migration.patch
The patch titled
Subject: mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker
has been added to the -mm tree. Its filename is
mm-vmscan-check-if-mem-cgroup-is-disabled-or-not-before-calling-memcg-slab-shrinker.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-vmscan-check-if-mem-cgroup-is-d…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-vmscan-check-if-mem-cgroup-is-d…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Yang Shi <yang.shi(a)linux.alibaba.com>
Subject: mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker
Shakeel Butt reported premature oom on kernel with "cgroup_disable=memory"
since mem_cgroup_is_root() returns false even though memcg is actually
NULL. The drop_caches is also broken.
It is because aeed1d325d42 ("mm/vmscan.c: generalize shrink_slab() calls
in shrink_node()") removed the !memcg check before !mem_cgroup_is_root().
And, surprisingly root memcg is allocated even though memory cgroup is
disabled by kernel boot parameter.
Add mem_cgroup_disabled() check to make reclaimer work as expected.
Link: http://lkml.kernel.org/r/1563385526-20805-1-git-send-email-yang.shi@linux.a…
Fixes: aeed1d325d42 ("mm/vmscan.c: generalize shrink_slab() calls in shrink_node()")
Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com>
Reported-by: Shakeel Butt <shakeelb(a)google.com>
Reviewed-by: Shakeel Butt <shakeelb(a)google.com>
Reviewed-by: Kirill Tkhai <ktkhai(a)virtuozzo.com>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Qian Cai <cai(a)lca.pw>
Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> [4.19+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/vmscan.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/mm/vmscan.c~mm-vmscan-check-if-mem-cgroup-is-disabled-or-not-before-calling-memcg-slab-shrinker
+++ a/mm/vmscan.c
@@ -699,7 +699,14 @@ static unsigned long shrink_slab(gfp_t g
unsigned long ret, freed = 0;
struct shrinker *shrinker;
- if (!mem_cgroup_is_root(memcg))
+ /*
+ * The root memcg might be allocated even though memcg is disabled
+ * via "cgroup_disable=memory" boot parameter. This could make
+ * mem_cgroup_is_root() return false, then just run memcg slab
+ * shrink, but skip global shrink. This may result in premature
+ * oom.
+ */
+ if (!mem_cgroup_disabled() && !mem_cgroup_is_root(memcg))
return shrink_slab_memcg(gfp_mask, nid, memcg, priority);
if (!down_read_trylock(&shrinker_rwsem))
_
Patches currently in -mm which might be from yang.shi(a)linux.alibaba.com are
revert-kmemleak-allow-to-coexist-with-fault-injection.patch
mm-vmscan-check-if-mem-cgroup-is-disabled-or-not-before-calling-memcg-slab-shrinker.patch
mm-mempolicy-make-the-behavior-consistent-when-mpol_mf_move-and-mpol_mf_strict-were-specified.patch
mm-mempolicy-handle-vma-with-unmovable-pages-mapped-correctly-in-mbind.patch
mm-thp-make-transhuge_vma_suitable-available-for-anonymous-thp.patch
mm-thp-make-transhuge_vma_suitable-available-for-anonymous-thp-v4.patch
mm-thp-fix-false-negative-of-shmem-vmas-thp-eligibility.patch
A single 32-bit PSR2 training pattern field follows the sixteen element
array of PSR table entries in the VBT spec. But, we incorrectly define
this PSR2 field for each of the PSR table entries. As a result, the PSR1
training pattern duration for any panel_type != 0 will be parsed
incorrectly. Secondly, PSR2 training pattern durations for VBTs with bdb
version >= 226 will also be wrong.
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: José Roberto de Souza <jose.souza(a)intel.com>
Cc: stable(a)vger.kernel.org
Cc: stable(a)vger.kernel.org #v5.2
Fixes: 88a0d9606aff ("drm/i915/vbt: Parse and use the new field with PSR2 TP2/3 wakeup time")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111088
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204183
Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan(a)intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Reviewed-by: José Roberto de Souza <jose.souza(a)intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Tested-by: François Guerraz <kubrick(a)fgv6.net>
---
drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
drivers/gpu/drm/i915/display/intel_vbt_defs.h | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 21501d565327..b416b394b641 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -766,7 +766,7 @@ parse_psr(struct drm_i915_private *dev_priv, const struct bdb_header *bdb)
}
if (bdb->version >= 226) {
- u32 wakeup_time = psr_table->psr2_tp2_tp3_wakeup_time;
+ u32 wakeup_time = psr->psr2_tp2_tp3_wakeup_time;
wakeup_time = (wakeup_time >> (2 * panel_type)) & 0x3;
switch (wakeup_time) {
diff --git a/drivers/gpu/drm/i915/display/intel_vbt_defs.h b/drivers/gpu/drm/i915/display/intel_vbt_defs.h
index 93f5c9d204d6..09cd37fb0b1c 100644
--- a/drivers/gpu/drm/i915/display/intel_vbt_defs.h
+++ b/drivers/gpu/drm/i915/display/intel_vbt_defs.h
@@ -481,13 +481,13 @@ struct psr_table {
/* TP wake up time in multiple of 100 */
u16 tp1_wakeup_time;
u16 tp2_tp3_wakeup_time;
-
- /* PSR2 TP2/TP3 wakeup time for 16 panels */
- u32 psr2_tp2_tp3_wakeup_time;
} __packed;
struct bdb_psr {
struct psr_table psr_table[16];
+
+ /* PSR2 TP2/TP3 wakeup time for 16 panels */
+ u32 psr2_tp2_tp3_wakeup_time;
} __packed;
/*
--
2.17.1
Hi,
Hope this note finds you well.
We being a global B2B database provider over a decade and a Compliant
Certificate Holder for GDPR. I am trying to reach you with potential
leads to help you target your marketing capabilities and boost your sales
and marketing plans for 2019.
IT Decision Makers: CIO, CTO, VP of IT, IT/Technology, Director of IT, IT
Managers Etc.
Finance: CFO, Chief Accountant, VP of Finance, President of Finance,
Controllers, Etc.
Marketing: CMO, SVP/VP Marketing, VP Partner Marketing, Director of
Marketing Etc.
Telecom/Contact Center VP Telecom, Principal Director Telecom, Senior
Director Contact Center Etc.
HR Decision Makers: Head of HR, Chief HR Officer, SVP HR, Director HR, VP
of HR Etc.
IT Security CISO, Head of Security, VP of IT Security Etc. And many more
titles.
We do also have: If you are looking for the right MSPs, MSSPs, ISVs and
VARs to partner with. We have a customized list of MSPs, MSSPs, CSPs, VADs,
SIs, ISVs and VARs rendering services for Backup and Recovery,
Connectivity, Cyber/Email/Network/Cloud Security, IaaS, VoIP, CRM, DaaS,
Virtualization, IT Consulting, ERP, PaaS, End Users, Channel Partners,
Resellers, OEM Partners, Software Solution and Technology Partners,
Services Partners and many more.
Please let me know what technology users you would be interested in and I
will get back to you with more information regarding the same.
Regards,
Rosie Huynh
Marketing Specialist
If you don't want to include yourself in our mailing list, please reply
back “Leave Out" in a subject line
Changes since v1 [1]:
- Fix an ioctl command corruption regression that manifested as an
intermittent failure of the monitor.sh unit test. This is handled in
the patch4 prep patch that makes it safe for nd_ioctl() to be
re-entrant. (Vishal)
- Update the changelog for the driver-core 'lockdep_lock' hack to
indicate Greg's non-NAK.
[1]: https://lore.kernel.org/lkml/156029554317.419799.1324389595953183385.stgit@…
---
The libnvdimm subsystem uses async operations to parallelize device
probing operations and to allow sysfs to trigger device_unregister() on
deleted namepsaces. A multithreaded stress test of the libnvdimm sysfs
interface uncovered a case where device_unregister() is triggered
multiple times, and the subsequent investigation uncovered a broken
locking scenario.
The lack of lockdep coverage for device_lock() stymied the debug. That
is, until patch6 "driver-core, libnvdimm: Let device subsystems add
local lockdep coverage" solved that with a shadow lock, with lockdep
coverage, to mirror device_lock() operations. Given the time saved with
shadow-lock debug-hack, patch6 attempts to generalize device_lock()
debug facility that might be able to be carried upstream. Patch6 is
staged at the end of this fix series in case it is contentious and needs
to be dropped.
Patch1 "drivers/base: Introduce kill_device()" could be achieved with
local libnvdimm infrastructure. However, the existing 'dead' flag in
'struct device_private' aims to solve similar async register/unregister
races so the fix in patch2 "libnvdimm/bus: Prevent duplicate
device_unregister() calls" can be implemented with existing driver-core
infrastructure.
Patch3 is a rare lockdep warning that is intermittent based on
namespaces racing ahead of the completion of probe of their parent
region. It is not related to the other fixes, it just happened to
trigger as a result of the async stress test.
Patch5 and patch6 address an ABBA deadlock tripped by the stress test.
These patches pass the failing stress test and the existing libnvdimm
unit tests with CONFIG_PROVE_LOCKING=y and the new "dev->lockdep_mutex"
shadow lock with no lockdep warnings.
---
Dan Williams (7):
drivers/base: Introduce kill_device()
libnvdimm/bus: Prevent duplicate device_unregister() calls
libnvdimm/region: Register badblocks before namespaces
libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant
libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl()
libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock
driver-core, libnvdimm: Let device subsystems add local lockdep coverage
drivers/acpi/nfit/core.c | 28 +++--
drivers/acpi/nfit/nfit.h | 24 ++++
drivers/base/core.c | 30 ++++--
drivers/nvdimm/btt_devs.c | 16 +--
drivers/nvdimm/bus.c | 210 ++++++++++++++++++++++++++-------------
drivers/nvdimm/core.c | 10 +-
drivers/nvdimm/dimm_devs.c | 4 -
drivers/nvdimm/namespace_devs.c | 36 +++----
drivers/nvdimm/nd-core.h | 71 +++++++++++++
drivers/nvdimm/pfn_devs.c | 24 ++--
drivers/nvdimm/pmem.c | 4 -
drivers/nvdimm/region.c | 24 ++--
drivers/nvdimm/region_devs.c | 12 +-
include/linux/device.h | 6 +
14 files changed, 343 insertions(+), 156 deletions(-)
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
On VLV/CHV there is some kind of linkage between the cdclk frequency
and the DP link frequency. The spec says:
"For DP audio configuration, cdclk frequency shall be set to
meet the following requirements:
DP Link Frequency(MHz) | Cdclk frequency(MHz)
270 | 320 or higher
162 | 200 or higher"
I suspect that would more accurately be expressed as
"cdclk >= DP link clock", and in any case we can express it like
that in the code because of the limited set of cdclk and link
frequencies we support.
Without this we can end up in a situation where the cdclk
is too low and enabling DP audio will kill the pipe. Happens
eg. with 2560x1440 modes where the 266MHz cdclk is sufficient
to pump the pixels (241.5 MHz dotclock) but is too low for
the DP audio due to the link frequency being 270 MHz.
Cc: stable(a)vger.kernel.org
Tested-by: Stefan Gottwald <gottwald(a)igel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111149
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/intel_cdclk.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_cdclk.c b/drivers/gpu/drm/i915/display/intel_cdclk.c
index d0581a1ac243..93b0d190c184 100644
--- a/drivers/gpu/drm/i915/display/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/display/intel_cdclk.c
@@ -2262,6 +2262,17 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
min_cdclk = max(2 * 96000, min_cdclk);
+ /*
+ * "For DP audio configuration, cdclk frequency shall be set to
+ * meet the following requirements:
+ * DP Link Frequency(MHz) | Cdclk frequency(MHz)
+ * 270 | 320 or higher
+ * 162 | 200 or higher"
+ */
+ if ((IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+ intel_crtc_has_dp_encoder(crtc_state) && crtc_state->has_audio)
+ min_cdclk = max(crtc_state->port_clock, min_cdclk);
+
/*
* On Valleyview some DSI panels lose (v|h)sync when the clock is lower
* than 320000KHz.
--
2.21.0
Folks!
There are more and more people worried about these usually harmless
warnings:
do_IRQ: 0.39 No irq handler for vector
It took a while to figure out why that happens and why it is harmless for
most interrupts, but there is also a real issue hidden for level type
IOAPIC interrupts.
The following commits in Linus tree are addressing the issue:
b7107a67f0d1 ("x86/irq: Handle spurious interrupt after shutdown gracefully")
dfe0cf8b51b0 ("x86/ioapic: Implement irq_get_irqchip_state() callback")
62e0468650c3 ("genirq: Add optional hardware synchronization for shutdown")
1d21f2af8571 ("genirq: Fix misleading synchronize_irq() documentation")
4001d8e8762f ("genirq: Delay deactivation in free_irq()")
There is another one which makes sense to be backported:
f8a8fe61fec8 ("x86/irq: Seperate unused system vectors from spurious entry again")
These should go back to 4.19, but not farther.
They apply cleanly to 5.1 and 5.2. A backport to 4.19 is attached.
Thanks,
tglx
GPU hang observed during the guest OCL conformance test which is caused
by THP GTT feature used durning the test.
It was observed the same GFN with different size (4K and 2M) requested
from the guest in GVT. So during the guest page dma map stage, it is
required to unmap first with orginal size and then remap again with
requested size.
Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
Cc: stable(a)vger.kernel.org
Signed-off-by: Xiaolin Zhang <xiaolin.zhang(a)intel.com>
---
drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index a68addf..4a7cf86 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1911,6 +1911,18 @@ static int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn,
ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
if (ret)
goto err_unmap;
+ } else if (entry->size != size) {
+ /* the same gfn with different size: unmap and re-map */
+ gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size);
+ __gvt_cache_remove_entry(vgpu, entry);
+
+ ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
+ if (ret)
+ goto err_unlock;
+
+ ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
+ if (ret)
+ goto err_unmap;
} else {
kref_get(&entry->ref);
*dma_addr = entry->dma_addr;
--
1.8.3.1
From: Josua Mayer <josua(a)solid-run.com>
Armada 8040 needs four clocks to be enabled for MDIO accesses to work.
Update the binding to allow the extra clock to be specified.
Cc: stable(a)vger.kernel.org
Fixes: 6d6a331f44a1 ("dt-bindings: allow up to three clocks for orion-mdio")
Signed-off-by: Josua Mayer <josua(a)solid-run.com>
---
Documentation/devicetree/bindings/net/marvell-orion-mdio.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
index 42cd81090a2c..3f3cfc1d8d4d 100644
--- a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+++ b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
@@ -16,7 +16,7 @@ Required properties:
Optional properties:
- interrupts: interrupt line number for the SMI error/done interrupt
-- clocks: phandle for up to three required clocks for the MDIO instance
+- clocks: phandle for up to four required clocks for the MDIO instance
The child nodes of the MDIO driver are the individual PHY devices
connected to this MDIO bus. They must have a "reg" property given the
--
2.16.4
VAG power control is improved to fit the manual [1]. This patchset fixes as
minimum one bug: if customer muxes Headphone to Line-In right after boot,
the VAG power remains off that leads to poor sound quality from line-in.
I.e. after boot:
- Connect sound source to Line-In jack;
- Connect headphone to HP jack;
- Run following commands:
$ amixer set 'Headphone' 80%
$ amixer set 'Headphone Mux' LINE_IN
Also this series includes fixes of non-important bugs in sgtl5000 codec
driver.
[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf
Changes in v4:
- CC the patch to kernel-stable
- Code optimization, simplify function signature
(thanks to Cezary Rojewski <cezary.rojewski(a)intel.com> for an idea)
- CC the patch to kernel-stable
- Add a Fixes tag
Changes in v3:
- Add the reference to NXP SGTL5000 data sheet to commit message
- Add the reference to NXP SGTL5000 data sheet to commit message
- Fix multi-line comment format
Changes in v2:
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
- Fix patch formatting
Oleksandr Suvorov (6):
ASoC: Define a set of DAPM pre/post-up events
ASoC: sgtl5000: Improve VAG power and mute control
ASoC: sgtl5000: Fix definition of VAG Ramp Control
ASoC: sgtl5000: add ADC mute control
ASoC: sgtl5000: Fix of unmute outputs on probe
ASoC: sgtl5000: Fix charge pump source assignment
include/sound/soc-dapm.h | 2 +
sound/soc/codecs/sgtl5000.c | 240 ++++++++++++++++++++++++++++++------
sound/soc/codecs/sgtl5000.h | 2 +-
3 files changed, 203 insertions(+), 41 deletions(-)
--
2.20.1
When testing with a device which uses the drm/udl driver, KASAN shows
that on hot-remove we have a use-after-free:
==================================================================
BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0xd0
Read of size 4 at addr ffff888385e325fc by task kworker/2:2/47
CPU: 2 PID: 47 Comm: kworker/2:2 Tainted: G U 4.14.133 #19
Hardware name: GOOGLE Samus, BIOS Google_Samus.6300.276.0 08/17/2016
Workqueue: events drm_mode_rmfb_work_fn
Call Trace:
dump_stack+0x67/0x92
print_address_description+0x80/0x2d6
? do_raw_spin_lock+0x1c/0xd0
kasan_report+0x255/0x295
do_raw_spin_lock+0x1c/0xd0
_raw_spin_lock_irqsave+0x42/0x4e
? down_timeout+0x19/0x58
down_timeout+0x19/0x58
udl_get_urb+0x3d/0x13b
? drm_helper_encoder_in_use+0xc2/0xe1
udl_crtc_dpms+0x45/0x274
__drm_helper_disable_unused_functions+0xed/0x150
drm_crtc_helper_set_config+0x22d/0xfc2
? lock_acquire+0x1e4/0x21a
? modeset_lock+0x165/0x20e
? __mutex_trylock+0x9/0x11
? debug_lockdep_rcu_enabled+0x2a/0x59
__drm_mode_set_config_internal+0xf3/0x240
drm_crtc_force_disable+0x68/0x83
drm_framebuffer_remove+0x10b/0x1af
drm_mode_rmfb_work_fn+0x8d/0x9b
process_one_work+0x42f/0x7a2
worker_thread+0x3a4/0x483
? flush_delayed_work+0x64/0x64
kthread+0x1e7/0x1f7
? __init_completion+0x2c/0x2c
ret_from_fork+0x3a/0x50
Allocated by task 1959:
save_stack+0x46/0xce
kasan_kmalloc+0x99/0xa8
kmem_cache_alloc_trace+0x10d/0x133
udl_driver_load+0x59/0x7fe
drm_dev_register+0x16b/0x2fd
udl_usb_probe+0x4f/0xa6
usb_probe_interface+0x26a/0x31d
driver_probe_device+0x1d5/0x411
bus_for_each_drv+0xbe/0xe5
__device_attach+0xdd/0x15b
bus_probe_device+0x5a/0x10b
device_add+0x468/0x7fb
usb_set_configuration+0x978/0x9e5
generic_probe+0x45/0x77
driver_probe_device+0x1d5/0x411
bus_for_each_drv+0xbe/0xe5
__device_attach+0xdd/0x15b
bus_probe_device+0x5a/0x10b
device_add+0x468/0x7fb
usb_new_device+0x51d/0x6a1
hub_event+0xee4/0x1639
process_one_work+0x42f/0x7a2
worker_thread+0x31c/0x483
kthread+0x1e7/0x1f7
ret_from_fork+0x3a/0x50
Freed by task 1959:
save_stack+0x46/0xce
kasan_slab_free+0x8a/0xac
slab_free_hook+0x52/0x5c
kfree+0x1a5/0x228
drm_dev_unregister+0xa6/0x16c
drm_dev_unplug+0x12/0x5b
usb_unbind_interface+0xc8/0x2c1
device_release_driver_internal+0x1e4/0x302
bus_remove_device+0x1b9/0x1e4
device_del+0x275/0x42d
usb_disable_device+0x112/0x2cb
usb_disconnect+0xef/0x28e
usb_disconnect+0xe0/0x28e
hub_event+0x7cc/0x1639
process_one_work+0x42f/0x7a2
worker_thread+0x31c/0x483
kthread+0x1e7/0x1f7
ret_from_fork+0x3a/0x50
The buggy address belongs to the object at ffff888385e32588
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 116 bytes inside of
2048-byte region [ffff888385e32588, ffff888385e32d88)
The buggy address belongs to the page:
page:ffffea000e178c00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000008100(slab|head)
raw: 8000000000008100 0000000000000000 0000000000000000 00000001000d000d
raw: ffffea000ee71e20 ffffea000ee6d620 ffff88842d00d0c0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888385e32480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888385e32500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888385e32580: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888385e32600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888385e32680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
This happens 100% of the time and is resolved by the following patch
upstream:
commit 6ecac85eadb9 ("drm/udl: move to embedding drm device inside udl device.")
This patch is the second in this series, and requires the first patch as
a dependency. This series apples cleanly to v4.14.133.
Dave Airlie (2):
drm/udl: introduce a macro to convert dev to udl.
drm/udl: move to embedding drm device inside udl device.
drivers/gpu/drm/udl/udl_drv.c | 56 +++++++++++++++++++++++++++-------
drivers/gpu/drm/udl/udl_drv.h | 9 +++---
drivers/gpu/drm/udl/udl_fb.c | 12 ++++----
drivers/gpu/drm/udl/udl_main.c | 35 ++++++---------------
4 files changed, 65 insertions(+), 47 deletions(-)
--
2.22.0.510.g264f2c817a-goog
The patch titled
Subject: include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures
has been removed from the -mm tree. Its filename was
bug-fix-cut-here-for-warn_on-for-__warn_taint-architectures.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Drew Davenport <ddavenport(a)chromium.org>
Subject: include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures
For architectures using __WARN_TAINT, the WARN_ON macro did not print out
the "cut here" string. The other WARN_XXX macros would print "cut here"
inside __warn_printk, which is not called for WARN_ON since it doesn't
have a message to print.
Link: http://lkml.kernel.org/r/20190624154831.163888-1-ddavenport@chromium.org
Fixes: a7bed27af194 ("bug: fix "cut here" location for __WARN_TAINT architectures")
Signed-off-by: Drew Davenport <ddavenport(a)chromium.org>
Acked-by: Kees Cook <keescook(a)chromium.org>
Tested-by: Kees Cook <keescook(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/asm-generic/bug.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/include/asm-generic/bug.h~bug-fix-cut-here-for-warn_on-for-__warn_taint-architectures
+++ a/include/asm-generic/bug.h
@@ -104,8 +104,10 @@ extern void warn_slowpath_null(const cha
warn_slowpath_fmt_taint(__FILE__, __LINE__, taint, arg)
#else
extern __printf(1, 2) void __warn_printk(const char *fmt, ...);
-#define __WARN() __WARN_TAINT(TAINT_WARN)
-#define __WARN_printf(arg...) do { __warn_printk(arg); __WARN(); } while (0)
+#define __WARN() do { \
+ printk(KERN_WARNING CUT_HERE); __WARN_TAINT(TAINT_WARN); \
+} while (0)
+#define __WARN_printf(arg...) __WARN_printf_taint(TAINT_WARN, arg)
#define __WARN_printf_taint(taint, arg...) \
do { __warn_printk(arg); __WARN_TAINT(taint); } while (0)
#endif
_
Patches currently in -mm which might be from ddavenport(a)chromium.org are
The patch titled
Subject: coda: pass the host file in vma->vm_file on mmap
has been removed from the -mm tree. Its filename was
coda-pass-the-host-file-in-vma-vm_file-on-mmap.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jan Harkes <jaharkes(a)cs.cmu.edu>
Subject: coda: pass the host file in vma->vm_file on mmap
Patch series "Coda updates".
The following patch series is a collection of various fixes for Coda, most
of which were collected from linux-fsdevel or linux-kernel but which have
as yet not found their way upstream.
This patch (of 22):
Various file systems expect that vma->vm_file points at their own file
handle, several use file_inode(vma->vm_file) to get at their inode or use
vma->vm_file->private_data. However the way Coda wrapped mmap on a host
file broke this assumption, vm_file was still pointing at the Coda file
and the host file systems would scribble over Coda's inode and private
file data.
This patch fixes the incorrect expectation and wraps vm_ops->open and
vm_ops->close to allow Coda to track when the vm_area_struct is destroyed
so we still release the reference on the Coda file handle at the right
time.
Link: http://lkml.kernel.org/r/0e850c6e59c0b147dc2dcd51a3af004c948c3697.155811738…
Signed-off-by: Jan Harkes <jaharkes(a)cs.cmu.edu>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Colin Ian King <colin.king(a)canonical.com>
Cc: Dan Carpenter <dan.carpenter(a)oracle.com>
Cc: David Howells <dhowells(a)redhat.com>
Cc: Fabian Frederick <fabf(a)skynet.be>
Cc: Mikko Rapeli <mikko.rapeli(a)iki.fi>
Cc: Sam Protsenko <semen.protsenko(a)linaro.org>
Cc: Yann Droneaud <ydroneaud(a)opteya.com>
Cc: Zhouyang Jia <jiazhouyang09(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/coda/file.c | 70 +++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 68 insertions(+), 2 deletions(-)
--- a/fs/coda/file.c~coda-pass-the-host-file-in-vma-vm_file-on-mmap
+++ a/fs/coda/file.c
@@ -27,6 +27,13 @@
#include "coda_linux.h"
#include "coda_int.h"
+struct coda_vm_ops {
+ atomic_t refcnt;
+ struct file *coda_file;
+ const struct vm_operations_struct *host_vm_ops;
+ struct vm_operations_struct vm_ops;
+};
+
static ssize_t
coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
@@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb,
return ret;
}
+static void
+coda_vm_open(struct vm_area_struct *vma)
+{
+ struct coda_vm_ops *cvm_ops =
+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+ atomic_inc(&cvm_ops->refcnt);
+
+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open)
+ cvm_ops->host_vm_ops->open(vma);
+}
+
+static void
+coda_vm_close(struct vm_area_struct *vma)
+{
+ struct coda_vm_ops *cvm_ops =
+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close)
+ cvm_ops->host_vm_ops->close(vma);
+
+ if (atomic_dec_and_test(&cvm_ops->refcnt)) {
+ vma->vm_ops = cvm_ops->host_vm_ops;
+ fput(cvm_ops->coda_file);
+ kfree(cvm_ops);
+ }
+}
+
static int
coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
{
@@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, s
struct coda_inode_info *cii;
struct file *host_file;
struct inode *coda_inode, *host_inode;
+ struct coda_vm_ops *cvm_ops;
+ int ret;
cfi = CODA_FTOC(coda_file);
BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC);
@@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, s
if (!host_file->f_op->mmap)
return -ENODEV;
+ if (WARN_ON(coda_file != vma->vm_file))
+ return -EIO;
+
+ cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL);
+ if (!cvm_ops)
+ return -ENOMEM;
+
coda_inode = file_inode(coda_file);
host_inode = file_inode(host_file);
@@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, s
* the container file on us! */
else if (coda_inode->i_mapping != host_inode->i_mapping) {
spin_unlock(&cii->c_lock);
+ kfree(cvm_ops);
return -EBUSY;
}
@@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, s
cfi->cfi_mapcount++;
spin_unlock(&cii->c_lock);
- return call_mmap(host_file, vma);
+ vma->vm_file = get_file(host_file);
+ ret = call_mmap(vma->vm_file, vma);
+
+ if (ret) {
+ /* if call_mmap fails, our caller will put coda_file so we
+ * should drop the reference to the host_file that we got.
+ */
+ fput(host_file);
+ kfree(cvm_ops);
+ } else {
+ /* here we add redirects for the open/close vm_operations */
+ cvm_ops->host_vm_ops = vma->vm_ops;
+ if (vma->vm_ops)
+ cvm_ops->vm_ops = *vma->vm_ops;
+
+ cvm_ops->vm_ops.open = coda_vm_open;
+ cvm_ops->vm_ops.close = coda_vm_close;
+ cvm_ops->coda_file = coda_file;
+ atomic_set(&cvm_ops->refcnt, 1);
+
+ vma->vm_ops = &cvm_ops->vm_ops;
+ }
+ return ret;
}
int coda_open(struct inode *coda_inode, struct file *coda_file)
@@ -207,4 +274,3 @@ const struct file_operations coda_file_o
.fsync = coda_fsync,
.splice_read = generic_file_splice_read,
};
-
_
Patches currently in -mm which might be from jaharkes(a)cs.cmu.edu are
The patch titled
Subject: fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
has been removed from the -mm tree. Its filename was
fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Radoslaw Burny <rburny(a)google.com>
Subject: fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
Normally, the inode's i_uid/i_gid are translated relative to s_user_ns,
but this is not a correct behavior for proc. Since sysctl permission
check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense
to use these values in u_[ug]id of proc inodes. In other words: although
uid/gid in the inode is not read during test_perm, the inode logically
belongs to the root of the namespace. I have confirmed this with Eric
Biederman at LPC and in this thread:
https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com
Consequences
============
Since the i_[ug]id values of proc nodes are not used for permissions
checks, this change usually makes no functional difference. However, it
causes an issue in a setup where:
* a namespace container is created without root user in container -
hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID
* container creator tries to configure it by writing /proc/sys files,
e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit
Kernel does not allow to open an inode for writing if its i_[ug]id are
invalid, making it impossible to write shmmax and thus - configure the
container.
Using a container with no root mapping is apparently rare, but we do use
this configuration at Google. Also, we use a generic tool to configure
the container limits, and the inability to write any of them causes a
failure.
History
=======
The invalid uids/gids in inodes first appeared due to 81754357770e (fs:
Update i_[ug]id_(read|write) to translate relative to s_user_ns).
However, AFAIK, this did not immediately cause any issues. The inability
to write to these "invalid" inodes was only caused by a later commit
0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown to the
vfs).
Tested: Used a repro program that creates a user namespace without any
mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside.
Before the change, it shows the overflow uid, with the change it's 0. The
overflow uid indicates that the uid in the inode is not correct and thus
it is not possible to open the file for writing.
Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com
Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs")
Signed-off-by: Radoslaw Burny <rburny(a)google.com>
Acked-by: Luis Chamberlain <mcgrof(a)kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Seth Forshee <seth.forshee(a)canonical.com>
Cc: John Sperbeck <jsperbeck(a)google.com>
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: <stable(a)vger.kernel.org> [4.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/proc_sysctl.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/proc/proc_sysctl.c~fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes
+++ a/fs/proc/proc_sysctl.c
@@ -499,6 +499,10 @@ static struct inode *proc_sys_make_inode
if (root->set_ownership)
root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+ else {
+ inode->i_uid = GLOBAL_ROOT_UID;
+ inode->i_gid = GLOBAL_ROOT_GID;
+ }
return inode;
}
_
Patches currently in -mm which might be from rburny(a)google.com are
Hello Christian,
> Hi,
>
> I assume you use the 1000 MHz firmware. This does also not work on my Rev 7
> board. But I'm pretty sure this is not a problem of the patches, because if
> I take a newer kernel (4.19.20/27) without the patches it also does not
> work. A kernel 4.19.17 does work for me. My opinion on that is that this is
> another problem which does just occure now because now the cpu frequency
> scaling is working with the right frequencies.
I am not sure which firmware i am running, i did all my tests on 5.0.0 and
changing between governors worked fine without the patches
Regards
/Ilias
>
> Ilias Apalodimas <ilias.apalodimas(a)linaro.org> schrieb am Do., 14. März
> 2019, 13:15:
>
> > Hi Gregory,
> > > The clock parenting was not setup properly when DVFS was enabled. It was
> > > expected that the same clock source was used with and without DVFS which
> > > was not the case.
> > >
> > > This patch fixes this issue, allowing to make the cpufreq support work
> > > when the CPU clocks source are not the default ones.
> > >
> > > Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
> > > Cc: <stable(a)vger.kernel.org>
> > > Reported-by: Christian Neubert <christian.neubert.86(a)gmail.com>
> > > Reported-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org>
> > > Signed-off-by: Gregory CLEMENT <gregory.clement(a)bootlin.com>
> > > ---
> > > drivers/clk/mvebu/armada-37xx-periph.c | 11 +++++++++++
> > > 1 file changed, 11 insertions(+)
> > >
> > > diff --git a/drivers/clk/mvebu/armada-37xx-periph.c
> > b/drivers/clk/mvebu/armada-37xx-periph.c
> > > index 1f1cff428d78..26ed3c18a239 100644
> > > --- a/drivers/clk/mvebu/armada-37xx-periph.c
> > > +++ b/drivers/clk/mvebu/armada-37xx-periph.c
> > > @@ -671,6 +671,17 @@ static int armada_3700_add_composite_clk(const
> > struct clk_periph_data *data,
> > > map = syscon_regmap_lookup_by_compatible(
> > > "marvell,armada-3700-nb-pm");
> > > pmcpu_clk->nb_pm_base = map;
> > > +
> > > + /*
> > > + * Use the same parent when DVFS is enabled that the
> > > + * default parent received at boot time. When this
> > > + * function is called, DVFS is not enabled yet, so we
> > > + * get the default parent and we can set the parent
> > > + * for DVFS.
> > > + */
> > > + if (clk_pm_cpu_set_parent(muxrate_hw,
> > > +
> > clk_pm_cpu_get_parent(muxrate_hw)))
> > > + dev_warn(dev, "Failed to setup default parent
> > clock for DVFS\n");
> > > }
> > >
> > > *hw = clk_hw_register_composite(dev, data->name,
> > data->parent_names,
> > > --
> > > 2.20.1
> > >
> > Applied this and selected only
> >
> > CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
> > CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
> > CONFIG_CPU_FREQ_GOV_POWERSAVE=y
> >
> > After changing the governor from 'powersave' to 'performance' the board
> > completely froze (i even lost access to the serial port)
> >
> > Cheers
> > /Ilias
> >
GPU hang observed during the guest OCL conformance test which is caused
by THP GTT feature used durning the test.
It was observed the same GFN with different size (4K and 2M) requested
from the guest in GVT. So during the guest page dma map stage, it is
required to unmap first with orginal size and then remap again with
requested size.
Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
Signed-off-by: Xiaolin Zhang <xiaolin.zhang(a)intel.com>
---
drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index a68addf..4a7cf86 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1911,6 +1911,18 @@ static int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn,
ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
if (ret)
goto err_unmap;
+ } else if (entry->size != size) {
+ /* the same gfn with different size: unmap and re-map */
+ gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size);
+ __gvt_cache_remove_entry(vgpu, entry);
+
+ ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
+ if (ret)
+ goto err_unlock;
+
+ ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
+ if (ret)
+ goto err_unmap;
} else {
kref_get(&entry->ref);
*dma_addr = entry->dma_addr;
--
1.8.3.1
From: Mark Zhang <markz(a)nvidia.com>
commit 7151449fe7fa5962c6153355f9779d6be99e8e97 upstream.
If client have not provided the mask base register then do not
write into the mask register.
Signed-off-by: Laxman Dewangan <ldewangan(a)nvidia.com>
Signed-off-by: Jinyoung Park <jinyoungp(a)nvidia.com>
Signed-off-by: Venkat Reddy Talla <vreddytalla(a)nvidia.com>
Signed-off-by: Mark Zhang <markz(a)nvidia.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
---
This commit was found in an nVidia product tree based on
v4.19, and looks like definitive stable material to me.
It should go into v4.19 only as far as I can tell.
---
drivers/base/regmap/regmap-irq.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 429ca8ed7e51..982c7ac311b8 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -91,6 +91,9 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
* suppress pointless writes.
*/
for (i = 0; i < d->chip->num_regs; i++) {
+ if (!d->chip->mask_base)
+ continue;
+
reg = d->chip->mask_base +
(i * map->reg_stride * d->irq_reg_stride);
if (d->chip->mask_invert) {
@@ -526,6 +529,9 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
/* Mask all the interrupts by default */
for (i = 0; i < chip->num_regs; i++) {
d->mask_buf[i] = d->mask_buf_def[i];
+ if (!chip->mask_base)
+ continue;
+
reg = chip->mask_base +
(i * map->reg_stride * d->irq_reg_stride);
if (chip->mask_invert)
--
2.20.1
The Raspberry Pi Compute Module 3 gathers components that are already
supported in 4.19.y kernels except there's no DTB for it. This small
series of patches backports:
1. the DTB addition on the arm platform
2. the extension of this addition to the arm64 platform
3. the correction of this extension.
I chose to backport patch 2 and 3 separately instead of squashing them
together but I can resubmit with patches 2 and 3 merged if that's
desirable.
This was successfully tested on bare metal, in 64-bit mode, with an
extra patch to the raspi3-firmware packages to get the DTB installed
in the right place, under the right name (bcm2710-rpi-cm3.dtb) so that
the bootloader finds it. The base kernel was 4.19.37-5 as packaged in
Debian.
The summary of changes follows.
Liviu Dudau (1):
arm64: dts: broadcom: Use the .dtb name in the rule, rather than .dts
Stefan Wahren (2):
ARM: dts: add Raspberry Pi Compute Module 3 and IO board
arm64: dts: broadcom: Add reference to Compute Module IO Board V3
arch/arm/boot/dts/Makefile | 1 +
arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 87 ++++++++++++++++++++++
arch/arm/boot/dts/bcm2837-rpi-cm3.dtsi | 52 +++++++++++++
arch/arm64/boot/dts/broadcom/Makefile | 3 +-
.../boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts | 2 +
5 files changed, 144 insertions(+), 1 deletion(-)
create mode 100644 arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts
create mode 100644 arch/arm/boot/dts/bcm2837-rpi-cm3.dtsi
create mode 100644 arch/arm64/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts
----- Original Message -----
> From: "Sasha Levin" <sashal(a)kernel.org>
> To: "Sasha Levin" <sashal(a)kernel.org>, "Ronnie Sahlberg" <lsahlber(a)redhat.com>, "linux-cifs"
> <linux-cifs(a)vger.kernel.org>
> Cc: "Steve French" <smfrench(a)gmail.com>, "Stable" <stable(a)vger.kernel.org>, stable(a)vger.kernel.org
> Sent: Tuesday, 16 July, 2019 11:27:10 AM
> Subject: Re: [PATCH] cifs: fix crash in smb2_compound_op()/smb2_set_next_command()
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v5.2.1, v5.1.18, v4.19.59, v4.14.133,
> v4.9.185, v4.4.185.
>
> v5.2.1: Build OK!
> v5.1.18: Build OK!
> v4.19.59: Failed to apply! Possible dependencies:
> 271b9c0c8007 ("smb3: Fix rmdir compounding regression to strict servers")
> c2e0fe3f5aae ("cifs: make rmdir() use compounding")
> c5a5f38f075c ("cifs: add a smb2_compound_op and change QUERY_INFO to use
> it")
> dcbf91035709 ("cifs: change SMB2_OP_SET_INFO to use compounding")
> e77fe73c7e38 ("cifs: we can not use small padding iovs together with
> encryption")
> f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace")
> f733e3936da4 ("cifs: change mkdir to use a compound")
> f7bfe04bf0db ("cifs: change SMB2_OP_SET_EOF to use compounding")
>
> v4.14.133: Failed to apply! Possible dependencies:
> 2e96467d9eb1 ("cifs: add pdu_size to the TCP_Server_Info structure")
> 3d4ef9a15343 ("smb3: fix redundant opens on root")
> 730928c8f4be ("cifs: update smb2_queryfs() to use compounding")
> 74dcf418fe34 ("CIFS: SMBD: Read correct returned data length for RDMA
> write (SMB read) I/O")
> 8ce79ec359ad ("cifs: update multiplex loop to handle compounded
> responses")
> 91cb74f5142c ("cifs: Change SMB2_open to return an iov for the error
> parameter")
> 93012bf98416 ("cifs: add server->vals->header_preamble_size")
> 9d874c36552a ("cifs: fix a buffer leak in smb2_query_symlink")
> c5a5f38f075c ("cifs: add a smb2_compound_op and change QUERY_INFO to use
> it")
> f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace")
>
> v4.9.185: Failed to apply! Possible dependencies:
> 31473fc4f965 ("CIFS: Separate SMB2 header structure")
> 7fb8986e7449 ("CIFS: Add capability to transform requests before
> sending")
> 8ce79ec359ad ("cifs: update multiplex loop to handle compounded
> responses")
> 9bb17e0916a0 ("CIFS: Add transform header handling callbacks")
> b8f57ee8aad4 ("CIFS: Separate RFC1001 length processing for SMB2 read")
> da502f7df03d ("CIFS: Make SendReceive2() takes resp iov")
> ef65aaede23f ("smb2: Enforce sec= mount option")
> f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace")
>
> v4.4.185: Failed to apply! Possible dependencies:
> 141891f4727c ("SMB3: Add mount parameter to allow user to override max
> credits")
> 166cea4dc3a4 ("SMB2: Separate RawNTLMSSP authentication from
> SMB2_sess_setup")
> 16c568efff82 ("cifs: merge the hash calculation helpers")
> 275516cdcfa4 ("Print IP address of unresponsive server")
> 31473fc4f965 ("CIFS: Separate SMB2 header structure")
> 373512ec5c10 ("Prepare for encryption support (first part). Add
> decryption and encryption key generation. Thanks to Metze for helping
> with this.")
> 3baf1a7b9215 ("SMB2: Separate Kerberos authentication from
> SMB2_sess_setup")
> 7fb8986e7449 ("CIFS: Add capability to transform requests before
> sending")
> 834170c85978 ("Enable previous version support")
> 8ce79ec359ad ("cifs: update multiplex loop to handle compounded
> responses")
> 9bb17e0916a0 ("CIFS: Add transform header handling callbacks")
> adfeb3e00e8e ("cifs: Make echo interval tunable")
> da502f7df03d ("CIFS: Make SendReceive2() takes resp iov")
> ef65aaede23f ("smb2: Enforce sec= mount option")
> f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace")
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
So it applies cleanly in v5.2.1 and v5.1.18.
I think it is sufficient to get into those two versions then. It is very hard to trigger this issue.
> --
> Thanks,
> Sasha
>
When scsi_init_sense_cache(host) is called concurrently from different
hosts, each code path may see that the cache isn't created, then try
to create a new one, then the created sense cache may be overrided and
leaked.
Fixes the issue by moving 'mutex_lock(&scsi_sense_cache_mutex)' before
scsi_select_sense_cache().
Fixes: 0a6ac4ee7c21 ("scsi: respect unchecked_isa_dma for blk-mq")
Cc: Stable <stable(a)vger.kernel.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Hannes Reinecke <hare(a)suse.com>
Cc: Ewan D. Milne <emilne(a)redhat.com>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
drivers/scsi/scsi_lib.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index e07a376a8c38..7493680ec104 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -72,11 +72,11 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
struct kmem_cache *cache;
int ret = 0;
+ mutex_lock(&scsi_sense_cache_mutex);
cache = scsi_select_sense_cache(shost->unchecked_isa_dma);
if (cache)
- return 0;
+ goto exit;
- mutex_lock(&scsi_sense_cache_mutex);
if (shost->unchecked_isa_dma) {
scsi_sense_isadma_cache =
kmem_cache_create("scsi_sense_cache(DMA)",
@@ -92,7 +92,7 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
if (!scsi_sense_cache)
ret = -ENOMEM;
}
-
+ exit:
mutex_unlock(&scsi_sense_cache_mutex);
return ret;
}
--
2.20.1
When migrating an anonymous private page to a ZONE_DEVICE private page,
the source page->mapping and page->index fields are copied to the
destination ZONE_DEVICE struct page and the page_mapcount() is increased.
This is so rmap_walk() can be used to unmap and migrate the page back to
system memory. However, try_to_unmap_one() computes the subpage pointer
from a swap pte which computes an invalid page pointer and a kernel panic
results such as:
BUG: unable to handle page fault for address: ffffea1fffffffc8
Currently, only single pages can be migrated to device private memory so
no subpage computation is needed and it can be set to "page".
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/rmap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/rmap.c b/mm/rmap.c
index e5dfe2ae6b0d..ec1af8b60423 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1476,6 +1476,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
* No need to invalidate here it will synchronize on
* against the special swap migration pte.
*/
+ subpage = page;
goto discard;
}
--
2.20.1
When a ZONE_DEVICE private page is freed, the page->mapping field can be
set. If this page is reused as an anonymous page, the previous value can
prevent the page from being inserted into the CPU's anon rmap table.
For example, when migrating a pte_none() page to device memory:
migrate_vma(ops, vma, start, end, src, dst, private)
migrate_vma_collect()
src[] = MIGRATE_PFN_MIGRATE
migrate_vma_prepare()
/* no page to lock or isolate so OK */
migrate_vma_unmap()
/* no page to unmap so OK */
ops->alloc_and_copy()
/* driver allocates ZONE_DEVICE page for dst[] */
migrate_vma_pages()
migrate_vma_insert_page()
page_add_new_anon_rmap()
__page_set_anon_rmap()
/* This check sees the page's stale mapping field */
if (PageAnon(page))
return
/* page->mapping is not updated */
The result is that the migration appears to succeed but a subsequent CPU
fault will be unable to migrate the page back to system memory or worse.
Clear the page->mapping field when freeing the ZONE_DEVICE page so stale
pointer data doesn't affect future page use.
Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ralph Campbell <rcampbell(a)nvidia.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Jason Gunthorpe <jgg(a)mellanox.com>
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Jan Kara <jack(a)suse.cz>
Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: "Jérôme Glisse" <jglisse(a)redhat.com>
---
kernel/memremap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/memremap.c b/kernel/memremap.c
index bea6f887adad..238ae5d0ae8a 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -408,6 +408,10 @@ void __put_devmap_managed_page(struct page *page)
mem_cgroup_uncharge(page);
+ /* Clear anonymous page mapping to prevent stale pointers */
+ if (is_device_private_page(page))
+ page->mapping = NULL;
+
page->pgmap->ops->page_free(page);
} else if (!count)
__put_page(page);
--
2.20.1
From: Fei Yang <fei.yang(a)intel.com>
If scatter-gather operation is allowed, a large USB request is split into
multiple TRBs. These TRBs are chained up by setting DWC3_TRB_CTRL_CHN bit
except the last one which has DWC3_TRB_CTRL_IOC bit set instead.
Since only the last TRB has IOC set for the whole USB request, the
dwc3_gadget_ep_reclaim_completed_trb() gets called only once for the request
and all TRBs are supposed to be reclaimed. However that is not what happens
with the current code.
This patch addresses the issue by checking req->num_pending_sgs. In case the
pending sgs is not zero, update trb_dequeue and req->num_trbs accordingly.
Signed-off-by: Fei Yang <fei.yang(a)intel.com>
Cc: stable <stable(a)vger.kernel.org>
---
drivers/usb/dwc3/gadget.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 173f532..4d5b4eb 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2394,8 +2394,14 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
if (event->status & DEPEVT_STATUS_SHORT && !chain)
return 1;
- if (event->status & DEPEVT_STATUS_IOC)
+ if (event->status & DEPEVT_STATUS_IOC) {
+ for (count = 0; count < req->num_pending_sgs; count++) {
+ dwc3_ep_inc_deq(dep);
+ req->num_trbs--;
+ }
+ req->num_pending_sgs = 0;
return 1;
+ }
return 0;
}
@@ -2404,7 +2410,7 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
struct dwc3_request *req, const struct dwc3_event_depevt *event,
int status)
{
- struct dwc3_trb *trb = &dep->trb_pool[dep->trb_dequeue];
+ struct dwc3_trb *trb;
struct scatterlist *sg = req->sg;
struct scatterlist *s;
unsigned int pending = req->num_pending_sgs;
--
2.7.4
From: Jan Harkes <jaharkes(a)cs.cmu.edu>
Subject: coda: pass the host file in vma->vm_file on mmap
Patch series "Coda updates".
The following patch series is a collection of various fixes for Coda, most
of which were collected from linux-fsdevel or linux-kernel but which have
as yet not found their way upstream.
This patch (of 22):
Various file systems expect that vma->vm_file points at their own file
handle, several use file_inode(vma->vm_file) to get at their inode or use
vma->vm_file->private_data. However the way Coda wrapped mmap on a host
file broke this assumption, vm_file was still pointing at the Coda file
and the host file systems would scribble over Coda's inode and private
file data.
This patch fixes the incorrect expectation and wraps vm_ops->open and
vm_ops->close to allow Coda to track when the vm_area_struct is destroyed
so we still release the reference on the Coda file handle at the right
time.
Link: http://lkml.kernel.org/r/0e850c6e59c0b147dc2dcd51a3af004c948c3697.155811738…
Signed-off-by: Jan Harkes <jaharkes(a)cs.cmu.edu>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Colin Ian King <colin.king(a)canonical.com>
Cc: Dan Carpenter <dan.carpenter(a)oracle.com>
Cc: David Howells <dhowells(a)redhat.com>
Cc: Fabian Frederick <fabf(a)skynet.be>
Cc: Mikko Rapeli <mikko.rapeli(a)iki.fi>
Cc: Sam Protsenko <semen.protsenko(a)linaro.org>
Cc: Yann Droneaud <ydroneaud(a)opteya.com>
Cc: Zhouyang Jia <jiazhouyang09(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/coda/file.c | 70 +++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 68 insertions(+), 2 deletions(-)
--- a/fs/coda/file.c~coda-pass-the-host-file-in-vma-vm_file-on-mmap
+++ a/fs/coda/file.c
@@ -27,6 +27,13 @@
#include "coda_linux.h"
#include "coda_int.h"
+struct coda_vm_ops {
+ atomic_t refcnt;
+ struct file *coda_file;
+ const struct vm_operations_struct *host_vm_ops;
+ struct vm_operations_struct vm_ops;
+};
+
static ssize_t
coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
@@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb,
return ret;
}
+static void
+coda_vm_open(struct vm_area_struct *vma)
+{
+ struct coda_vm_ops *cvm_ops =
+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+ atomic_inc(&cvm_ops->refcnt);
+
+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open)
+ cvm_ops->host_vm_ops->open(vma);
+}
+
+static void
+coda_vm_close(struct vm_area_struct *vma)
+{
+ struct coda_vm_ops *cvm_ops =
+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close)
+ cvm_ops->host_vm_ops->close(vma);
+
+ if (atomic_dec_and_test(&cvm_ops->refcnt)) {
+ vma->vm_ops = cvm_ops->host_vm_ops;
+ fput(cvm_ops->coda_file);
+ kfree(cvm_ops);
+ }
+}
+
static int
coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
{
@@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, s
struct coda_inode_info *cii;
struct file *host_file;
struct inode *coda_inode, *host_inode;
+ struct coda_vm_ops *cvm_ops;
+ int ret;
cfi = CODA_FTOC(coda_file);
BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC);
@@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, s
if (!host_file->f_op->mmap)
return -ENODEV;
+ if (WARN_ON(coda_file != vma->vm_file))
+ return -EIO;
+
+ cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL);
+ if (!cvm_ops)
+ return -ENOMEM;
+
coda_inode = file_inode(coda_file);
host_inode = file_inode(host_file);
@@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, s
* the container file on us! */
else if (coda_inode->i_mapping != host_inode->i_mapping) {
spin_unlock(&cii->c_lock);
+ kfree(cvm_ops);
return -EBUSY;
}
@@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, s
cfi->cfi_mapcount++;
spin_unlock(&cii->c_lock);
- return call_mmap(host_file, vma);
+ vma->vm_file = get_file(host_file);
+ ret = call_mmap(vma->vm_file, vma);
+
+ if (ret) {
+ /* if call_mmap fails, our caller will put coda_file so we
+ * should drop the reference to the host_file that we got.
+ */
+ fput(host_file);
+ kfree(cvm_ops);
+ } else {
+ /* here we add redirects for the open/close vm_operations */
+ cvm_ops->host_vm_ops = vma->vm_ops;
+ if (vma->vm_ops)
+ cvm_ops->vm_ops = *vma->vm_ops;
+
+ cvm_ops->vm_ops.open = coda_vm_open;
+ cvm_ops->vm_ops.close = coda_vm_close;
+ cvm_ops->coda_file = coda_file;
+ atomic_set(&cvm_ops->refcnt, 1);
+
+ vma->vm_ops = &cvm_ops->vm_ops;
+ }
+ return ret;
}
int coda_open(struct inode *coda_inode, struct file *coda_file)
@@ -207,4 +274,3 @@ const struct file_operations coda_file_o
.fsync = coda_fsync,
.splice_read = generic_file_splice_read,
};
-
_
From: Radoslaw Burny <rburny(a)google.com>
Subject: fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
Normally, the inode's i_uid/i_gid are translated relative to s_user_ns,
but this is not a correct behavior for proc. Since sysctl permission
check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense
to use these values in u_[ug]id of proc inodes. In other words: although
uid/gid in the inode is not read during test_perm, the inode logically
belongs to the root of the namespace. I have confirmed this with Eric
Biederman at LPC and in this thread:
https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com
Consequences
============
Since the i_[ug]id values of proc nodes are not used for permissions
checks, this change usually makes no functional difference. However, it
causes an issue in a setup where:
* a namespace container is created without root user in container -
hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID
* container creator tries to configure it by writing /proc/sys files,
e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit
Kernel does not allow to open an inode for writing if its i_[ug]id are
invalid, making it impossible to write shmmax and thus - configure the
container.
Using a container with no root mapping is apparently rare, but we do use
this configuration at Google. Also, we use a generic tool to configure
the container limits, and the inability to write any of them causes a
failure.
History
=======
The invalid uids/gids in inodes first appeared due to 81754357770e (fs:
Update i_[ug]id_(read|write) to translate relative to s_user_ns).
However, AFAIK, this did not immediately cause any issues. The inability
to write to these "invalid" inodes was only caused by a later commit
0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown to the
vfs).
Tested: Used a repro program that creates a user namespace without any
mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside.
Before the change, it shows the overflow uid, with the change it's 0. The
overflow uid indicates that the uid in the inode is not correct and thus
it is not possible to open the file for writing.
Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com
Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs")
Signed-off-by: Radoslaw Burny <rburny(a)google.com>
Acked-by: Luis Chamberlain <mcgrof(a)kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Seth Forshee <seth.forshee(a)canonical.com>
Cc: John Sperbeck <jsperbeck(a)google.com>
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: <stable(a)vger.kernel.org> [4.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/proc_sysctl.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/proc/proc_sysctl.c~fs-fix-the-default-values-of-i_uid-i_gid-on-proc-sys-inodes
+++ a/fs/proc/proc_sysctl.c
@@ -499,6 +499,10 @@ static struct inode *proc_sys_make_inode
if (root->set_ownership)
root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+ else {
+ inode->i_uid = GLOBAL_ROOT_UID;
+ inode->i_gid = GLOBAL_ROOT_GID;
+ }
return inode;
}
_
The late 2016 model of the Razer Blade Stealth has a built-in USB
keyboard, but for some reason the BIOS exposes an i8042 controller with
a connected KBD port. While this fake AT Keyboard device doesn't appear
to report any events, attempting to change the state of the caps lock
LED on it from on to off causes the entire system to hang.
So, introduce a quirk table for disabling keyboard probing by default,
i8042_dmi_nokbd_table, and add this specific model of Razer laptop to
that table.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Cc: stable(a)vger.kernel.org
---
drivers/input/serio/i8042-x86ia64io.h | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 136f6e7bf797..888f5f6feebf 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -884,6 +884,22 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
{ }
};
+static const struct dmi_system_id i8042_dmi_nokbd_table[] __initconst = {
+ {
+ /*
+ * Razer Blade Stealth (Late 2016 model) - Keyboard is on USB
+ * but the system exposes a fake AT keyboard that crashes the
+ * system if the caps lock LED is changed
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Blade Stealth"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "2.04"),
+ },
+ },
+ { }
+};
+
#endif /* CONFIG_X86 */
#ifdef CONFIG_PNP
@@ -1040,6 +1056,9 @@ static int __init i8042_pnp_init(void)
#ifdef CONFIG_X86
if (dmi_check_system(i8042_dmi_nopnp_table))
i8042_nopnp = true;
+
+ if (dmi_check_system(i8042_dmi_nokbd_table))
+ i8042_nokbd = true;
#endif
if (i8042_nopnp) {
--
2.20.1
misc/eeprom/{at24,at25,eeprom_93xx46} drivers all register their
corresponding devices in the nvmem framework in compat mode which requires
nvmem sysfs interface to be present. The latter, however, has been split
out from nvmem under a separate Kconfig in commit ae0c2d725512 ("nvmem:
core: add NVMEM_SYSFS Kconfig"). As a result, probing certain I2C-attached
EEPROMs now fails with
at24: probe of 0-0050 failed with error -38
because of a stub implementation of nvmem_sysfs_setup_compat()
in drivers/nvmem/nvmem.h. Update the nvmem dependency for these drivers
so they could load again:
at24 0-0050: 32768 byte 24c256 EEPROM, writable, 64 bytes/write
Cc: Adrian Bunk <bunk(a)kernel.org>
Cc: Bartosz Golaszewski <brgl(a)bgdev.pl>
Cc: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Cc: stable(a)vger.kernel.org # v5.2+
Signed-off-by: Arseny Solokha <asolokha(a)kb.kras.ru>
---
drivers/misc/eeprom/Kconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
index f88094719552..f2abe27010ef 100644
--- a/drivers/misc/eeprom/Kconfig
+++ b/drivers/misc/eeprom/Kconfig
@@ -5,6 +5,7 @@ config EEPROM_AT24
tristate "I2C EEPROMs / RAMs / ROMs from most vendors"
depends on I2C && SYSFS
select NVMEM
+ select NVMEM_SYSFS
select REGMAP_I2C
help
Enable this driver to get read/write support to most I2C EEPROMs
@@ -34,6 +35,7 @@ config EEPROM_AT25
tristate "SPI EEPROMs from most vendors"
depends on SPI && SYSFS
select NVMEM
+ select NVMEM_SYSFS
help
Enable this driver to get read/write support to most SPI EEPROMs,
after you configure the board init code to know about each eeprom
@@ -80,6 +82,7 @@ config EEPROM_93XX46
depends on SPI && SYSFS
select REGMAP
select NVMEM
+ select NVMEM_SYSFS
help
Driver for the microwire EEPROM chipsets 93xx46x. The driver
supports both read and write commands and also the command to
--
2.22.0