- Linux-stable-mirror - lists.linaro.org

[STABLE candidates] backport candidates from Allwinner kernels

by Arnd Bergmann

These are from https://github.com/BPI-SINOVOIP/BPI-M2P-bsp-4.4 They contain a bunch of things from an older Android kernel that looks like it would still make sense for normal stable kernels as well, very little here is allwinner specific: 0905f04eb21f sched/fair: Fix new task's load avg removed from source CPU in wake_up_new_task() 382c55f88ffe mmc: block: Allow more than 8 partitions per card b9b7aebb42d1 arm64: fix COMPAT_SHMLBA definition for large pages b523e185bba3 efi: stub: define DISABLE_BRANCH_PROFILING for all architectures 6c044fecdf78 ARM: 8458/1: bL_switcher: add GIC dependency ad84f56bf6d6 ARM: 8494/1: mm: Enable PXN when running non-LPAE kernel on LPAE processor 2010b93e9317 net: tcp: deal with listen sockets properly in tcp_abort. 699f68556943 android: unconditionally remove callbacks in sync_fence_free() 0eb77e988032 vmstat: make vmstat_updater deferrable again and shut down on idle 8d43b49e7e00 hid-sensor-hub.c: fix wrong do_div() usage 75feee3d9d51 arm64: hide __efistub_ aliases from kallsyms 728dabd6d175 Eliminate the .eh_frame sections from the aarch64 vmlinux and kernel modules 45c815f06b80 perf: Synchronously free aux pages in case of allocation failure 7c1306723ee9 net: diag: support v4mapped sockets in inet_diag_find_one_icsk() a5ebb87db843 Revert "mmc: block: don't use parameter prefix if built as module" 3d65ae4634ed writeback: initialize inode members that track writeback history 5ef11c35ce86 mm: ASLR: use get_random_long() 0d9c51a6e1df block: partition: add partition specific uevent callbacks for partition info a9ddc71f5840 coresight: fixing lockdep error fae54158792a coresight: coresight_unregister() function cleanup f2dfab3568fc coresight: release reference taken by 'bus_find_device()' ad725aee070c coresight: remove csdev's link from topology b15f0fb657e0 coresight: removing bind/unbind options from sysfs 4a2e2b19f96a stm class: Hide STM-specific options if STM is disabled 4c127fd16e6b stm class: Fix locking in unbinding policy path c74f7e8281ad stm class: Fix link list locking f08b18266c71 stm class: Prevent user-controllable allocations 59be422e4ce1 stm class: Support devices with multiple instances 1810f2c44817 stm class: Fix unlocking braino in the error path cde4ad836884 stm class: Guard output assignment against concurrency f7c81c7176c7 stm class: Fix unbalanced module/device refcounting b4ca34aaf78e stm class: Fix a race in unlinking bf16e5b8cdea coresight: "DEVICE_ATTR_RO" should defined as static. 61390593f723 coresight: etm4x: Check every parameter used by dma_xx_coherent. 3694bd76781b asm-generic: Fix local variable shadow in __set_fixmap_offset 18e77054de74 staging: ashmem: Avoid deadlock with mmap/shrink 90a2f171383b staging: ashmem: Add missing include 1328d8efef17 staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT 4532150762ce staging: goldfish: audio: fix compiliation on arm 1b9bdf5c1661 ARM: 8510/1: rework ARM_CPU_SUSPEND dependencies b660950c60a7 arm64/kernel: fix incorrect EL0 check in inv_entry macro b4201cc4fc6e mac80211: fix "warning: ‘target_metric’ may be used uninitialized" dcb10a967ce8 perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap_count drops 812264550dcb arm64: kernel: Include _AC definition in page.h f6cf0545ec69 PM / Hibernate: Call flush_icache_range() on pages restored in-place cbe4a61d1ddc stm class: Do not leak the chrdev in error path 389b6699a2aa stm class: Fix stm device initialization order bbb1681ee365 arm64: mm: mark fault_info table const 5014e904681d coresight: Handle build path error dcb94b88c09c ipv6: fix endianness error in icmpv6_err cee51c33f52e usb: gadget: configfs: add mutex lock before unregister gadget 207707d8fd48 usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG 7b996243fab4 tun: fix transmit timestamp support 01b411590665 cpu/hotplug: Handle unbalanced hotplug enable/disable 359be67862c5 dma mapping : export caller to vmallocinfo ace6033ec5c3 video: fbdev: Set pixclock = 0 in goldfishfb These are from https://github.com/BPI-SINOVOIP/BPI-M64-bsp-4.4: 91d372117695 s390: add DEBUG_RODATA support 99a507771fa5 arm64: kconfig: drop CONFIG_RTC_LIB dependency 38b850a73034 arm64: spinlock: order spin_{is_locked,unlock_wait} against local locks 987aa5f80596 mmc: mmc: fix switch timeout issue caused by jiffies precision 4ef8c1c93f84 cfg80211: size various nl80211 messages correctly c88215d7050f cfg80211: Fix documentation for connect result 5c2a625937ba arm64: support keyctl() system call in 32-bit mode And finally, one from https://github.com/BPI-SINOVOIP/BPI-Mainline-kernel/tree/master/linux-4.14: a830405ee452 stmmac: copy unicast mac address to MAC registers I can post them as patches as well if that helps. Overall, my script found 380, 80 and 55 patches backported from mainline here, respectively, but most of them are clearly not stable candidates. Arnd

6 years, 5 months

2
3
0 0

✅ PASS: Stable queue: queue-5.0

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 1f6f316a537d - Linux 5.0.5 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out a ref: Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Ref: 1f6f316a537d - Linux 5.0.5 We then merged the patchset with `git am`: bluetooth-check-l2cap-option-sizes-returned-from-l2cap_get_conf_opt.patch bluetooth-verify-that-l2cap_get_conf_opt-provides-large-enough-buffer.patch netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch dccp-do-not-use-ipv6-header-for-ipv4-flow.patch genetlink-fix-a-memory-leak-on-error-path.patch gtp-change-net_udp_tunnel-dependency-to-select.patch ipv6-make-ip6_create_rt_rcu-return-ip6_null_entry-instead-of-null.patch mac8390-fix-mmio-access-size-probe.patch misdn-hfcpci-test-both-vendor-device-id-for-digium-hfc4s.patch net-aquantia-fix-rx-checksum-offload-for-udp-tcp-over-ipv6.patch net-datagram-fix-unbounded-loop-in-__skb_try_recv_datagram.patch net-packet-set-__gfp_nowarn-upon-allocation-in-alloc_pg_vec.patch net-phy-meson-gxl-fix-interrupt-support.patch net-rose-fix-a-possible-stack-overflow.patch net-stmmac-fix-memory-corruption-with-large-mtus.patch net-sysfs-call-dev_hold-if-kobject_init_and_add-success.patch net-usb-aqc111-extend-hwid-table-by-qnap-device.patch packets-always-register-packet-sk-in-the-same-order.patch rhashtable-still-do-rehash-when-we-get-eexist.patch sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch sctp-use-memdup_user-instead-of-vmemdup_user.patch tcp-do-not-use-ipv6-header-for-ipv4-flow.patch tipc-allow-service-ranges-to-be-connect-ed-on-rdm-dgram.patch tipc-change-to-check-tipc_own_id-to-return-in-tipc_net_stop.patch tipc-fix-cancellation-of-topology-subscriptions.patch tun-properly-test-for-iff_up.patch vrf-prevent-adding-upper-devices.patch vxlan-don-t-call-gro_cells_destroy-before-device-is-unregistered.patch thunderx-enable-page-recycling-for-non-xdp-case.patch thunderx-eliminate-extra-calls-to-put_page-for-pages-held-for-recycling.patch net-dsa-mv88e6xxx-fix-few-issues-in-mv88e6390x_port_set_cmode.patch net-mii-fix-pause-cap-advertisement-from-linkmode_adv_to_lcl_adv_t-helper.patch net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch r8169-fix-cable-re-plugging-issue.patch ila-fix-rhashtable-walker-list-corruption.patch tun-add-a-missing-rcu_read_unlock-in-error-path.patch powerpc-fsl-fix-the-flush-of-branch-predictor.patch btrfs-fix-incorrect-file-size-after-shrinking-truncate-and-fsync.patch btrfs-remove-warn_on-in-log_dir_items.patch btrfs-don-t-report-readahead-errors-and-don-t-update-statistics.patch btrfs-raid56-properly-unmap-parity-page-in-finish_parity_scrub.patch btrfs-fix-bound-checking-in-qgroup_trace_new_subtree_blocks.patch btrfs-avoid-possible-qgroup_rsv_size-overflow-in-btrfs_calculate_inode_block_rsv_size.patch btrfs-fix-assertion-failure-on-fsync-with-no_holes-enabled.patch locks-wake-any-locks-blocked-on-request-before-deadlock-check.patch tracing-initialize-variable-in-create_dyn_event.patch arm-imx6q-cpuidle-fix-bug-that-cpu-might-not-wake-up-at-expected-time.patch powerpc-bpf-fix-generation-of-load-store-dw-instructions.patch vfio-ccw-only-free-cp-on-final-interrupt.patch nfs-fix-nfs4_lock_state-refcounting-in-nfs4_alloc_-lock-unlock-data.patch nfs-fix-mount-umount-race-in-nlmclnt.patch nfsv4.1-don-t-free-interrupted-slot-on-open.patch net-dsa-qca8k-remove-leftover-phy-accessors.patch alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch alsa-seq-oss-fix-spectre-v1-vulnerability.patch alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch kbuild-modversions-fix-relative-crc-byte-order-interpretation.patch fs-open.c-allow-opening-only-regular-files-during-execve.patch ocfs2-fix-inode-bh-swapping-mixup-in-ocfs2_reflink_inodes_lock.patch scsi-sd-fix-a-race-between-closing-an-sd-device-and-sd-i-o.patch scsi-sd-quiesce-warning-if-device-does-not-report-optimal-i-o-size.patch scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host.patch scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices.patch drm-rockchip-vop-reset-scale-mode-when-win-is-disabled.patch tty-serial-atmel-add-is_half_duplex-helper.patch tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch staging-speakup_soft-fix-alternate-speech-with-other-synths.patch staging-vt6655-remove-vif-check-from-vnt_interrupt.patch staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch usb-serial-cp210x-add-new-device-id.patch usb-serial-ftdi_sio-add-additional-novatech-products.patch usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch usb-serial-option-add-support-for-quectel-em12.patch usb-serial-option-add-olicard-600.patch acpi-cppc-fix-guaranteed-performance-handling.patch disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch cpufreq-scpi-fix-use-after-free.patch drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch drm-i915-mark-aml-0x87ca-as-ulx.patch drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch usb-mtu3-fix-extcon-dependency.patch usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch usb-common-consider-only-available-nodes-for-dr_mode.patch mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch usb-typec-fix-unchecked-return-value.patch mm-hotplug-fix-offline-undo_isolate_page_range.patch mm-add-support-for-kmem-caches-in-dma32-zone.patch iommu-io-pgtable-arm-v7s-request-dma32-memory-and-improve-debugging.patch mm-mempolicy-make-mbind-return-eio-when-mpol_mf_strict-is-specified.patch mm-debug.c-fix-__dump_page-when-mapping-host-is-not-set.patch mm-memory_hotplug.c-fix-notification-in-offline-error-path.patch mm-page_isolation.c-fix-a-wrong-flag-in-set_migratetype_isolate.patch mm-migrate.c-add-missing-flush_dcache_page-for-non-mapped-page-migrate.patch Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: https://artifacts.cki-project.org/builds/aarch64/b8c0f4f23672fab154ae67dfaf… kernel build: https://artifacts.cki-project.org/builds/aarch64/b8c0f4f23672fab154ae67dfaf… ppc64le: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: https://artifacts.cki-project.org/builds/ppc64le/8e540c84fd1e9990c1d75803e5… kernel build: https://artifacts.cki-project.org/builds/ppc64le/8e540c84fd1e9990c1d75803e5… x86_64: make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64 configuration: https://artifacts.cki-project.org/builds/x86_64/9d5c216f180c7a62d706e87cda3… kernel build: https://artifacts.cki-project.org/builds/x86_64/9d5c216f180c7a62d706e87cda3… Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: ✅ Boot test [0] ✅ LTP lite - release 20190115 [1] ✅ Loopdev Sanity [2] ✅ xfstests: xfs [3] ✅ AMTU (Abstract Machine Test Utility) [4] 🚧 ✅ Networking route: pmtu [5] 🚧 ❎ audit: audit testsuite test [6] ✅ httpd: mod_ssl smoke sanity [7] ✅ httpd: php sanity [8] 🚧 ✅ iotop: sanity [9] 🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport 🚧 ✅ tuned: tune-processes-through-perf [10] ✅ Usex - version 1.9-29 [11] ✅ lvm thinp sanity [12] ppc64le: ✅ Boot test [0] ✅ LTP lite - release 20190115 [1] ✅ Loopdev Sanity [2] ✅ xfstests: xfs [3] ✅ AMTU (Abstract Machine Test Utility) [4] 🚧 ✅ Networking route: pmtu [5] 🚧 ❎ audit: audit testsuite test [6] ✅ httpd: mod_ssl smoke sanity [7] ✅ httpd: php sanity [8] 🚧 ✅ iotop: sanity [9] 🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport 🚧 ✅ selinux-policy: serge-testsuite [13] 🚧 ✅ tuned: tune-processes-through-perf [10] ✅ Usex - version 1.9-29 [11] ✅ lvm thinp sanity [12] x86_64: ✅ Boot test [0] ✅ LTP lite - release 20190115 [1] ✅ Loopdev Sanity [2] ✅ xfstests: xfs [3] ✅ AMTU (Abstract Machine Test Utility) [4] 🚧 ✅ Networking route: pmtu [5] 🚧 ❎ audit: audit testsuite test [6] ✅ httpd: mod_ssl smoke sanity [7] ✅ httpd: php sanity [8] 🚧 ✅ iotop: sanity [9] 🚧 ✅ /CoreOS/net-snmp/Regression/bz251332-tcp-transport 🚧 ✅ selinux-policy: serge-testsuite [13] 🚧 ✅ tuned: tune-processes-through-perf [10] ✅ Usex - version 1.9-29 [11] ✅ lvm thinp sanity [12] Test source: [0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/… [3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems… [4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu [5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/… [6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud… [7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt… [8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt… [9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot… [10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun… [11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us… [12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/lvm/… [13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se… Waived tests (marked with 🚧) ----------------------------- This test run included waived tests. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed.

6 years, 5 months

1
0
0 0

[PATCH v4.19.x] usb: typec: class: Don't use port parent for getting mux handles

by Heikki Krogerus

commit 23481121c81d984193edf1532f5e123637e50903 upstream. It is not possible to use the parent of the port device when requesting mux handles as the parent may be a multiport USB Type-C or PD controller. The muxes must be assigned to the ports, not the controllers. This will also move the requesting of the muxes after the port device is initialized. [ heikki: This patch fixes an issue where port->id was used uninitialized. ] Cc: <stable(a)vger.kernel.org> # 4.19.x: cd7753d: drivers: base: Helpers for adding device connection descriptions Cc: <stable(a)vger.kernel.org> # 4.19.x: 140a4ec: platform: x86: intel_cht_int33fe: Register all connections at once Cc: <stable(a)vger.kernel.org> # 4.19.x: 78d2b54: platform: x86: intel_cht_int33fe: Add connection for the DP alt mode Cc: <stable(a)vger.kernel.org> # 4.19.x: 495965a: platform: x86: intel_cht_int33fe: Add connections for the USB Type-C port Cc: <stable(a)vger.kernel.org> # 4.19.x Cc: <stable(a)vger.kernel.org> # 4.19.x: 148b0aa: platform: x86: intel_cht_int33fe: Remove the old connections for the muxes Fixes: bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers") Acked-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> --- Hi, This is a request to backport commit 23481121c81d984193edf1532f5e123637e50903 It was not marked as a fix, but it does fix an issue where a variable "port->id" was used in function typec_register_port() without initializing it. The patch has additional prerequisites which are listed in the sign-off area. Please note that there is also one patch listed there after this one. thanks, heikki --- drivers/usb/typec/class.c | 38 +++++++++++++++----------------------- 1 file changed, 15 insertions(+), 23 deletions(-) diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index e61dffb27a0c..00141e05bc72 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -1500,7 +1500,7 @@ typec_port_register_altmode(struct typec_port *port, sprintf(id, "id%04xm%02x", desc->svid, desc->mode); - mux = typec_mux_get(port->dev.parent, id); + mux = typec_mux_get(&port->dev, id); if (IS_ERR(mux)) return ERR_CAST(mux); @@ -1540,18 +1540,6 @@ struct typec_port *typec_register_port(struct device *parent, return ERR_PTR(id); } - port->sw = typec_switch_get(cap->fwnode ? &port->dev : parent); - if (IS_ERR(port->sw)) { - ret = PTR_ERR(port->sw); - goto err_switch; - } - - port->mux = typec_mux_get(parent, "typec-mux"); - if (IS_ERR(port->mux)) { - ret = PTR_ERR(port->mux); - goto err_mux; - } - switch (cap->type) { case TYPEC_PORT_SRC: port->pwr_role = TYPEC_SOURCE; @@ -1592,13 +1580,26 @@ struct typec_port *typec_register_port(struct device *parent, port->port_type = cap->type; port->prefer_role = cap->prefer_role; + device_initialize(&port->dev); port->dev.class = typec_class; port->dev.parent = parent; port->dev.fwnode = cap->fwnode; port->dev.type = &typec_port_dev_type; dev_set_name(&port->dev, "port%d", id); - ret = device_register(&port->dev); + port->sw = typec_switch_get(&port->dev); + if (IS_ERR(port->sw)) { + put_device(&port->dev); + return ERR_CAST(port->sw); + } + + port->mux = typec_mux_get(&port->dev, "typec-mux"); + if (IS_ERR(port->mux)) { + put_device(&port->dev); + return ERR_CAST(port->mux); + } + + ret = device_add(&port->dev); if (ret) { dev_err(parent, "failed to register port (%d)\n", ret); put_device(&port->dev); @@ -1606,15 +1607,6 @@ struct typec_port *typec_register_port(struct device *parent, } return port; - -err_mux: - typec_switch_put(port->sw); - -err_switch: - ida_simple_remove(&typec_index_ida, port->id); - kfree(port); - - return ERR_PTR(ret); } EXPORT_SYMBOL_GPL(typec_register_port); -- 2.20.1

6 years, 5 months

2
1
0 0

[PATCH 4.14-stable backport] vfio: ccw: only free cp on final interrupt

by Cornelia Huck

When we get an interrupt for a channel program, it is not necessarily the final interrupt; for example, the issuing guest may request an intermediate interrupt by specifying the program-controlled-interrupt flag on a ccw. We must not switch the state to idle if the interrupt is not yet final; even more importantly, we must not free the translated channel program if the interrupt is not yet final, or the host can crash during cp rewind. Fixes: e5f84dbaea59 ("vfio: ccw: return I/O results asynchronously") Cc: stable(a)vger.kernel.org # v4.12+ Reviewed-by: Eric Farman <farman(a)linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck(a)redhat.com> (cherry picked from commit 50b7f1b7236bab08ebbbecf90521e84b068d7a17) --- drivers/s390/cio/vfio_ccw_drv.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c index ae7a49ade414..d22759eb6640 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -70,20 +70,24 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) { struct vfio_ccw_private *private; struct irb *irb; + bool is_final; private = container_of(work, struct vfio_ccw_private, io_work); irb = &private->irb; + is_final = !(scsw_actl(&irb->scsw) & + (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); - cp_free(&private->cp); + if (is_final) + cp_free(&private->cp); } memcpy(private->io_region.irb_area, irb, sizeof(*irb)); if (private->io_trigger) eventfd_signal(private->io_trigger, 1); - if (private->mdev) + if (private->mdev && is_final) private->state = VFIO_CCW_STATE_IDLE; } -- 2.17.2

6 years, 5 months

2
1
0 0

[PATCH v2 1/2] dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid

by Dirk Behme

Having a cyclic DMA, a residue 0 is not an indication of a completed DMA. In case of cyclic DMA make sure that dma_set_residue() is called and with this a residue of 0 is forwarded correctly to the caller. Fixes: 3544d2878817 ("dmaengine: rcar-dmac: use result of updated get_residue in tx_status") Signed-off-by: Dirk Behme <dirk.behme(a)de.bosch.com> Signed-off-by: Achim Dahlhoff <Achim.Dahlhoff(a)de.bosch.com> Signed-off-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx(a)renesas.com> Cc: <stable(a)vger.kernel.org> # v4.8+ --- Note: Patch done against mainline v5.0 Changes in v2: None drivers/dma/sh/rcar-dmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c index 2b4f25698169..2ea59229d7f5 100644 --- a/drivers/dma/sh/rcar-dmac.c +++ b/drivers/dma/sh/rcar-dmac.c @@ -1378,7 +1378,7 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan, spin_unlock_irqrestore(&rchan->lock, flags); /* if there's no residue, the cookie is complete */ - if (!residue) + if (!residue && !rchan->desc.running->cyclic) return DMA_COMPLETE; dma_set_residue(txstate, residue); -- 2.20.0

6 years, 5 months

1
2
0 0

[PATCH for-4.19 1/2] staging: erofs: fix error handling when failed to read compresssed data

by Gao Xiang

commit b6391ac73400eff38377a4a7364bd3df5efb5178 upstream. Complete read error handling paths for all three kinds of compressed pages: 1) For cache-managed pages, PG_uptodate will be checked since read_endio will unlock and SetPageUptodate for these pages; 2) For inplaced pages, read_endio cannot SetPageUptodate directly since it should be used to mark the final decompressed data, PG_error will be set with page locked for IO error instead; 3) For staging pages, PG_error is used, which is similar to what we do for inplaced pages. Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Cc: <stable(a)vger.kernel.org> # 4.19+ Reviewed-by: Chao Yu <yuchao0(a)huawei.com> Signed-off-by: Gao Xiang <gaoxiang25(a)huawei.com> --- This series resolves the following conflicts: FAILED: patch "[PATCH] staging: erofs: fix error handling when failed to read" failed to apply to 4.19-stable tree FAILED: patch "[PATCH] staging: erofs: keep corrupted fs from crashing kernel in" failed to apply to 4.19-stable tree Thanks, Gao Xiang drivers/staging/erofs/unzip_vle.c | 42 +++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c index f44662dd795c..bb9a69158ba4 100644 --- a/drivers/staging/erofs/unzip_vle.c +++ b/drivers/staging/erofs/unzip_vle.c @@ -885,6 +885,7 @@ static int z_erofs_vle_unzip(struct super_block *sb, overlapped = false; compressed_pages = grp->compressed_pages; + err = 0; for (i = 0; i < clusterpages; ++i) { unsigned pagenr; @@ -894,26 +895,39 @@ static int z_erofs_vle_unzip(struct super_block *sb, DBG_BUGON(page == NULL); DBG_BUGON(page->mapping == NULL); - if (z_erofs_is_stagingpage(page)) - continue; + if (!z_erofs_is_stagingpage(page)) { #ifdef EROFS_FS_HAS_MANAGED_CACHE - if (page->mapping == mngda) { - DBG_BUGON(!PageUptodate(page)); - continue; - } + if (page->mapping == mngda) { + if (unlikely(!PageUptodate(page))) + err = -EIO; + continue; + } #endif - /* only non-head page could be reused as a compressed page */ - pagenr = z_erofs_onlinepage_index(page); + /* + * only if non-head page can be selected + * for inplace decompression + */ + pagenr = z_erofs_onlinepage_index(page); - DBG_BUGON(pagenr >= nr_pages); - DBG_BUGON(pages[pagenr]); - ++sparsemem_pages; - pages[pagenr] = page; + DBG_BUGON(pagenr >= nr_pages); + DBG_BUGON(pages[pagenr]); + ++sparsemem_pages; + pages[pagenr] = page; - overlapped = true; + overlapped = true; + } + + /* PG_error needs checking for inplaced and staging pages */ + if (unlikely(PageError(page))) { + DBG_BUGON(PageUptodate(page)); + err = -EIO; + } } + if (unlikely(err)) + goto out; + llen = (nr_pages << PAGE_SHIFT) - work->pageofs; if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) { @@ -1078,6 +1092,8 @@ static inline bool recover_managed_page(struct z_erofs_vle_workgroup *grp, return true; lock_page(page); + ClearPageError(page); + if (unlikely(!PagePrivate(page))) { set_page_private(page, (unsigned long)grp); SetPagePrivate(page); -- 2.17.1

6 years, 5 months

2
3
0 0

[PATCH 4.20, 5.0] mt76x02u: use usb_bulk_msg to upload firmware

by Stanislaw Gruszka

commit 5de4db8fcb6d6fc7d9064c22841211790c0ab81b upstream. We don't need to send firmware data asynchronously, much simpler is just use synchronous usb_bulk_msg(). [ stable note: this patch was originally developed as cleanup, but it remove incorrect usage of page_frag_alloc(): alloc more than PAGE_SIZE and create not ARCH_DMA_MINALIGN dma buffers needed at least for performance reason. Was tested on 5.0 and 4.20, see https://bugzilla.kernel.org/show_bug.cgi?id=202673 and https://bugzilla.kernel.org/show_bug.cgi?id=202241 ] Tested-by: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Signed-off-by: Stanislaw Gruszka <sgruszka(a)redhat.com> --- drivers/net/wireless/mediatek/mt76/mt76.h | 13 ++++++ .../net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 52 +++++++--------------- drivers/net/wireless/mediatek/mt76/usb.c | 1 - 3 files changed, 29 insertions(+), 37 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h index 5cd508a68609..6d29ba4046c3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76.h +++ b/drivers/net/wireless/mediatek/mt76/mt76.h @@ -713,6 +713,19 @@ static inline bool mt76u_check_sg(struct mt76_dev *dev) udev->speed == USB_SPEED_WIRELESS)); } +static inline int +mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int timeout) +{ + struct usb_interface *intf = to_usb_interface(dev->dev); + struct usb_device *udev = interface_to_usbdev(intf); + struct mt76_usb *usb = &dev->usb; + unsigned int pipe; + int sent; + + pipe = usb_sndbulkpipe(udev, usb->out_ep[MT_EP_OUT_INBAND_CMD]); + return usb_bulk_msg(udev, pipe, data, len, &sent, timeout); +} + int mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type, u16 val, u16 offset, void *buf, size_t len); diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c index 6db789f90269..2ca393e267af 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c @@ -121,18 +121,14 @@ static int __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd, bool wait_resp) { - struct usb_interface *intf = to_usb_interface(dev->dev); - struct usb_device *udev = interface_to_usbdev(intf); struct mt76_usb *usb = &dev->usb; - unsigned int pipe; - int ret, sent; + int ret; u8 seq = 0; u32 info; if (test_bit(MT76_REMOVED, &dev->state)) return 0; - pipe = usb_sndbulkpipe(udev, usb->out_ep[MT_EP_OUT_INBAND_CMD]); if (wait_resp) { seq = ++usb->mcu.msg_seq & 0xf; if (!seq) @@ -146,7 +142,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb, if (ret) return ret; - ret = usb_bulk_msg(udev, pipe, skb->data, skb->len, &sent, 500); + ret = mt76u_bulk_msg(dev, skb->data, skb->len, 500); if (ret) return ret; @@ -268,14 +264,12 @@ void mt76x02u_mcu_fw_reset(struct mt76x02_dev *dev) EXPORT_SYMBOL_GPL(mt76x02u_mcu_fw_reset); static int -__mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, struct mt76u_buf *buf, +__mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, u8 *data, const void *fw_data, int len, u32 dst_addr) { - u8 *data = sg_virt(&buf->urb->sg[0]); - DECLARE_COMPLETION_ONSTACK(cmpl); __le32 info; u32 val; - int err; + int err, data_len; info = cpu_to_le32(FIELD_PREP(MT_MCU_MSG_PORT, CPU_TX_PORT) | FIELD_PREP(MT_MCU_MSG_LEN, len) | @@ -291,25 +285,12 @@ __mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, struct mt76u_buf *buf, mt76u_single_wr(&dev->mt76, MT_VEND_WRITE_FCE, MT_FCE_DMA_LEN, len << 16); - buf->len = MT_CMD_HDR_LEN + len + sizeof(info); - err = mt76u_submit_buf(&dev->mt76, USB_DIR_OUT, - MT_EP_OUT_INBAND_CMD, - buf, GFP_KERNEL, - mt76u_mcu_complete_urb, &cmpl); - if (err < 0) - return err; - - if (!wait_for_completion_timeout(&cmpl, - msecs_to_jiffies(1000))) { - dev_err(dev->mt76.dev, "firmware upload timed out\n"); - usb_kill_urb(buf->urb); - return -ETIMEDOUT; - } + data_len = MT_CMD_HDR_LEN + len + sizeof(info); - if (mt76u_urb_error(buf->urb)) { - dev_err(dev->mt76.dev, "firmware upload failed: %d\n", - buf->urb->status); - return buf->urb->status; + err = mt76u_bulk_msg(&dev->mt76, data, data_len, 1000); + if (err) { + dev_err(dev->mt76.dev, "firmware upload failed: %d\n", err); + return err; } val = mt76_rr(dev, MT_TX_CPU_FROM_FCE_CPU_DESC_IDX); @@ -322,17 +303,16 @@ __mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, struct mt76u_buf *buf, int mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, const void *data, int data_len, u32 max_payload, u32 offset) { - int err, len, pos = 0, max_len = max_payload - 8; - struct mt76u_buf buf; + int len, err = 0, pos = 0, max_len = max_payload - 8; + u8 *buf; - err = mt76u_buf_alloc(&dev->mt76, &buf, 1, max_payload, max_payload, - GFP_KERNEL); - if (err < 0) - return err; + buf = kmalloc(max_payload, GFP_KERNEL); + if (!buf) + return -ENOMEM; while (data_len > 0) { len = min_t(int, data_len, max_len); - err = __mt76x02u_mcu_fw_send_data(dev, &buf, data + pos, + err = __mt76x02u_mcu_fw_send_data(dev, buf, data + pos, len, offset + pos); if (err < 0) break; @@ -341,7 +321,7 @@ int mt76x02u_mcu_fw_send_data(struct mt76x02_dev *dev, const void *data, pos += len; usleep_range(5000, 10000); } - mt76u_buf_free(&buf); + kfree(buf); return err; } diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c index b061263453d4..09923cedd039 100644 --- a/drivers/net/wireless/mediatek/mt76/usb.c +++ b/drivers/net/wireless/mediatek/mt76/usb.c @@ -326,7 +326,6 @@ int mt76u_buf_alloc(struct mt76_dev *dev, struct mt76u_buf *buf, return mt76u_fill_rx_sg(dev, buf, nsgs, len, sglen); } -EXPORT_SYMBOL_GPL(mt76u_buf_alloc); void mt76u_buf_free(struct mt76u_buf *buf) { -- 2.7.5

6 years, 5 months

2
1
0 0

[PATCH stable 4.19, 4.20, 5.0] bpf: do not restore dst_reg when cur_state is freed

by Daniel Borkmann

From: Xu Yu <xuyu(a)linux.alibaba.com> [ upstream commit 0803278b0b4d8eeb2b461fb698785df65a725d9e ] Syzkaller hit 'KASAN: use-after-free Write in sanitize_ptr_alu' bug. Call trace: dump_stack+0xbf/0x12e print_address_description+0x6a/0x280 kasan_report+0x237/0x360 sanitize_ptr_alu+0x85a/0x8d0 adjust_ptr_min_max_vals+0x8f2/0x1ca0 adjust_reg_min_max_vals+0x8ed/0x22e0 do_check+0x1ca6/0x5d00 bpf_check+0x9ca/0x2570 bpf_prog_load+0xc91/0x1030 __se_sys_bpf+0x61e/0x1f00 do_syscall_64+0xc8/0x550 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fault injection trace: kfree+0xea/0x290 free_func_state+0x4a/0x60 free_verifier_state+0x61/0xe0 push_stack+0x216/0x2f0 <- inject failslab sanitize_ptr_alu+0x2b1/0x8d0 adjust_ptr_min_max_vals+0x8f2/0x1ca0 adjust_reg_min_max_vals+0x8ed/0x22e0 do_check+0x1ca6/0x5d00 bpf_check+0x9ca/0x2570 bpf_prog_load+0xc91/0x1030 __se_sys_bpf+0x61e/0x1f00 do_syscall_64+0xc8/0x550 entry_SYSCALL_64_after_hwframe+0x49/0xbe When kzalloc() fails in push_stack(), free_verifier_state() will free current verifier state. As push_stack() returns, dst_reg was restored if ptr_is_dst_reg is false. However, as member of the cur_state, dst_reg is also freed, and error occurs when dereferencing dst_reg. Simply fix it by testing ret of push_stack() before restoring dst_reg. Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") Signed-off-by: Xu Yu <xuyu(a)linux.alibaba.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index bcb42aa..acc2305 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2815,7 +2815,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, *dst_reg = *ptr_reg; } ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true); - if (!ptr_is_dst_reg) + if (!ptr_is_dst_reg && ret) *dst_reg = tmp; return !ret ? -EFAULT : 0; } -- 2.9.5

6 years, 5 months

2
1
0 0

[PATCH 4.9 00/30] 4.9.166-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.166 release. There are 30 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu Mar 28 04:25:51 UTC 2019. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.166-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.166-rc1 Arnd Bergmann <arnd(a)arndb.de> ath10k: avoid possible string overflow Baolin Wang <baolin.wang(a)linaro.org> power: supply: charger-manager: Fix incorrect return value Enric Balletbo i Serra <enric.balletbo(a)collabora.com> pwm-backlight: Enable/disable the PWM before/after LCD enable toggle. Baolin Wang <baolin.wang(a)linaro.org> rtc: Fix overflow when converting time64_t to rtc_time kehuanlin <chgokhl(a)gmail.com> scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1 Andrey Konovalov <andreyknvl(a)google.com> USB: core: only clean up what we allocated Peter Zijlstra <peterz(a)infradead.org> lib/int_sqrt: optimize small argument Lanqing Liu <lanqing.liu(a)spreadtrum.com> serial: sprd: clear timeout interrupt only rather than all interrupts Qiao Zhou <qiaozhou(a)asrmicro.com> arm64: traps: disable irq in die() Al Viro <viro(a)ZenIV.linux.org.uk> Hang/soft lockup in d_invalidate with simultaneous calls Wei Qiao <wei.qiao(a)spreadtrum.com> serial: sprd: adjust TIMEOUT to a big value Eric Dumazet <edumazet(a)google.com> tcp/dccp: drop SYN packets if accept queue is full Hui Wang <hui.wang(a)canonical.com> ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Takashi Iwai <tiwai(a)suse.de> ALSA: hda - Record the current power state before suspend/resume calls Waiman Long <longman(a)redhat.com> locking/lockdep: Add debug_locks check in __lock_downgrade() Myungho Jung <mhjungk(a)gmail.com> Bluetooth: Fix decrementing reference count twice in releasing socket Hans Verkuil <hverkuil(a)xs4all.nl> media: v4l2-ctrls.c/uvc: zero v4l2_event zhangyi (F) <yi.zhang(a)huawei.com> ext4: brelse all indirect buffer in ext4_ind_remove_space() Lukas Czerner <lczerner(a)redhat.com> ext4: fix data corruption caused by unaligned direct AIO Jiufei Xue <jiufei.xue(a)linux.alibaba.com> ext4: fix NULL pointer dereference while journal is aborted Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Move objtool_file struct off the stack Chen Jie <chenjie6(a)huawei.com> futex: Ensure that futex address is aligned in handle_futex_death() Archer Yan <ayan(a)wavecomp.com> MIPS: Fix kernel crash for R6 in jump label branch function Yasha Cherikovsky <yasha.che3(a)gmail.com> MIPS: Ensure ELF appended dtb is relocated Yifeng Li <tomli(a)tomli.me> mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. Jan Kara <jack(a)suse.cz> udf: Fix crash on IO error during truncate Ilya Dryomov <idryomov(a)gmail.com> libceph: wait for latest osdmap in ceph_monc_blacklist_add() Stanislaw Gruszka <sgruszka(a)redhat.com> iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Thomas Zimmermann <tzimmermann(a)suse.de> drm/vmwgfx: Don't double-free the mode stored in par->set_mode Arnd Bergmann <arnd(a)arndb.de> mmc: pxamci: fix enum type confusion ------------- Diffstat: Makefile | 4 +-- arch/arm64/kernel/traps.c | 8 +++-- arch/mips/include/asm/jump_label.h | 8 ++--- arch/mips/kernel/vmlinux.lds.S | 12 ++++--- arch/mips/loongson64/lemote-2f/irq.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 ++----- drivers/iommu/amd_iommu.c | 7 ++++- drivers/media/usb/uvc/uvc_ctrl.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls.c | 2 +- drivers/mmc/host/pxamci.c | 2 +- drivers/net/wireless/ath/ath10k/wmi.c | 2 +- drivers/power/supply/charger-manager.c | 3 +- drivers/rtc/rtc-lib.c | 6 ++-- drivers/scsi/ufs/ufshcd.c | 14 +++++---- drivers/tty/serial/sprd_serial.c | 6 ++-- drivers/usb/core/config.c | 9 ++++-- drivers/video/backlight/pwm_bl.c | 9 +++--- fs/dcache.c | 10 +++--- fs/ext4/ext4_jbd2.h | 2 +- fs/ext4/file.c | 2 +- fs/ext4/indirect.c | 12 ++++--- fs/udf/truncate.c | 3 ++ include/linux/ceph/libceph.h | 2 ++ include/net/inet_connection_sock.h | 5 --- kernel/futex.c | 4 +++ kernel/locking/lockdep.c | 3 ++ lib/int_sqrt.c | 3 ++ net/bluetooth/hci_sock.c | 3 +- net/ceph/ceph_common.c | 18 ++++++++++- net/ceph/mon_client.c | 9 ++++++ net/dccp/ipv4.c | 8 +---- net/dccp/ipv6.c | 2 +- net/ipv4/tcp_input.c | 8 +---- sound/pci/hda/hda_codec.c | 57 ++++++++++++++++++++++++++++++++-- tools/objtool/check.c | 3 +- 35 files changed, 175 insertions(+), 87 deletions(-)

6 years, 5 months

7
37
0 0

FAILED: patch "[PATCH] ARM: imx6q: cpuidle: fix bug that CPU might not wake up at" failed to apply to 3.18-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 3.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 91740fc8242b4f260cfa4d4536d8551804777fae Mon Sep 17 00:00:00 2001 From: Kohji Okuno <okuno.kohji(a)jp.panasonic.com> Date: Tue, 26 Feb 2019 11:34:13 +0900 Subject: [PATCH] ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time In the current cpuidle implementation for i.MX6q, the CPU that sets 'WAIT_UNCLOCKED' and the CPU that returns to 'WAIT_CLOCKED' are always the same. While the CPU that sets 'WAIT_UNCLOCKED' is in IDLE state of "WAIT", if the other CPU wakes up and enters IDLE state of "WFI" istead of "WAIT", this CPU can not wake up at expired time. Because, in the case of "WFI", the CPU must be waked up by the local timer interrupt. But, while 'WAIT_UNCLOCKED' is set, the local timer is stopped, when all CPUs execute "wfi" instruction. As a result, the local timer interrupt is not fired. In this situation, this CPU will wake up by IRQ different from local timer. (e.g. broacast timer) So, this fix changes CPU to return to 'WAIT_CLOCKED'. Signed-off-by: Kohji Okuno <okuno.kohji(a)jp.panasonic.com> Fixes: e5f9dec8ff5f ("ARM: imx6q: support WAIT mode using cpuidle") Cc: <stable(a)vger.kernel.org> Signed-off-by: Shawn Guo <shawnguo(a)kernel.org> diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c index bfeb25aaf9a2..326e870d7123 100644 --- a/arch/arm/mach-imx/cpuidle-imx6q.c +++ b/arch/arm/mach-imx/cpuidle-imx6q.c @@ -16,30 +16,23 @@ #include "cpuidle.h" #include "hardware.h" -static atomic_t master = ATOMIC_INIT(0); -static DEFINE_SPINLOCK(master_lock); +static int num_idle_cpus = 0; +static DEFINE_SPINLOCK(cpuidle_lock); static int imx6q_enter_wait(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index) { - if (atomic_inc_return(&master) == num_online_cpus()) { - /* - * With this lock, we prevent other cpu to exit and enter - * this function again and become the master. - */ - if (!spin_trylock(&master_lock)) - goto idle; + spin_lock(&cpuidle_lock); + if (++num_idle_cpus == num_online_cpus()) imx6_set_lpm(WAIT_UNCLOCKED); - cpu_do_idle(); - imx6_set_lpm(WAIT_CLOCKED); - spin_unlock(&master_lock); - goto done; - } + spin_unlock(&cpuidle_lock); -idle: cpu_do_idle(); -done: - atomic_dec(&master); + + spin_lock(&cpuidle_lock); + if (num_idle_cpus-- == num_online_cpus()) + imx6_set_lpm(WAIT_CLOCKED); + spin_unlock(&cpuidle_lock); return index; }

6 years, 5 months

3
2
0 0

Re: [PATCH 1/3] xhci: Fix port resume done detection for SS ports with LPM enabled

by Mathias Nyman

On 27.3.2019 16.00, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a -stable tag. > The stable tag indicates that it's relevant for the following trees: all > > The bot has tested the following trees: v5.0.4, v4.19.31, v4.14.108, v4.9.165, v4.4.177, v3.18.137. > > v5.0.4: Build OK! > v4.19.31: Build OK! > v4.14.108: Build OK! > v4.9.165: Failed to apply! Possible dependencies: > 76a0f32b28d4 ("xhci: rename temp and temp1 variables") > > v4.4.177: Failed to apply! Possible dependencies: > 76a0f32b28d4 ("xhci: rename temp and temp1 variables") > > v3.18.137: Failed to apply! Possible dependencies: > 2338b9e47fba ("xhci: define the new default speed ID for SuperSpeedPlus used by xhci hw") > 41485a90d573 ("xhci: optimize xhci bus resume time") > 76a0f32b28d4 ("xhci: rename temp and temp1 variables") > b50107bb83d0 ("xhci: check xhci hardware for USB 3.1 support") > cd33a32157e4 ("usb: xhci: cleanup xhci_hcd allocation") > > > How should we proceed with this patch? Backported versions for 4.9, 4.4 and 3.18 sent to stable Thanks Mathias

6 years, 5 months

2
1
0 0

[PATCH] USB: gadget: f_hid: fix deadlock in f_hidg_write()

by Radoslav Gerganov

commit 072684e8c58d17e853f8e8b9f6d9ce2e58d2b036 upstream. In f_hidg_write() the write_spinlock is acquired before calling usb_ep_queue() which causes a deadlock when dummy_hcd is being used. This is because dummy_queue() callbacks into f_hidg_req_complete() which tries to acquire the same spinlock. This is (part of) the backtrace when the deadlock occurs: 0xffffffffc06b1410 in f_hidg_req_complete 0xffffffffc06a590a in usb_gadget_giveback_request 0xffffffffc06cfff2 in dummy_queue 0xffffffffc06a4b96 in usb_ep_queue 0xffffffffc06b1eb6 in f_hidg_write 0xffffffff8127730b in __vfs_write 0xffffffff812774d1 in vfs_write 0xffffffff81277725 in SYSC_write Fix this by releasing the write_spinlock before calling usb_ep_queue() Reviewed-by: James Bottomley <James.Bottomley(a)HansenPartnership.com> Tested-by: James Bottomley <James.Bottomley(a)HansenPartnership.com> Cc: stable(a)vger.kernel.org Fixes: 749494b6bdbb ("usb: gadget: f_hid: fix: Move IN request allocation to set_alt()") Signed-off-by: Radoslav Gerganov <rgerganov(a)vmware.com> Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> --- drivers/usb/gadget/function/f_hid.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 5815120..8e83649 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -340,20 +340,20 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, req->complete = f_hidg_req_complete; req->context = hidg; + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); if (status < 0) { ERROR(hidg->func.config->cdev, "usb_ep_queue error on int endpoint %zd\n", status); - goto release_write_pending_unlocked; + goto release_write_pending; } else { status = count; } - spin_unlock_irqrestore(&hidg->write_spinlock, flags); return status; release_write_pending: spin_lock_irqsave(&hidg->write_spinlock, flags); -release_write_pending_unlocked: hidg->write_pending = 0; spin_unlock_irqrestore(&hidg->write_spinlock, flags); -- 1.9.1

6 years, 5 months

2
2
0 0

[PATCH] arm64: compat: Reduce address limit

by Vincenzo Frascino

Currently, compat tasks running on arm64 can allocate memory up to TASK_SIZE_32 (UL(0x100000000)). This means that mmap() allocations, if we treat them as returning an array, are not compliant with the sections 6.5.8 of the C standard (C99) which states that: "If the expression P points to an element of an array object and the expression Q points to the last element of the same array object, the pointer expression Q+1 compares greater than P". Redefine TASK_SIZE_32 to address the issue. Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Will Deacon <will.deacon(a)arm.com> Cc: Jann Horn <jannh(a)google.com> Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Vincenzo Frascino <vincenzo.frascino(a)arm.com> --- arch/arm64/include/asm/processor.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h index 5d9ce62bdebd..f8235f7df29b 100644 --- a/arch/arm64/include/asm/processor.h +++ b/arch/arm64/include/asm/processor.h @@ -57,7 +57,11 @@ #define TASK_SIZE_64 (UL(1) << vabits_user) #ifdef CONFIG_COMPAT +#ifdef CONFIG_ARM64_64K_PAGES #define TASK_SIZE_32 UL(0x100000000) +#else +#define TASK_SIZE_32 (UL(0x100000000) - PAGE_SIZE) +#endif /* CONFIG_ARM64_64K_PAGES */ #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \ TASK_SIZE_32 : TASK_SIZE_64) #define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \ -- 2.21.0

6 years, 5 months

2
2
0 0

[PATCH backport to 4.4 and 4.9] xhci: Fix port resume done detection for SS ports with LPM enabled

by Mathias Nyman

commit 6cbcf596934c8e16d6288c7cc62dfb7ad8eadf15 upstream backport to 4.4 and 4.9 stable A suspended SS port in U3 link state will go to U0 when resumed, but can almost immediately after that enter U1 or U2 link power save states before host controller driver reads the port status. Host controller driver only checks for U0 state, and might miss the finished resume, leaving flags unclear and skip notifying usb code of the wake. Add U1 and U2 to the possible link states when checking for finished port resume. Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-ring.c | 9 ++++++--- drivers/usb/host/xhci.h | 1 + 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index f4e34a7..879d822 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1645,10 +1645,13 @@ static void handle_port_status(struct xhci_hcd *xhci, } } - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 && - DEV_SUPERSPEED_ANY(temp)) { + if ((temp & PORT_PLC) && + DEV_SUPERSPEED_ANY(temp) && + ((temp & PORT_PLS_MASK) == XDEV_U0 || + (temp & PORT_PLS_MASK) == XDEV_U1 || + (temp & PORT_PLS_MASK) == XDEV_U2)) { xhci_dbg(xhci, "resume SS port %d finished\n", port_id); - /* We've just brought the device into U0 through either the + /* We've just brought the device into U0/1/2 through either the * Resume state after a device remote wakeup, or through the * U3Exit state after a host-initiated resume. If it's a device * initiated remote wake, don't pass up the link state change, diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index e679fec..de4771c 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -311,6 +311,7 @@ struct xhci_op_regs { */ #define PORT_PLS_MASK (0xf << 5) #define XDEV_U0 (0x0 << 5) +#define XDEV_U1 (0x1 << 5) #define XDEV_U2 (0x2 << 5) #define XDEV_U3 (0x3 << 5) #define XDEV_INACTIVE (0x6 << 5) -- 2.7.4

6 years, 5 months

1
0
0 0

[PATCH backport to 3.18] xhci: Fix port resume done detection for SS ports with LPM enabled

by Mathias Nyman

commit 6cbcf596934c8e16d6288c7cc62dfb7ad8eadf15 upstream. backport to 3.18 stable. A suspended SS port in U3 link state will go to U0 when resumed, but can almost immediately after that enter U1 or U2 link power save states before host controller driver reads the port status. Host controller driver only checks for U0 state, and might miss the finished resume, leaving flags unclear and skip notifying usb code of the wake. Add U1 and U2 to the possible link states when checking for finished port resume. Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-ring.c | 9 ++++++--- drivers/usb/host/xhci.h | 1 + 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 1b70797..54e4af8 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1599,10 +1599,13 @@ static void handle_port_status(struct xhci_hcd *xhci, } } - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 && - DEV_SUPERSPEED(temp)) { + if ((temp & PORT_PLC) && + DEV_SUPERSPEED(temp) && + ((temp & PORT_PLS_MASK) == XDEV_U0 || + (temp & PORT_PLS_MASK) == XDEV_U1 || + (temp & PORT_PLS_MASK) == XDEV_U2)) { xhci_dbg(xhci, "resume SS port %d finished\n", port_id); - /* We've just brought the device into U0 through either the + /* We've just brought the device into U0/1/2 through either the * Resume state after a device remote wakeup, or through the * U3Exit state after a host-initiated resume. If it's a device * initiated remote wake, don't pass up the link state change, diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 2ea272a..190d8ed 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -283,6 +283,7 @@ struct xhci_op_regs { */ #define PORT_PLS_MASK (0xf << 5) #define XDEV_U0 (0x0 << 5) +#define XDEV_U1 (0x1 << 5) #define XDEV_U2 (0x2 << 5) #define XDEV_U3 (0x3 << 5) #define XDEV_RESUME (0xf << 5) -- 2.7.4

6 years, 5 months

1
0
0 0

FAILED: patch "[PATCH] scsi: zfcp: fix rport unblock if deleted SCSI devices on" failed to apply to 3.18-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 3.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From fe67888fc007a76b81e37da23ce5bd8fb95890b0 Mon Sep 17 00:00:00 2001 From: Steffen Maier <maier(a)linux.ibm.com> Date: Tue, 26 Mar 2019 14:36:58 +0100 Subject: [PATCH] scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host An already deleted SCSI device can exist on the Scsi_Host and remain there because something still holds a reference. A new SCSI device with the same H:C:T:L and FCP device, target port WWPN, and FCP LUN can be created. When we try to unblock an rport, we still find the deleted SCSI device and return early because the zfcp_scsi_dev of that SCSI device is not ZFCP_STATUS_COMMON_UNBLOCKED. Hence we miss to unblock the rport, even if the new proper SCSI device would be in good state. Therefore, skip deleted SCSI devices when iterating the sdevs of the shost. [cf. __scsi_device_lookup{_by_target}() or scsi_device_get()] The following abbreviated trace sequence can indicate such problem: Area : REC Tag : ersfs_3 LUN : 0x4045400300000000 WWPN : 0x50050763031bd327 LUN status : 0x40000000 not ZFCP_STATUS_COMMON_UNBLOCKED Ready count : n not incremented yet Running count : 0x00000000 ERP want : 0x01 ERP need : 0xc1 ZFCP_ERP_ACTION_NONE Area : REC Tag : ersfs_3 LUN : 0x4045400300000000 WWPN : 0x50050763031bd327 LUN status : 0x41000000 Ready count : n+1 Running count : 0x00000000 ERP want : 0x01 ERP need : 0x01 ... Area : REC Level : 4 only with increased trace level Tag : ertru_l LUN : 0x4045400300000000 WWPN : 0x50050763031bd327 LUN status : 0x40000000 Request ID : 0x0000000000000000 ERP status : 0x01800000 ERP step : 0x1000 ERP action : 0x01 ERP count : 0x00 NOT followed by a trace record with tag "scpaddy" for WWPN 0x50050763031bd327. Signed-off-by: Steffen Maier <maier(a)linux.ibm.com> Fixes: 6f2ce1c6af37 ("scsi: zfcp: fix rport unblock race with LUN recovery") Cc: <stable(a)vger.kernel.org> #2.6.32+ Reviewed-by: Jens Remus <jremus(a)linux.ibm.com> Reviewed-by: Benjamin Block <bblock(a)linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c index 744a64680d5b..c0b2348d7ce6 100644 --- a/drivers/s390/scsi/zfcp_erp.c +++ b/drivers/s390/scsi/zfcp_erp.c @@ -1341,6 +1341,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); int lun_status; + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL) + continue; if (zsdev->port != port) continue; /* LUN under port of interest */

6 years, 5 months

3
2
0 0

Re: [PATCH 3.16 310/366] vmxnet3: fix checks for dma mapping errors

by Ben Hutchings

On Fri, 2019-03-29 at 17:01 +0100, Thomas Weißschuh wrote: > Hi Ben, > > I forgot you to Cc: on the following mail: > > https://lore.kernel.org/stable/20190329154756.GA14540@fralrnd0033.fra.amade… > > Thomas > > On Fri, Mar 29, 2019 at 04:47:58PM +0100, Thomas Weißschuh wrote: > > > 3.16.60-rc1 review patch. If anyone has any objections, please let me know. > > > > Sorry for the late response, this just hit the kernel in Debian Jessie > > (oldstable) a few days ago. > > > > > ------------------ > > > > > > From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> > > > > > > commit 5738a09d58d5ad2871f1f9a42bf6a3aa9ece5b3c upstream. > > > > > > vmxnet3_drv does not check dma_addr with dma_mapping_error() > > > after mapping dma memory. The patch adds the checks and > > > tries to handle failures. > > > > We are seeing kernel panics/machine freezes/BUGs with the new 3.16.64 from Debian. > > I bisected it with the vanilla stable kernel and it boiled down to this commit. > > VMs of multiple nodes of our vmware cluster are affected. > > The bug can be triggered in multiple ways, I have seen it when an external > > network request is served, when installing packages over the network and > > performing a git clone. [...] I missed the upstream follow-up to this, which was commit 58caf637365f "Driver: Vmxnet3: Fix regression caused by 5738a09". I'm attaching a backport of that. I don't have any VMware installation to test on; could you do that? Ben. -- Ben Hutchings It is easier to change the specification to fit the program than vice versa.

6 years, 5 months

2
1
0 0

[PATCH] mm: Fix modifying of page protection by insert_pfn_pmd()

by Aneesh Kumar K.V

With some architectures like ppc64, set_pmd_at() cannot cope with a situation where there is already some (different) valid entry present. Use pmdp_set_access_flags() instead to modify the pfn which is built to deal with modifying existing PMD entries. This is similar to commit cae85cb8add3 ("mm/memory.c: fix modifying of page protection by insert_pfn()") We also do similar update w.r.t insert_pfn_pud eventhough ppc64 don't support pud pfn entries now. CC: stable(a)vger.kernel.org Signed-off-by: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> --- mm/huge_memory.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 404acdcd0455..f7dca413c4b2 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -755,6 +755,20 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr, spinlock_t *ptl; ptl = pmd_lock(mm, pmd); + if (!pmd_none(*pmd)) { + if (write) { + if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) { + WARN_ON_ONCE(!is_huge_zero_pmd(*pmd)); + goto out_unlock; + } + entry = pmd_mkyoung(*pmd); + entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma); + if (pmdp_set_access_flags(vma, addr, pmd, entry, 1)) + update_mmu_cache_pmd(vma, addr, pmd); + } + goto out_unlock; + } + entry = pmd_mkhuge(pfn_t_pmd(pfn, prot)); if (pfn_t_devmap(pfn)) entry = pmd_mkdevmap(entry); @@ -770,6 +784,7 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr, set_pmd_at(mm, addr, pmd, entry); update_mmu_cache_pmd(vma, addr, pmd); +out_unlock: spin_unlock(ptl); } @@ -821,6 +836,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr, spinlock_t *ptl; ptl = pud_lock(mm, pud); + if (!pud_none(*pud)) { + if (write) { + if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) { + WARN_ON_ONCE(!is_huge_zero_pud(*pud)); + goto out_unlock; + } + entry = pud_mkyoung(*pud); + entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma); + if (pudp_set_access_flags(vma, addr, pud, entry, 1)) + update_mmu_cache_pud(vma, addr, pud); + } + goto out_unlock; + } + entry = pud_mkhuge(pfn_t_pud(pfn, prot)); if (pfn_t_devmap(pfn)) entry = pud_mkdevmap(entry); @@ -830,6 +859,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr, } set_pud_at(mm, addr, pud, entry); update_mmu_cache_pud(vma, addr, pud); + +out_unlock: spin_unlock(ptl); } -- 2.20.1

6 years, 5 months

2
1
0 0

[RFC/RFT PATCH 06/18] crypto: chacha20poly1305 - set cra_name correctly

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> If the rfc7539 template is instantiated with specific implementations, e.g. "rfc7539(chacha20-generic,poly1305-generic)" rather than "rfc7539(chacha20,poly1305)", then the implementation names end up included in the instance's cra_name. This is incorrect because it then prevents all users from allocating "rfc7539(chacha20,poly1305)", if the highest priority implementations of chacha20 and poly1305 were selected. Also, the self-tests aren't run on an instance allocated in this way. Fix it by setting the instance's cra_name from the underlying algorithms' actual cra_names, rather than from the requested names. This matches what other templates do. Fixes: 71ebc4d1b27d ("crypto: chacha20poly1305 - Add a ChaCha20-Poly1305 AEAD construction, RFC7539") Cc: <stable(a)vger.kernel.org> # v4.2+ Cc: Martin Willi <martin(a)strongswan.org> Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- crypto/chacha20poly1305.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c index ed2e12e26dd80..279d816ab51dd 100644 --- a/crypto/chacha20poly1305.c +++ b/crypto/chacha20poly1305.c @@ -645,8 +645,8 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, err = -ENAMETOOLONG; if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, - "%s(%s,%s)", name, chacha_name, - poly_name) >= CRYPTO_MAX_ALG_NAME) + "%s(%s,%s)", name, chacha->base.cra_name, + poly->cra_name) >= CRYPTO_MAX_ALG_NAME) goto out_drop_chacha; if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s(%s,%s)", name, chacha->base.cra_driver_name, -- 2.21.0

6 years, 5 months

2
1
0 0

[RFC/RFT PATCH 01/18] crypto: x86/poly1305 - fix overflow during partial reduction

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> The x86_64 implementation of Poly1305 produces the wrong result on some inputs because poly1305_4block_avx2() incorrectly assumes that when partially reducing the accumulator, the bits carried from limb 'd4' to limb 'h0' fit in a 32-bit integer. This is true for poly1305-generic which processes only one block at a time. However, it's not true for the AVX2 implementation, which processes 4 blocks at a time and therefore can produce intermediate limbs about 4x larger. Fix it by making the relevant calculations use 64-bit arithmetic rather than 32-bit. Note that most of the carries already used 64-bit arithmetic, but the d4 -> h0 carry was different for some reason. To be safe I also made the same change to the corresponding SSE2 code, though that only operates on 1 or 2 blocks at a time. I don't think it's really needed for poly1305_block_sse2(), but it doesn't hurt because it's already x86_64 code. It *might* be needed for poly1305_2block_sse2(), but overflows aren't easy to reproduce there. This bug was originally detected by my patches that improve testmgr to fuzz algorithms against their generic implementation. But also add a test vector which reproduces it directly (in the AVX2 case). Fixes: b1ccc8f4b631 ("crypto: poly1305 - Add a four block AVX2 variant for x86_64") Fixes: c70f4abef07a ("crypto: poly1305 - Add a SSE2 SIMD variant for x86_64") Cc: <stable(a)vger.kernel.org> # v4.3+ Cc: Martin Willi <martin(a)strongswan.org> Cc: Jason A. Donenfeld <Jason(a)zx2c4.com> Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- arch/x86/crypto/poly1305-avx2-x86_64.S | 14 +++++--- arch/x86/crypto/poly1305-sse2-x86_64.S | 22 ++++++++----- crypto/testmgr.h | 44 +++++++++++++++++++++++++- 3 files changed, 67 insertions(+), 13 deletions(-) diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S index 3b6e70d085da8..8457cdd47f751 100644 --- a/arch/x86/crypto/poly1305-avx2-x86_64.S +++ b/arch/x86/crypto/poly1305-avx2-x86_64.S @@ -323,6 +323,12 @@ ENTRY(poly1305_4block_avx2) vpaddq t2,t1,t1 vmovq t1x,d4 + # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> + # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small + # amount. Careful: we must not assume the carry bits 'd0 >> 26', + # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit + # integers. It's true in a single-block implementation, but not here. + # d1 += d0 >> 26 mov d0,%rax shr $26,%rax @@ -361,16 +367,16 @@ ENTRY(poly1305_4block_avx2) # h0 += (d4 >> 26) * 5 mov d4,%rax shr $26,%rax - lea (%eax,%eax,4),%eax - add %eax,%ebx + lea (%rax,%rax,4),%rax + add %rax,%rbx # h4 = d4 & 0x3ffffff mov d4,%rax and $0x3ffffff,%eax mov %eax,h4 # h1 += h0 >> 26 - mov %ebx,%eax - shr $26,%eax + mov %rbx,%rax + shr $26,%rax add %eax,h1 # h0 = h0 & 0x3ffffff andl $0x3ffffff,%ebx diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S index e6add74d78a59..6f0be7a869641 100644 --- a/arch/x86/crypto/poly1305-sse2-x86_64.S +++ b/arch/x86/crypto/poly1305-sse2-x86_64.S @@ -253,16 +253,16 @@ ENTRY(poly1305_block_sse2) # h0 += (d4 >> 26) * 5 mov d4,%rax shr $26,%rax - lea (%eax,%eax,4),%eax - add %eax,%ebx + lea (%rax,%rax,4),%rax + add %rax,%rbx # h4 = d4 & 0x3ffffff mov d4,%rax and $0x3ffffff,%eax mov %eax,h4 # h1 += h0 >> 26 - mov %ebx,%eax - shr $26,%eax + mov %rbx,%rax + shr $26,%rax add %eax,h1 # h0 = h0 & 0x3ffffff andl $0x3ffffff,%ebx @@ -524,6 +524,12 @@ ENTRY(poly1305_2block_sse2) paddq t2,t1 movq t1,d4 + # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> + # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small + # amount. Careful: we must not assume the carry bits 'd0 >> 26', + # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit + # integers. It's true in a single-block implementation, but not here. + # d1 += d0 >> 26 mov d0,%rax shr $26,%rax @@ -562,16 +568,16 @@ ENTRY(poly1305_2block_sse2) # h0 += (d4 >> 26) * 5 mov d4,%rax shr $26,%rax - lea (%eax,%eax,4),%eax - add %eax,%ebx + lea (%rax,%rax,4),%rax + add %rax,%rbx # h4 = d4 & 0x3ffffff mov d4,%rax and $0x3ffffff,%eax mov %eax,h4 # h1 += h0 >> 26 - mov %ebx,%eax - shr $26,%eax + mov %rbx,%rax + shr $26,%rax add %eax,h1 # h0 = h0 & 0x3ffffff andl $0x3ffffff,%ebx diff --git a/crypto/testmgr.h b/crypto/testmgr.h index f267633cf13ac..d18a37629f053 100644 --- a/crypto/testmgr.h +++ b/crypto/testmgr.h @@ -5634,7 +5634,49 @@ static const struct hash_testvec poly1305_tv_template[] = { .psize = 80, .digest = "\x13\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", - }, + }, { /* Regression test for overflow in AVX2 implementation */ + .plaintext = "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff\xff\xff\xff\xff" + "\xff\xff\xff\xff", + .psize = 300, + .digest = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8" + "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1", + } }; /* NHPoly1305 test vectors from https://github.com/google/adiantum */ -- 2.21.0

6 years, 5 months

2
1
0 0

[PATCH hulk-4.19-next 08/10] DTS:DTS2018120709658 Description:scsi: sd: Fix a race between closing an sd device and sd I/O

by chenxiang

From: c00284940 <c00284940(a)huawei.com> plinth inclusion category: bugfix bugzilla: NA DTS: DTS2018120709658 CVE: NA The scsi_end_request() function calls scsi_cmd_to_driver() indirectly and hence needs the disk->private_data pointer. Avoid that that pointer is cleared before all affected I/O requests have finished. This patch avoids that the following crash occurs: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: scsi_mq_uninit_cmd+0x1c/0x30 scsi_end_request+0x7c/0x1b8 scsi_io_completion+0x464/0x668 scsi_finish_command+0xbc/0x160 scsi_eh_flush_done_q+0x10c/0x170 sas_scsi_recover_host+0x84c/0xa98 [libsas] scsi_error_handler+0x140/0x5b0 kthread+0x100/0x12c ret_from_fork+0x10/0x18 Cc: Christoph Hellwig <hch(a)lst.de> Cc: Ming Lei <ming.lei(a)redhat.com> Cc: Hannes Reinecke <hare(a)suse.com> Cc: Johannes Thumshirn <jthumshirn(a)suse.de> Cc: Jason Yan <yanaijie(a)huawei.com> Cc: <stable(a)vger.kernel.org> Reported-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Change-Id: Ib761a1144492a507c7c3d4a09b817bb4f1285835 Signed-off-by: c00284940 <c00284940(a)huawei.com> Reviewed-on: http://10.90.31.173:8080/5601 Tested-by: public TuringEE <turingee(a)huawei.com> Reviewed-by: huangdaode 00314581 <huangdaode(a)hisilicon.com> Reviewed-by: public TuringEE <turingee(a)huawei.com> --- drivers/scsi/sd.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index a02196b..eb37f7d 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -1413,11 +1413,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode) scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); } - /* - * XXX and what if there are packets in flight and this close() - * XXX is followed by a "rmmod sd_mod"? - */ - scsi_disk_put(sdkp); } @@ -3514,9 +3509,21 @@ static void scsi_disk_release(struct device *dev) { struct scsi_disk *sdkp = to_scsi_disk(dev); struct gendisk *disk = sdkp->disk; - + struct request_queue *q = disk->queue; + ida_free(&sd_index_ida, sdkp->index); + /* + * Wait until all requests that are in progress have completed. + * This is necessary to avoid that e.g. scsi_end_request() crashes + * due to clearing the disk->private_data pointer. Wait from inside + * scsi_disk_release() instead of from sd_release() to avoid that + * freezing and unfreezing the request queue affects user space I/O + * in case multiple processes open a /dev/sd... node concurrently. + */ + blk_mq_freeze_queue(q); + blk_mq_unfreeze_queue(q); + disk->private_data = NULL; put_disk(disk); put_device(&sdkp->device->sdev_gendev); -- 2.8.1

6 years, 5 months

3
2
0 0

Build failure in v3.18.y.queue

by Guenter Roeck

Building arm:mxs_defconfig ... failed drivers/tty/serial/mxs-auart.c: In function 'mxs_auart_probe': drivers/tty/serial/mxs-auart.c:1065:3: error: label 'out_disable_clks' used but not defined Guenter

6 years, 5 months

2
1
0 0

[PATCH hulk-4.19-next 03/10] DTS:DTS2019030103192 Description:{fromtree} scsi:hisi_sas: fix calls to dma_set_mask_and_coherent()

by chenxiang

From: c00284940 <c00284940(a)huawei.com> plinth inclusion category: bugfix bugzilla: NA DTS: DTS2019030103192 CVE: NA The change to use dma_set_mask_and_coherent() incorrectly made a second call with the 32 bit DMA mask value when the call with the 64 bit DMA mask value succeeded. This resulted in FC connections failing due to corrupted data buffers, and various other SCSI/FCP I/O errors. Fixes: e4db40e ("scsi: hisi_sas: use dma_set_mask_and_coherent") Cc: <stable(a)vger.kernel.org> Suggested-by: Ewan D. Milne <emilne(a)redhat.com> Signed-off-by: Hannes Reinecke <hare(a)suse.com> Change-Id: I2d8b409b5b9675a8d7a17730cde342b2f7579c38 Signed-off-by: c00284940 <c00284940(a)huawei.com> Reviewed-on: http://10.90.31.173:8080/4799 Tested-by: public TuringEE <turingee(a)huawei.com> Reviewed-by: huangdaode 00314581 <huangdaode(a)hisilicon.com> Reviewed-by: public TuringEE <turingee(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 ++++++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 15 +++++++-------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index ff32799..a2a4c74 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -2556,6 +2556,7 @@ static struct Scsi_Host *hisi_sas_shost_alloc(struct platform_device *pdev, struct Scsi_Host *shost; struct hisi_hba *hisi_hba; struct device *dev = &pdev->dev; + int error; shost = scsi_host_alloc(hw->sht, sizeof(*hisi_hba)); if (!shost) { @@ -2576,8 +2577,11 @@ static struct Scsi_Host *hisi_sas_shost_alloc(struct platform_device *pdev, if (hisi_sas_get_fw_info(hisi_hba) < 0) goto err_out; - if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)) && - dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32))) { + error = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)); + if (error) + error = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32)); + + if (error) { dev_err(dev, "No usable DMA addressing method\n"); goto err_out; } diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index b4bde32..24db55f 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -2903,14 +2903,13 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) if (rc) goto err_out_disable_device; - if ((pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) || - (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0)) { - if ((pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) || - (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) != 0)) { - dev_err(dev, "No usable DMA addressing method\n"); - rc = -EIO; - goto err_out_regions; - } + rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); + if (rc) + rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); + if (rc) { + dev_err(dev, "No usable DMA addressing method\n"); + rc = -ENODEV; + goto err_out_regions; } shost = hisi_sas_shost_alloc_pci(pdev); -- 2.8.1

6 years, 5 months

3
2
0 0

Re: [PATCH] staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()

by Gao Xiang

Hi, On 2019/3/30 21:45, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a "Fixes:" tag, > fixing commit: 3aa8ec716e52 staging: erofs: add directory operations. > > The bot has tested the following trees: v5.0.5, v4.19.32. > > v5.0.5: Build OK! > v4.19.32: Failed to apply! Possible dependencies: > 6e78901a9f23 ("staging: erofs: separate erofs_get_meta_page") > 7dd68b147d60 ("staging: erofs: use explicit unsigned int type") > 8be31270362b ("staging: erofs: introduce erofs_grab_bio") > ab47dd2b0819 ("staging: erofs: cleanup z_erofs_vle_work_{lookup, register}") > > > How should we proceed with this patch? I have made a 4.19 patch for this: https://lore.kernel.org/lkml/20190401065309.68109-2-gaoxiang25@huawei.com/ Thanks, Gao Xiang > > -- > Thanks, > Sasha >

6 years, 5 months

1
0
0 0

[PATCH V2 1/3] blk-mq: free hw queue's resource in hctx's release handler

by Ming Lei

Once blk_cleanup_queue() returns, tags shouldn't be used any more, because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2 ("blk-mq: Fix a use-after-free") fixes this issue exactly. However, that commit introduces another issue. Before 45a9c9d909b2, we are allowed to run queue during cleaning up queue if the queue's kobj refcount is held. After that commit, queue can't be run during queue cleaning up, otherwise oops can be triggered easily because some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue(). We have invented ways for addressing this kind of issue before, such as: 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done") c2856ae2f315 ("blk-mq: quiesce queue before freeing queue") But still can't cover all cases, recently James reports another such kind of issue: https://marc.info/?l=linux-scsi&m=155389088124782&w=2 This issue can be quite hard to address by previous way, given scsi_run_queue() may run requeues for other LUNs. Fixes the above issue by freeing hctx's resources in its release handler, and this way is safe becasue tags isn't needed for freeing such hctx resource. This approach follows typical design pattern wrt. kobject's release handler. Cc: Dongli Zhang <dongli.zhang(a)oracle.com> Cc: James Smart <james.smart(a)broadcom.com> Cc: Bart Van Assche <bart.vanassche(a)wdc.com> Cc: linux-scsi(a)vger.kernel.org, Cc: Martin K . Petersen <martin.petersen(a)oracle.com>, Cc: Christoph Hellwig <hch(a)lst.de>, Cc: James E . J . Bottomley <jejb(a)linux.vnet.ibm.com>, Cc: jianchao wang <jianchao.w.wang(a)oracle.com> Reported-by: James Smart <james.smart(a)broadcom.com> Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free") Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> --- block/blk-core.c | 2 +- block/blk-mq-sysfs.c | 6 ++++++ block/blk-mq.c | 8 ++------ block/blk-mq.h | 2 +- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index 4673ebe42255..b3bbf8a5110d 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_queue *q) blk_exit_queue(q); if (queue_is_mq(q)) - blk_mq_free_queue(q); + blk_mq_exit_queue(q); percpu_ref_exit(&q->q_usage_counter); diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c index 3f9c3f4ac44c..4040e62c3737 100644 --- a/block/blk-mq-sysfs.c +++ b/block/blk-mq-sysfs.c @@ -10,6 +10,7 @@ #include <linux/smp.h> #include <linux/blk-mq.h> +#include "blk.h" #include "blk-mq.h" #include "blk-mq-tag.h" @@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj) { struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj); + + if (hctx->flags & BLK_MQ_F_BLOCKING) + cleanup_srcu_struct(hctx->srcu); + blk_free_flush_queue(hctx->fq); + sbitmap_free(&hctx->ctx_map); free_cpumask_var(hctx->cpumask); kfree(hctx->ctxs); kfree(hctx); diff --git a/block/blk-mq.c b/block/blk-mq.c index 70b210a308c4..05d11149e75a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2243,12 +2243,7 @@ static void blk_mq_exit_hctx(struct request_queue *q, if (set->ops->exit_hctx) set->ops->exit_hctx(hctx, hctx_idx); - if (hctx->flags & BLK_MQ_F_BLOCKING) - cleanup_srcu_struct(hctx->srcu); - blk_mq_remove_cpuhp(hctx); - blk_free_flush_queue(hctx->fq); - sbitmap_free(&hctx->ctx_map); } static void blk_mq_exit_hw_queues(struct request_queue *q, @@ -2881,7 +2876,8 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, } EXPORT_SYMBOL(blk_mq_init_allocated_queue); -void blk_mq_free_queue(struct request_queue *q) +/* tags can _not_ be used after returning from blk_mq_exit_queue */ +void blk_mq_exit_queue(struct request_queue *q) { struct blk_mq_tag_set *set = q->tag_set; diff --git a/block/blk-mq.h b/block/blk-mq.h index 0ed8e5a8729f..0a5d0893dae4 100644 --- a/block/blk-mq.h +++ b/block/blk-mq.h @@ -37,7 +37,7 @@ struct blk_mq_ctx { struct kobject kobj; } ____cacheline_aligned_in_smp; -void blk_mq_free_queue(struct request_queue *q); +void blk_mq_exit_queue(struct request_queue *q); int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr); void blk_mq_wake_waiters(struct request_queue *q); bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool); -- 2.9.5

6 years, 5 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror