The change to use dma_set_mask_and_coherent() incorrectly made a second
call with the 32 bit DMA mask value when the call with the 64 bit DMA
mask value succeeded.
Fixes: c22b332d811b ("scsi: csiostor: switch to generic DMA API")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Hannes Reinecke <hare(a)suse.com>
---
drivers/scsi/csiostor/csio_init.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index 460e4ee1c8fe..a6dd704d7f2d 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -206,8 +206,11 @@ csio_pci_init(struct pci_dev *pdev, int *bars)
pci_set_master(pdev);
pci_try_set_mwi(pdev);
- if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) ||
- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))) {
+ rv = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+ if (rv)
+ rv = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+ if (rv) {
+ rv = -ENODEV;
dev_err(&pdev->dev, "No suitable DMA available.\n");
goto err_release_regions;
}
--
2.16.4
The change to use dma_set_mask_and_coherent() incorrectly made a second
call with the 32 bit DMA mask value when the call with the 64 bit DMA
mask value succeeded. This resulted in NVMe/FC connections failing due
to corrupted data buffers, and various other SCSI/FCP I/O errors.
Fixes: f30e1bfd6154 ("scsi: lpfc: use dma_set_mask_and_coherent")
Cc: <stable(a)vger.kernel.org>
Suggested-by: Don Dutile <ddutile(a)redhat.com>
Signed-off-by: Ewan D. Milne <emilne(a)redhat.com>
Signed-off-by: Hannes Reinecke <hare(a)suse.com>
---
drivers/scsi/lpfc/lpfc_init.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index eef6b929c327..59b098cb5787 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -7693,15 +7693,18 @@ lpfc_sli_pci_mem_setup(struct lpfc_hba *phba)
unsigned long bar0map_len, bar2map_len;
int i, hbq_count;
void *ptr;
- int error = -ENODEV;
+ int error;
if (!pdev)
- return error;
+ return -ENODEV;
/* Set the device DMA mask size */
- if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) ||
- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+ error = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+ if (error)
+ error = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+ if (error)
return error;
+ error = -ENODEV;
/* Get the bus address of Bar0 and Bar2 and the number of bytes
* required by each mapping.
@@ -10053,11 +10056,13 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
uint32_t if_type;
if (!pdev)
- return error;
+ return -ENODEV;
/* Set the device DMA mask size */
- if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) ||
- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+ error = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+ if (error)
+ error = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+ if (error)
return error;
/*
--
2.16.4
Greg,
I am working on a patch series that may need to be stable at some point.
There are pre-reqs but one of the pre-reqs might need to be different in the older kernels.
How is the best way to handle that situation?
I might be able to split the problematic patch...
Mike
From: Adrian Hunter <adrian.hunter(a)intel.com>
exported-sql-viewer.py is a standalone python script and requires a
shebang. Also only python2 is supported at present. Restore the shebang
but use the more flexible 'env' form.
Signed-off-by: Adrian Hunter <adrian.hunter(a)intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: stable(a)vger.kernel.org
Fixes: a38352de4495 ("perf script python: Remove explicit shebang from Python script")
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/perf/scripts/python/exported-sql-viewer.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py
index c3091401df91..b296028386a6 100755
--- a/tools/perf/scripts/python/exported-sql-viewer.py
+++ b/tools/perf/scripts/python/exported-sql-viewer.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python2
# SPDX-License-Identifier: GPL-2.0
# exported-sql-viewer.py: view data from sql database
# Copyright (c) 2014-2018, Intel Corporation.
--
2.20.1
The recently released 3.18.137-rc1 stable-rc version fails to compile
because commit "netfilter: nf_tables: fix flush after rule deletion in
the same batch" references a macro that doesn't yet exist in 3.18. I
believe this problem also exists in 4.4 and might be addressed with
s/nft_is_active_next/nft_rule_is_active_next/.
3.18.137-rc1 (Git HEAD b336d186) contains commit c00e84e3 which
introduces a reference to the "nft_is_active_next" macro which isn't
defined in 3.18.
net/netfilter/nf_tables_api.c: In function 'nft_delrule_by_chain':
net/netfilter/nf_tables_api.c:284:3: error: implicit declaration of function 'nft_is_active_next' [-Werror=implicit-function-declaration]
if (!nft_is_active_next(ctx->net, rule))
^
The nft_is_active_next macro doesn't even exist in the 4.4 stable tree
and not until 4.9, where the commit "netfilter: nf_tables: add generic
macros to check for generation mask" refactored the
nft_rule_is_active_next static inline function to the
nft_is_active_next macro.
Thanks for maintaining the stable series!
Corey
--
undefined(a)pobox.com
Hi
I'm submitting this upstream patch for the 4.19 stable branch.
Mikulas
commit 68a958a915ca912b8ce71b9eea7445996f6e681e
Author: Mikulas Patocka <mpatocka(a)redhat.com>
Date: Mon Oct 8 12:57:34 2018 +0200
udlfb: handle unplug properly
The udlfb driver maintained an open count and cleaned up itself when the
count reached zero. But the console is also counted in the reference count
- so, if the user unplugged the device, the open count would not drop to
zero and the driver stayed loaded with console attached. If the user
re-plugged the adapter, it would create a device /dev/fb1, show green
screen and the access to the console would be lost.
The framebuffer subsystem has reference counting on its own - in order to
fix the unplug bug, we rely the framebuffer reference counting. When the
user unplugs the adapter, we call unregister_framebuffer unconditionally.
unregister_framebuffer will unbind the console, wait until all users stop
using the framebuffer and then call the fb_destroy method. The fb_destroy
cleans up the USB driver.
This patch makes the following changes:
* Drop dlfb->kref and rely on implicit framebuffer reference counting
instead.
* dlfb_usb_disconnect calls unregister_framebuffer, the rest of driver
cleanup is done in the function dlfb_ops_destroy. dlfb_ops_destroy will
be called by the framebuffer subsystem when no processes have the
framebuffer open or mapped.
* We don't use workqueue during initialization, but initialize directly
from dlfb_usb_probe. The workqueue could race with dlfb_usb_disconnect
and this racing would produce various kinds of memory corruption.
* We use usb_get_dev and usb_put_dev to make sure that the USB subsystem
doesn't free the device under us.
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
cc: Dave Airlie <airlied(a)redhat.com>
Cc: Bernie Thompson <bernie(a)plugable.com>,
Cc: Ladislav Michl <ladis(a)linux-mips.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com>
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index afbd6101c78e..070026a7e55a 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -916,8 +916,6 @@ static int dlfb_ops_open(struct fb_info *info, int user)
dlfb->fb_count++;
- kref_get(&dlfb->kref);
-
if (fb_defio && (info->fbdefio == NULL)) {
/* enable defio at last moment if not disabled by client */
@@ -940,14 +938,17 @@ static int dlfb_ops_open(struct fb_info *info, int user)
return 0;
}
-/*
- * Called when all client interfaces to start transactions have been disabled,
- * and all references to our device instance (dlfb_data) are released.
- * Every transaction must have a reference, so we know are fully spun down
- */
-static void dlfb_free(struct kref *kref)
+static void dlfb_ops_destroy(struct fb_info *info)
{
- struct dlfb_data *dlfb = container_of(kref, struct dlfb_data, kref);
+ struct dlfb_data *dlfb = info->par;
+
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+ fb_destroy_modedb(info->monspecs.modedb);
+ vfree(info->screen_base);
+
+ fb_destroy_modelist(&info->modelist);
while (!list_empty(&dlfb->deferred_free)) {
struct dlfb_deferred_free *d = list_entry(dlfb->deferred_free.next, struct dlfb_deferred_free, list);
@@ -957,40 +958,13 @@ static void dlfb_free(struct kref *kref)
}
vfree(dlfb->backing_buffer);
kfree(dlfb->edid);
+ usb_put_dev(dlfb->udev);
kfree(dlfb);
-}
-
-static void dlfb_free_framebuffer(struct dlfb_data *dlfb)
-{
- struct fb_info *info = dlfb->info;
-
- if (info) {
- unregister_framebuffer(info);
-
- if (info->cmap.len != 0)
- fb_dealloc_cmap(&info->cmap);
- if (info->monspecs.modedb)
- fb_destroy_modedb(info->monspecs.modedb);
- vfree(info->screen_base);
-
- fb_destroy_modelist(&info->modelist);
-
- dlfb->info = NULL;
-
- /* Assume info structure is freed after this point */
- framebuffer_release(info);
- }
- /* ref taken in probe() as part of registering framebfufer */
- kref_put(&dlfb->kref, dlfb_free);
+ /* Assume info structure is freed after this point */
+ framebuffer_release(info);
}
-static void dlfb_free_framebuffer_work(struct work_struct *work)
-{
- struct dlfb_data *dlfb = container_of(work, struct dlfb_data,
- free_framebuffer_work.work);
- dlfb_free_framebuffer(dlfb);
-}
/*
* Assumes caller is holding info->lock mutex (for open and release at least)
*/
@@ -1000,10 +974,6 @@ static int dlfb_ops_release(struct fb_info *info, int user)
dlfb->fb_count--;
- /* We can't free fb_info here - fbmem will touch it when we return */
- if (dlfb->virtualized && (dlfb->fb_count == 0))
- schedule_delayed_work(&dlfb->free_framebuffer_work, HZ);
-
if ((dlfb->fb_count == 0) && (info->fbdefio)) {
fb_deferred_io_cleanup(info);
kfree(info->fbdefio);
@@ -1013,8 +983,6 @@ static int dlfb_ops_release(struct fb_info *info, int user)
dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count);
- kref_put(&dlfb->kref, dlfb_free);
-
return 0;
}
@@ -1172,6 +1140,7 @@ static struct fb_ops dlfb_ops = {
.fb_blank = dlfb_ops_blank,
.fb_check_var = dlfb_ops_check_var,
.fb_set_par = dlfb_ops_set_par,
+ .fb_destroy = dlfb_ops_destroy,
};
@@ -1615,12 +1584,13 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb,
return true;
}
-static void dlfb_init_framebuffer_work(struct work_struct *work);
-
static int dlfb_usb_probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
+ int i;
+ const struct device_attribute *attr;
struct dlfb_data *dlfb;
+ struct fb_info *info;
int retval = -ENOMEM;
struct usb_device *usbdev = interface_to_usbdev(intf);
@@ -1631,10 +1601,9 @@ static int dlfb_usb_probe(struct usb_interface *intf,
goto error;
}
- kref_init(&dlfb->kref); /* matching kref_put in usb .disconnect fn */
INIT_LIST_HEAD(&dlfb->deferred_free);
- dlfb->udev = usbdev;
+ dlfb->udev = usb_get_dev(usbdev);
usb_set_intfdata(intf, dlfb);
dev_dbg(&intf->dev, "console enable=%d\n", console);
@@ -1657,42 +1626,6 @@ static int dlfb_usb_probe(struct usb_interface *intf,
}
- if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
- retval = -ENOMEM;
- dev_err(&intf->dev, "unable to allocate urb list\n");
- goto error;
- }
-
- kref_get(&dlfb->kref); /* matching kref_put in free_framebuffer_work */
-
- /* We don't register a new USB class. Our client interface is dlfbev */
-
- /* Workitem keep things fast & simple during USB enumeration */
- INIT_DELAYED_WORK(&dlfb->init_framebuffer_work,
- dlfb_init_framebuffer_work);
- schedule_delayed_work(&dlfb->init_framebuffer_work, 0);
-
- return 0;
-
-error:
- if (dlfb) {
-
- kref_put(&dlfb->kref, dlfb_free); /* last ref from kref_init */
-
- /* dev has been deallocated. Do not dereference */
- }
-
- return retval;
-}
-
-static void dlfb_init_framebuffer_work(struct work_struct *work)
-{
- int i, retval;
- struct fb_info *info;
- const struct device_attribute *attr;
- struct dlfb_data *dlfb = container_of(work, struct dlfb_data,
- init_framebuffer_work.work);
-
/* allocates framebuffer driver structure, not framebuffer memory */
info = framebuffer_alloc(0, &dlfb->udev->dev);
if (!info) {
@@ -1706,17 +1639,22 @@ static void dlfb_init_framebuffer_work(struct work_struct *work)
dlfb->ops = dlfb_ops;
info->fbops = &dlfb->ops;
+ INIT_LIST_HEAD(&info->modelist);
+
+ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+ retval = -ENOMEM;
+ dev_err(&intf->dev, "unable to allocate urb list\n");
+ goto error;
+ }
+
+ /* We don't register a new USB class. Our client interface is dlfbev */
+
retval = fb_alloc_cmap(&info->cmap, 256, 0);
if (retval < 0) {
dev_err(info->device, "cmap allocation failed: %d\n", retval);
goto error;
}
- INIT_DELAYED_WORK(&dlfb->free_framebuffer_work,
- dlfb_free_framebuffer_work);
-
- INIT_LIST_HEAD(&info->modelist);
-
retval = dlfb_setup_modes(dlfb, info, NULL, 0);
if (retval != 0) {
dev_err(info->device,
@@ -1760,10 +1698,16 @@ static void dlfb_init_framebuffer_work(struct work_struct *work)
dev_name(info->dev), info->var.xres, info->var.yres,
((dlfb->backing_buffer) ?
info->fix.smem_len * 2 : info->fix.smem_len) >> 10);
- return;
+ return 0;
error:
- dlfb_free_framebuffer(dlfb);
+ if (dlfb->info) {
+ dlfb_ops_destroy(dlfb->info);
+ } else if (dlfb) {
+ usb_put_dev(dlfb->udev);
+ kfree(dlfb);
+ }
+ return retval;
}
static void dlfb_usb_disconnect(struct usb_interface *intf)
@@ -1791,20 +1735,9 @@ static void dlfb_usb_disconnect(struct usb_interface *intf)
for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
device_remove_file(info->dev, &fb_device_attrs[i]);
device_remove_bin_file(info->dev, &edid_attr);
- unlink_framebuffer(info);
}
- usb_set_intfdata(intf, NULL);
- dlfb->udev = NULL;
-
- /* if clients still have us open, will be freed on last close */
- if (dlfb->fb_count == 0)
- schedule_delayed_work(&dlfb->free_framebuffer_work, 0);
-
- /* release reference taken by kref_init in probe() */
- kref_put(&dlfb->kref, dlfb_free);
-
- /* consider dlfb_data freed */
+ unregister_framebuffer(info);
}
static struct usb_driver dlfb_driver = {
diff --git a/include/video/udlfb.h b/include/video/udlfb.h
index 3abd327bada6..7d09e54ae54e 100644
--- a/include/video/udlfb.h
+++ b/include/video/udlfb.h
@@ -36,12 +36,9 @@ struct dlfb_data {
struct usb_device *udev;
struct fb_info *info;
struct urb_list urbs;
- struct kref kref;
char *backing_buffer;
int fb_count;
bool virtualized; /* true when physical usb device not present */
- struct delayed_work init_framebuffer_work;
- struct delayed_work free_framebuffer_work;
atomic_t usb_active; /* 0 = update virtual buffer, but no usb traffic */
atomic_t lost_pixels; /* 1 = a render op failed. Need screen refresh */
char *edid; /* null until we read edid from hw or get from sysfs */
Hi Greg and Sasha,
Attached are three mbox files containing patches that bring the Clang
backports that Nick did in 4.9.139 up to date with what is currently in
4.14 and mainline, as well as fix warnings that are present in the arm64
and x86_64 defconfigs here and in AOSP (cuttlefish_defconfig). All of
these warnings are fixed in 4.14 so there will be no regressions from
upgrading.
They were tested with Arch Linux's GCC 8.2.1 and AOSP's clang-r349610 [1]
and boot tested in QEMU 3.1.0 with our rootfs files [2].
Additionally, for Greg, I have provided a merge resolution for
the Makefile conflict you will get when doing the android-4.9 merge.
You will also get a conflict in arch/arm64/include/asm/arch_gicv3.h,
just check out to MERGE_HEAD as the {read,write}_sysreg_s macros have
the LTO workaround that causes the conflict in the first place. I
tested this resolution by building and booting cuttlefish_defconfig
for arm64 with CONFIG_LTO_CLANG and CONFIG_CFI_CLANG enabled.
[1]: https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+/…
[2]: https://github.com/ClangBuiltLinux/continuous-integration/tree/8a288264aa71…
Please let me know if there are any concerns or objections!
Nathan
From: "Arad, Ronen" <ronen.arad(a)intel.com>
Direct this upstream db65a3aaf29ecce2e34271d52e8d2336b97bd9fe sha to
stable 3.18. This patch addresses a race condition where a call to
nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
one thread in-between another thread:
skb = netlink_alloc_skb(sk,
and
skb_reserve(skb, skb_tailroom(skb) -
nlk->max_recvmsg_len);
in netlink_dump. The result can be a negative value and will cause
a kernel panic ad BUG at net/core/skbuff.c because the negative value
turns into an extremely large positive value.
Original commit:
netlink_dump() allocates skb based on the calculated min_dump_alloc or
a per socket max_recvmsg_len.
min_alloc_size is maximum space required for any single netdev
attributes as calculated by rtnl_calcit().
max_recvmsg_len tracks the user provided buffer to netlink_recvmsg.
It is capped at 16KiB.
The intention is to avoid small allocations and to minimize the number
of calls required to obtain dump information for all net devices.
netlink_dump packs as many small messages as could fit within an skb
that was sized for the largest single netdev information. The actual
space available within an skb is larger than what is requested. It could
be much larger and up to near 2x with align to next power of 2 approach.
Allowing netlink_dump to use all the space available within the
allocated skb increases the buffer size a user has to provide to avoid
truncaion (i.e. MSG_TRUNG flag set).
It was observed that with many VLANs configured on at least one netdev,
a larger buffer of near 64KiB was necessary to avoid "Message truncated"
error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when
min_alloc_size was only little over 32KiB.
This patch trims skb to allocated size in order to allow the user to
avoid truncation with more reasonable buffer size.
Signed-off-by: Ronen Arad <ronen.arad(a)intel.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
(cherry pick commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe)
Signed-off-by: Mark Salyzyn <salyzyn(a)android.com>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Ronen Arad <ronen.arad(a)intel.com>
Cc: "David S . Miller" <davem(a)davemloft.net>
Cc: Dmitry Safonov <dima(a)arista.com>
Cc: David Ahern <dsahern(a)gmail.com>
Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com>
Cc: Andrei Vagin <avagin(a)virtuozzo.com>
Cc: Li RongQing <lirongqing(a)baidu.com>
Cc: YU Bo <tsu.yubo(a)gmail.com>
Cc: Denys Vlasenko <dvlasenk(a)redhat.com>
Cc: netdev(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org # 3.18
---
net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------
1 file changed, 22 insertions(+), 12 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 50096e0edd8e..14295cef6b76 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1977,6 +1977,7 @@ static int netlink_dump(struct sock *sk)
struct nlmsghdr *nlh;
struct module *module;
int err = -ENOBUFS;
+ int alloc_min_size;
int alloc_size;
mutex_lock(nlk->cb_mutex);
@@ -1985,9 +1986,6 @@ static int netlink_dump(struct sock *sk)
goto errout_skb;
}
- cb = &nlk->cb;
- alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
-
if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
goto errout_skb;
@@ -1996,22 +1994,34 @@ static int netlink_dump(struct sock *sk)
* to reduce number of system calls on dump operations, if user
* ever provided a big enough buffer.
*/
- if (alloc_size < nlk->max_recvmsg_len) {
- skb = netlink_alloc_skb(sk,
- nlk->max_recvmsg_len,
- nlk->portid,
+ cb = &nlk->cb;
+ alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
+
+ if (alloc_min_size < nlk->max_recvmsg_len) {
+ alloc_size = nlk->max_recvmsg_len;
+ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
(GFP_KERNEL & ~__GFP_WAIT) |
__GFP_NOWARN | __GFP_NORETRY);
- /* available room should be exact amount to avoid MSG_TRUNC */
- if (skb)
- skb_reserve(skb, skb_tailroom(skb) -
- nlk->max_recvmsg_len);
}
- if (!skb)
+ if (!skb) {
+ alloc_size = alloc_min_size;
skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
(GFP_KERNEL & ~__GFP_WAIT));
+ }
if (!skb)
goto errout_skb;
+
+ /* Trim skb to allocated size. User is expected to provide buffer as
+ * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
+ * netlink_recvmsg())). dump will pack as many smaller messages as
+ * could fit within the allocated skb. skb is typically allocated
+ * with larger space than required (could be as much as near 2x the
+ * requested size with align to next power of 2 approach). Allowing
+ * dump to use the excess space makes it difficult for a user to have a
+ * reasonable static buffer based on the expected largest dump of a
+ * single netdev. The outcome is MSG_TRUNC error.
+ */
+ skb_reserve(skb, skb_tailroom(skb) - alloc_size);
netlink_skb_set_owner_r(skb, sk);
if (nlk->dump_done_errno > 0)
--
2.21.0.rc0.258.g878e2cd30e-goog
This series backports bugfixes already merged in linux upstream
which we found these issues in our commercial products, which
are serious and should be fixed immediately.
Note that it also includes some xarray modification since
upcoming patches heavily needs it, which can reduce more
conflicts later.
All patches have been tested again as a whole.
Thanks,
Gao Xiang
Gao Xiang (7):
staging: erofs: remove the redundant d_rehash() for the root dentry
staging: erofs: atomic_cond_read_relaxed on ref-locked workgroup
staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}'
staging: erofs: add a full barrier in erofs_workgroup_unfreeze
staging: erofs: {dir,inode,super}.c: rectify BUG_ONs
staging: erofs: unzip_{pagevec.h,vle.c}: rectify BUG_ONs
staging: erofs: unzip_vle_lz4.c,utils.c: rectify BUG_ONs
drivers/staging/erofs/dir.c | 7 +++-
drivers/staging/erofs/inode.c | 10 ++++-
drivers/staging/erofs/internal.h | 70 ++++++++++++++++++++++-------------
drivers/staging/erofs/super.c | 19 +++-------
drivers/staging/erofs/unzip_pagevec.h | 2 +-
drivers/staging/erofs/unzip_vle.c | 35 +++++++-----------
drivers/staging/erofs/unzip_vle_lz4.c | 2 +-
drivers/staging/erofs/utils.c | 12 +++---
8 files changed, 86 insertions(+), 71 deletions(-)
--
2.14.5
Unfortunately commit
net: validate untrusted gso packets without csum offload
d5be7f632bad0f489879eed0ff4b99bd7fe0b74c
needs follow-up
net: avoid false positives in untrusted gso validation
http://patchwork.ozlabs.org/patch/1044429/
It rejects illegal packets injected from userspace, including at
least one that can crash the kernel. But I'm afraid it has false
positives.
I would suggest holding back on the backport to stable branches until
both patches can go in together.
If the second patch is not accepted, the alternative will be to revert
this filter-based approach completely and fix the narrow kernel crash
(but I'm afraid that syzkaller will just find others..)
Apologies for the mess,
Willem
Hi Greg,
While testing v4.20.y on Tegra I noticed that the kernel is crashing on
boot if certain sound-cards are probe deferred. This issue has been
fixed in the mainline by the following commit ...
commit 09ac6a817bd687e7f5dac00470262efdd72f9319
Author: Curtis Malainey <cujomalainey(a)chromium.org>
Date: Thu Jan 10 16:21:04 2019 -0800
ASoC: soc-core: fix init platform memory handling
I have verified that this applies cleanly and resolves the issue on
v4.20.y. Please can we include for the v4.20.y stable branch?
Cheers
Jon
--
nvpublic
From: Lan Tianyu <Tianyu.Lan(a)microsoft.com>
The max flush rep count of HvFlushGuestPhysicalAddressList hypercall
is equal with how many entries of union hv_gpa_page_range can be populated
into the input parameter page. The origin code lacks parenthesis around
PAGE_SIZE - 2 * sizeof(u64). This patch is to fix it.
Cc: <stable(a)vger.kernel.org>
Fixs: cc4edae4b924 ("x86/hyper-v: Add HvFlushGuestAddressList hypercall support")
Signed-off-by: Lan Tianyu <Tianyu.Lan(a)microsoft.com>
---
arch/x86/include/asm/hyperv-tlfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/hyperv-tlfs.h b/arch/x86/include/asm/hyperv-tlfs.h
index 705dafc2d11a..2bdbbbcfa393 100644
--- a/arch/x86/include/asm/hyperv-tlfs.h
+++ b/arch/x86/include/asm/hyperv-tlfs.h
@@ -841,7 +841,7 @@ union hv_gpa_page_range {
* count is equal with how many entries of union hv_gpa_page_range can
* be populated into the input parameter page.
*/
-#define HV_MAX_FLUSH_REP_COUNT (PAGE_SIZE - 2 * sizeof(u64) / \
+#define HV_MAX_FLUSH_REP_COUNT ((PAGE_SIZE - 2 * sizeof(u64)) / \
sizeof(union hv_gpa_page_range))
struct hv_guest_mapping_flush_list {
--
2.14.4
From: Lan Tianyu <Tianyu.Lan(a)microsoft.com>
The max flush rep count of HvFlushGuestPhysicalAddressList hypercall
is equal with how many entries of union hv_gpa_page_range can be populated
into the input parameter page. The origin code lacks parenthesis around
PAGE_SIZE - 2 * sizeof(u64). This patch is to fix it.
Cc: <stable(a)vger.kernel.org>
Fixes: cc4edae4b924 ("x86/hyper-v: Add HvFlushGuestAddressList hypercall support")
Signed-off-by: Lan Tianyu <Tianyu.Lan(a)microsoft.com>
---
Change since v1
- Update change log
arch/x86/include/asm/hyperv-tlfs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/hyperv-tlfs.h b/arch/x86/include/asm/hyperv-tlfs.h
index 705dafc2d11a..2bdbbbcfa393 100644
--- a/arch/x86/include/asm/hyperv-tlfs.h
+++ b/arch/x86/include/asm/hyperv-tlfs.h
@@ -841,7 +841,7 @@ union hv_gpa_page_range {
* count is equal with how many entries of union hv_gpa_page_range can
* be populated into the input parameter page.
*/
-#define HV_MAX_FLUSH_REP_COUNT (PAGE_SIZE - 2 * sizeof(u64) / \
+#define HV_MAX_FLUSH_REP_COUNT ((PAGE_SIZE - 2 * sizeof(u64)) / \
sizeof(union hv_gpa_page_range))
struct hv_guest_mapping_flush_list {
--
2.14.4
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Lenovo Thinkpad T431s (ivb) apparently can't handle LP1+ watermarks
being enabled. It underruns severly enough that the screen is
unusable. The latency values and watemarks look as expected.
And sadly updating the BIOS to the latest version (BIOS GHET41WW
(1.26 ) 11/21/2018) did not help.
One glimmer of hope I had was the VBT. It seems to have some sort
of flag for "self refresh = yes/no", but when I looked at a bunch
of VBTs I had lying around most of them had that field set to "no".
So if we used that we'd end up disabling LP1+ on most machines.
That seems a bit harsh since we know LP1+ works just fine on
most machines.
Since I have no better ideas let's just disable LP1+ watermarks
on this particular machine via a quirk.
Cc: stable(a)vger.kernel.org
Cc: Andrea <andreatclist(a)gmail.com>
Reported-by: Andrea <andreatclist(a)gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=109477
Fixes: a46a7350b1e8 ("drm/i915: Fix ilk+ watermarks when disabling pipes")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/intel_pm.c | 51 +++++++++++++++++++++++++--------
1 file changed, 39 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 4c0e43caa5cd..75dceac19950 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3015,6 +3015,29 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
}
+static void ilk_wm_disable_quirk(struct drm_i915_private *dev_priv,
+ int level)
+{
+ int max_level = ilk_wm_max_level(dev_priv);
+
+ if (dev_priv->wm.pri_latency[level] == 0 &&
+ dev_priv->wm.spr_latency[level] == 0 &&
+ dev_priv->wm.cur_latency[level] == 0)
+ return;
+
+ DRM_DEBUG_KMS("LP%d+ watermarks disabled by quirk\n", level);
+
+ for (; level <= max_level; level++) {
+ dev_priv->wm.pri_latency[level] = 0;
+ dev_priv->wm.spr_latency[level] = 0;
+ dev_priv->wm.cur_latency[level] = 0;
+ }
+
+ intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
+ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+}
+
static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
{
/*
@@ -3028,23 +3051,18 @@ static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
* interrupts only. To play it safe we disable LP3
* watermarks entirely.
*/
- if (dev_priv->wm.pri_latency[3] == 0 &&
- dev_priv->wm.spr_latency[3] == 0 &&
- dev_priv->wm.cur_latency[3] == 0)
- return;
-
- dev_priv->wm.pri_latency[3] = 0;
- dev_priv->wm.spr_latency[3] = 0;
- dev_priv->wm.cur_latency[3] = 0;
+ ilk_wm_disable_quirk(dev_priv, 3);
+}
- DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
- intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
- intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
- intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+static void ilk_wm_disable_lp1_quirk(struct drm_i915_private *dev_priv)
+{
+ ilk_wm_disable_quirk(dev_priv, 1);
}
static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
{
+ struct pci_dev *pdev = dev_priv->drm.pdev;
+
intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
memcpy(dev_priv->wm.spr_latency, dev_priv->wm.pri_latency,
@@ -3063,6 +3081,15 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
snb_wm_latency_quirk(dev_priv);
snb_wm_lp3_irq_quirk(dev_priv);
}
+
+ /*
+ * Lenovo Thinkpad T431s (ivb)
+ * Massive underruns.
+ */
+ if (pdev->device == 0x0166 &&
+ pdev->subsystem_vendor == 0x17aa &&
+ pdev->subsystem_device == 0x2208)
+ ilk_wm_disable_lp1_quirk(dev_priv);
}
static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
--
2.19.2
On Mon, Feb 18, 2019 at 12:27 PM Simon Horman <horms(a)verge.net.au> wrote:
> On Fri, Feb 15, 2019 at 05:49:32PM +0100, Arnd Bergmann wrote:
> > On Fri, Feb 8, 2019 at 12:14 PM Simon Horman <horms+renesas(a)verge.net.au> wrote:
> > > Renesas ARM Based SoC Updates for v5.1
> > >
> > > * Correct shared IRQ handling of R-Car Gen2 Regulator quirk
> > > * Add missing dts files to MAINTAINERS
> >
> > Should the bugfix be marked Cc:stable and and Fixes:... ?
> >
> Sorry for missing that, I think that the bugfix should have had the following.
> Let me know if/how you want to handle updating the patch's changelog.
>
> Fixes: 6d14d4d313d09dab ("ARM: shmobile: Rework the PMIC IRQ line quirk")
I think the easiest way is to send an email to stable(a)kernel.org asking for
a backport of commit 5347a0203709 ("ARM: shmobile: Fix R-Car Gen2 regulator
quirk") after that has hit the mainline kernel and asking for a backport.
I've added it to Cc here, but I don't know if that's sufficient.
If you'd rather have me pick up the patch for 5.0 as well, I can also do
that and add the Cc/Fixes lines there. We will then have a duplicate
commit in 5.1, but it should not cause any merge issues.
Arnd
From: Alexander Usyskin <alexander.usyskin(a)intel.com>
Fix unbalanced module reference counting during internal reset, which
prevents the drivers unloading.
Tracking mei_me/txe modules on mei client bus via
mei_cldev_enable/disable is error prone due to possible internal
reset flow, where clients are disconnected underneath.
Moving reference counting to probe and release of mei bus client
driver solves this issue in simplest way, as each client provides only
a single connection to a client bus driver.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
---
drivers/misc/mei/bus.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index e5456faf00e6..65bec998eb6e 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -540,17 +540,9 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
goto out;
}
- if (!mei_cl_bus_module_get(cldev)) {
- dev_err(&cldev->dev, "get hw module failed");
- ret = -ENODEV;
- goto out;
- }
-
ret = mei_cl_connect(cl, cldev->me_cl, NULL);
- if (ret < 0) {
+ if (ret < 0)
dev_err(&cldev->dev, "cannot connect\n");
- mei_cl_bus_module_put(cldev);
- }
out:
mutex_unlock(&bus->device_lock);
@@ -613,7 +605,6 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
if (err < 0)
dev_err(bus->dev, "Could not disconnect from the ME client\n");
- mei_cl_bus_module_put(cldev);
out:
/* Flush queues and remove any pending read */
mei_cl_flush_queues(cl, NULL);
@@ -724,9 +715,16 @@ static int mei_cl_device_probe(struct device *dev)
if (!id)
return -ENODEV;
+ if (!mei_cl_bus_module_get(cldev)) {
+ dev_err(&cldev->dev, "get hw module failed");
+ return -ENODEV;
+ }
+
ret = cldrv->probe(cldev, id);
- if (ret)
+ if (ret) {
+ mei_cl_bus_module_put(cldev);
return ret;
+ }
__module_get(THIS_MODULE);
return 0;
@@ -754,6 +752,7 @@ static int mei_cl_device_remove(struct device *dev)
mei_cldev_unregister_callbacks(cldev);
+ mei_cl_bus_module_put(cldev);
module_put(THIS_MODULE);
dev->driver = NULL;
return ret;
--
2.20.1
On Fri, Feb 22, 2019 at 8:54 PM Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.20.11, v4.19.24, v4.14.102, v4.9.159, v4.4.175, v3.18.135.
>
> v4.19.24: Failed to apply! Possible dependencies:
> 919d8a3f3fef ("scsi: mpt3sas: Convert uses of pr_<level> with MPT3SAS_FMT to ioc_<level>")
>
> v4.14.102: Failed to apply! Possible dependencies:
> 016d5c35e278 ("scsi: mpt3sas: SGL to PRP Translation for I/Os to NVMe devices")
> 02a386df3678 ("scsi: mpt3sas: open-code _scsih_scsi_lookup_get()")
> 05303dfb7380 ("scsi: mpt3sas: use list_splice_init()")
> 12e7c6782bc5 ("scsi: mpt3sas: Introduce mpt3sas_get_st_from_smid()")
> 182ac784b41f ("scsi: mpt3sas: Introduce Base function for cloning.")
> 22ae5a3c2599 ("scsi: mpt3sas: Introduce API to get BAR0 mapped buffer address")
> 494f401bcd07 ("scsi: mpt3sas: Fix sparse warnings")
> 6a2d4618aef3 ("scsi: mpt3sas: separate out _base_recovery_check()")
> 6da999fe5a92 ("scsi: mpt3sas: simplify mpt3sas_scsi_issue_tm()")
> 74fcfa5371b7 ("scsi: mpt3sas: simplify task management functions")
> 93204b782a88 ("scsi: mpt3sas: Lockless access for chain buffers.")
> 9961c9bbf2b4 ("scsi: mpt3sas: check command status before attempting abort")
> aff39e61218f ("scsi: mpt3sas: Added support for nvme encapsulated request message.")
> b0cd285eb57c ("scsi: mpt3sas: always use first reserved smid for ioctl passthrough")
> ba4494d47bd0 ("scsi: mpt3sas: set default value for cb_idx")
> c102e00cf4b8 ("scsi: mpt3sas: API 's to support NVMe drive addition to SML")
> cd5897eda27d ("scsi: mpt3sas: Fix nvme drives checking for tlr.")
> d8335ae2b453 ("scsi: mpt3sas: fix dma_addr_t casts")
> d88e1eaba6ee ("scsi: mpt3sas: Add nvme device support in slave alloc, target alloc and probe")
> dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
>
> v4.9.159: Failed to apply! Possible dependencies:
> 016d5c35e278 ("scsi: mpt3sas: SGL to PRP Translation for I/Os to NVMe devices")
> 12e7c6782bc5 ("scsi: mpt3sas: Introduce mpt3sas_get_st_from_smid()")
> 307d9075a02b ("scsi: mpt3sas: Recognize and act on iopriority info")
> 494f401bcd07 ("scsi: mpt3sas: Fix sparse warnings")
> 81c16f83231a ("scsi: mpt3sas: Use the new MPI 2.6 32-bit Atomic Request Descriptors for SAS35 devices.")
> 998f26aedf41 ("scsi: mpt3sas: Added Device ID's for SAS35 devices and updated MPI header.")
> aff39e61218f ("scsi: mpt3sas: Added support for nvme encapsulated request message.")
> b0cd285eb57c ("scsi: mpt3sas: always use first reserved smid for ioctl passthrough")
> ba4494d47bd0 ("scsi: mpt3sas: set default value for cb_idx")
> c696f7b83ede ("scsi: mpt3sas: Implement device_remove_in_progress check in IOCTL path")
> d8335ae2b453 ("scsi: mpt3sas: fix dma_addr_t casts")
> dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
>
> v4.4.175: Failed to apply! Possible dependencies:
> 016d5c35e278 ("scsi: mpt3sas: SGL to PRP Translation for I/Os to NVMe devices")
> 12e7c6782bc5 ("scsi: mpt3sas: Introduce mpt3sas_get_st_from_smid()")
> 30158dc9bbc9 ("mpt3sas: Never block the Enclosure device")
> 307d9075a02b ("scsi: mpt3sas: Recognize and act on iopriority info")
> 5f0dfb7a9bcc ("mpt3sas: Used "synchronize_irq()"API to synchronize timed-out IO & TMs")
> 6c197093847e ("mpt3sas: Set maximum transfer length per IO to 4MB for VDs")
> 81c16f83231a ("scsi: mpt3sas: Use the new MPI 2.6 32-bit Atomic Request Descriptors for SAS35 devices.")
> 8bbb1cf63f5e ("mpt3sas: Fix warnings exposed by W=1")
> 998f26aedf41 ("scsi: mpt3sas: Added Device ID's for SAS35 devices and updated MPI header.")
> aff39e61218f ("scsi: mpt3sas: Added support for nvme encapsulated request message.")
> b0cd285eb57c ("scsi: mpt3sas: always use first reserved smid for ioctl passthrough")
> b130b0d56fa9 ("mpt3sas: Added support for high port count HBA variants.")
> ba4494d47bd0 ("scsi: mpt3sas: set default value for cb_idx")
> c696f7b83ede ("scsi: mpt3sas: Implement device_remove_in_progress check in IOCTL path")
> d8335ae2b453 ("scsi: mpt3sas: fix dma_addr_t casts")
> dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
> fd0331b32826 ("mpt3sas: Make use of additional HighPriority credit message frames for sending SCSI IO's")
>
> v3.18.135: Failed to apply! Possible dependencies:
> 03d1fb3a6578 ("mpt3sas: Fix for Asynchronous completion of timedout IO and task abort of timedout IO.")
> 12e7c6782bc5 ("scsi: mpt3sas: Introduce mpt3sas_get_st_from_smid()")
> 2b89669ae4ad ("mpt3sas: Bump mpt3sas driver version to v6.100.00.00")
> 2e26c3853206 ("mpt3sas: Update MPI2 strings to MPI2.5")
> 2ecb204d07ac ("scsi: always assign block layer tags if enabled")
> 3c5866565f37 ("mpt2sas: Use mpi headers from mpt3sas")
> 7497392a1193 ("mpt3sas: Move Gen3 HBA's device registration to a separate file")
> 7786ab6aff9c ("mpt3sas: Ported WarpDrive product SSS6200 support")
> 78f97c8f612d ("mpt2sas: Move Gen2 HBA's device registration to a separate file")
> 8a7e4c24e08f ("mpt3sas: Added mpt2sas driver definitions")
> 8f88dc41927f ("mptfusion: don't change queue type in ->change_queue_depth")
> a03bd153b1b3 ("mpt2sas, mpt3sas: Update attribution language to Avago")
> a62182f338b3 ("scsi: provide a generic change_queue_type method")
> ad666a0f41d9 ("mpt2sas, mpt3sas: fix upper bound for the module parameter max_sgl_entries")
> c75683ca13d1 ("mpt3sas : Bump mpt3sas driver version to 9.100.00.00")
> c8b09f6fb67d ("scsi: don't set tagging state from scsi_adjust_queue_depth")
> cb16ef384f15 ("mpt2sas: MPI2 Rev AA (2.00.19) specifications")
> cf75d5d6aa91 ("mpt3sas: simplify ->change_queue_depth")
> d357e84d65df ("mpt3sas: Define 'hba_mpi_version_belonged' IOC variable")
> d42432ad6c5c ("mpt2sas: MPI2 Rev BB (2.00.20) specification and 2.00.35 header files")
> db5ed4dfd5dd ("scsi: drop reason argument from ->change_queue_depth")
> dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
> f9d81cfc2315 ("mpt3sas: Bump mpt3sas Driver version to v5.100.00.00")
> fb77bb5376a5 ("mpt3sas: Added Combined Reply Queue feature to extend up-to 96 MSIX vector support")
>
>
> How should we proceed with this patch?
Shall I prepare the patches against all the above stable kernels and
shall I post them individually? if yes then how should I mention that
the particular is for corresponding stable kernel?
Thanks,
Sreekanth
>
> --
> Thanks,
> Sasha