- Linux-stable-mirror - lists.linaro.org

FAILED: patch "[PATCH] mm, vmscan: Allow preallocating memory for" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8e04944f0ea8b838399049bdcda920ab36ae3b04 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Wed, 4 Apr 2018 19:53:07 +0900 Subject: [PATCH] mm,vmscan: Allow preallocating memory for register_shrinker(). syzbot is catching so many bugs triggered by commit 9ee332d99e4d5a97 ("sget(): handle failures of register_shrinker()"). That commit expected that calling kill_sb() from deactivate_locked_super() without successful fill_super() is safe, but the reality was different; some callers assign attributes which are needed for kill_sb() after sget() succeeds. For example, [1] is a report where sb->s_mode (which seems to be either FMODE_READ | FMODE_EXCL | FMODE_WRITE or FMODE_READ | FMODE_EXCL) is not assigned unless sget() succeeds. But it does not worth complicate sget() so that register_shrinker() failure path can safely call kill_block_super() via kill_sb(). Making alloc_super() fail if memory allocation for register_shrinker() failed is much simpler. Let's avoid calling deactivate_locked_super() from sget_userns() by preallocating memory for the shrinker and making register_shrinker() in sget_userns() never fail. [1] https://syzkaller.appspot.com/bug?id=588996a25a2587be2e3a54e8646728fb9cae44… Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+5a170e19c963a2e0df79(a)syzkaller.appspotmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/super.c b/fs/super.c index 5fa9a8d8d865..122c402049a2 100644 --- a/fs/super.c +++ b/fs/super.c @@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s) security_sb_free(s); put_user_ns(s->s_user_ns); kfree(s->s_subtype); + free_prealloced_shrinker(&s->s_shrink); /* no delays needed */ destroy_super_work(&s->destroy_work); } @@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_shrink.count_objects = super_cache_count; s->s_shrink.batch = 1024; s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE; + if (prealloc_shrinker(&s->s_shrink)) + goto fail; return s; fail: @@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type, hlist_add_head(&s->s_instances, &type->fs_supers); spin_unlock(&sb_lock); get_filesystem(type); - err = register_shrinker(&s->s_shrink); - if (err) { - deactivate_locked_super(s); - s = ERR_PTR(err); - } + register_shrinker_prepared(&s->s_shrink); return s; } diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 388ff2936a87..6794490f25b2 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -75,6 +75,9 @@ struct shrinker { #define SHRINKER_NUMA_AWARE (1 << 0) #define SHRINKER_MEMCG_AWARE (1 << 1) -extern int register_shrinker(struct shrinker *); -extern void unregister_shrinker(struct shrinker *); +extern int prealloc_shrinker(struct shrinker *shrinker); +extern void register_shrinker_prepared(struct shrinker *shrinker); +extern int register_shrinker(struct shrinker *shrinker); +extern void unregister_shrinker(struct shrinker *shrinker); +extern void free_prealloced_shrinker(struct shrinker *shrinker); #endif diff --git a/mm/vmscan.c b/mm/vmscan.c index 8b920ce3ae02..9b697323a88c 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone /* * Add a shrinker callback to be called from the vm. */ -int register_shrinker(struct shrinker *shrinker) +int prealloc_shrinker(struct shrinker *shrinker) { size_t size = sizeof(*shrinker->nr_deferred); @@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker) shrinker->nr_deferred = kzalloc(size, GFP_KERNEL); if (!shrinker->nr_deferred) return -ENOMEM; + return 0; +} + +void free_prealloced_shrinker(struct shrinker *shrinker) +{ + kfree(shrinker->nr_deferred); + shrinker->nr_deferred = NULL; +} +void register_shrinker_prepared(struct shrinker *shrinker) +{ down_write(&shrinker_rwsem); list_add_tail(&shrinker->list, &shrinker_list); up_write(&shrinker_rwsem); +} + +int register_shrinker(struct shrinker *shrinker) +{ + int err = prealloc_shrinker(shrinker); + + if (err) + return err; + register_shrinker_prepared(shrinker); return 0; } EXPORT_SYMBOL(register_shrinker);

7 years, 4 months

3
2
0 0

[PATCH 0/2] usb: typec: fixes

by Heikki Krogerus

Hi, I got two separate fixes here. First one will fix an issue with ucsi where the driver may timeout if EC is under heavy load, and the second an issue with tps6598x when used with plain I2C adapters. Thanks, Heikki Krogerus (2): usb: typec: tps6598x: handle block reads separately with plain-I2C adapters usb: typec: ucsi: Increase command completion timeout value drivers/usb/typec/tps6598x.c | 42 +++++++++++++++++++++++++++++------ drivers/usb/typec/ucsi/ucsi.c | 2 +- 2 files changed, 36 insertions(+), 8 deletions(-) -- 2.17.0

7 years, 4 months

3
9
0 0

FAILED: patch "[PATCH] mm, vmscan: Allow preallocating memory for" failed to apply to 3.18-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 3.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8e04944f0ea8b838399049bdcda920ab36ae3b04 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Wed, 4 Apr 2018 19:53:07 +0900 Subject: [PATCH] mm,vmscan: Allow preallocating memory for register_shrinker(). syzbot is catching so many bugs triggered by commit 9ee332d99e4d5a97 ("sget(): handle failures of register_shrinker()"). That commit expected that calling kill_sb() from deactivate_locked_super() without successful fill_super() is safe, but the reality was different; some callers assign attributes which are needed for kill_sb() after sget() succeeds. For example, [1] is a report where sb->s_mode (which seems to be either FMODE_READ | FMODE_EXCL | FMODE_WRITE or FMODE_READ | FMODE_EXCL) is not assigned unless sget() succeeds. But it does not worth complicate sget() so that register_shrinker() failure path can safely call kill_block_super() via kill_sb(). Making alloc_super() fail if memory allocation for register_shrinker() failed is much simpler. Let's avoid calling deactivate_locked_super() from sget_userns() by preallocating memory for the shrinker and making register_shrinker() in sget_userns() never fail. [1] https://syzkaller.appspot.com/bug?id=588996a25a2587be2e3a54e8646728fb9cae44… Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+5a170e19c963a2e0df79(a)syzkaller.appspotmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/super.c b/fs/super.c index 5fa9a8d8d865..122c402049a2 100644 --- a/fs/super.c +++ b/fs/super.c @@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s) security_sb_free(s); put_user_ns(s->s_user_ns); kfree(s->s_subtype); + free_prealloced_shrinker(&s->s_shrink); /* no delays needed */ destroy_super_work(&s->destroy_work); } @@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_shrink.count_objects = super_cache_count; s->s_shrink.batch = 1024; s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE; + if (prealloc_shrinker(&s->s_shrink)) + goto fail; return s; fail: @@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type, hlist_add_head(&s->s_instances, &type->fs_supers); spin_unlock(&sb_lock); get_filesystem(type); - err = register_shrinker(&s->s_shrink); - if (err) { - deactivate_locked_super(s); - s = ERR_PTR(err); - } + register_shrinker_prepared(&s->s_shrink); return s; } diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 388ff2936a87..6794490f25b2 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -75,6 +75,9 @@ struct shrinker { #define SHRINKER_NUMA_AWARE (1 << 0) #define SHRINKER_MEMCG_AWARE (1 << 1) -extern int register_shrinker(struct shrinker *); -extern void unregister_shrinker(struct shrinker *); +extern int prealloc_shrinker(struct shrinker *shrinker); +extern void register_shrinker_prepared(struct shrinker *shrinker); +extern int register_shrinker(struct shrinker *shrinker); +extern void unregister_shrinker(struct shrinker *shrinker); +extern void free_prealloced_shrinker(struct shrinker *shrinker); #endif diff --git a/mm/vmscan.c b/mm/vmscan.c index 8b920ce3ae02..9b697323a88c 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone /* * Add a shrinker callback to be called from the vm. */ -int register_shrinker(struct shrinker *shrinker) +int prealloc_shrinker(struct shrinker *shrinker) { size_t size = sizeof(*shrinker->nr_deferred); @@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker) shrinker->nr_deferred = kzalloc(size, GFP_KERNEL); if (!shrinker->nr_deferred) return -ENOMEM; + return 0; +} + +void free_prealloced_shrinker(struct shrinker *shrinker) +{ + kfree(shrinker->nr_deferred); + shrinker->nr_deferred = NULL; +} +void register_shrinker_prepared(struct shrinker *shrinker) +{ down_write(&shrinker_rwsem); list_add_tail(&shrinker->list, &shrinker_list); up_write(&shrinker_rwsem); +} + +int register_shrinker(struct shrinker *shrinker) +{ + int err = prealloc_shrinker(shrinker); + + if (err) + return err; + register_shrinker_prepared(shrinker); return 0; } EXPORT_SYMBOL(register_shrinker);

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] mm, vmscan: Allow preallocating memory for" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8e04944f0ea8b838399049bdcda920ab36ae3b04 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Wed, 4 Apr 2018 19:53:07 +0900 Subject: [PATCH] mm,vmscan: Allow preallocating memory for register_shrinker(). syzbot is catching so many bugs triggered by commit 9ee332d99e4d5a97 ("sget(): handle failures of register_shrinker()"). That commit expected that calling kill_sb() from deactivate_locked_super() without successful fill_super() is safe, but the reality was different; some callers assign attributes which are needed for kill_sb() after sget() succeeds. For example, [1] is a report where sb->s_mode (which seems to be either FMODE_READ | FMODE_EXCL | FMODE_WRITE or FMODE_READ | FMODE_EXCL) is not assigned unless sget() succeeds. But it does not worth complicate sget() so that register_shrinker() failure path can safely call kill_block_super() via kill_sb(). Making alloc_super() fail if memory allocation for register_shrinker() failed is much simpler. Let's avoid calling deactivate_locked_super() from sget_userns() by preallocating memory for the shrinker and making register_shrinker() in sget_userns() never fail. [1] https://syzkaller.appspot.com/bug?id=588996a25a2587be2e3a54e8646728fb9cae44… Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+5a170e19c963a2e0df79(a)syzkaller.appspotmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/super.c b/fs/super.c index 5fa9a8d8d865..122c402049a2 100644 --- a/fs/super.c +++ b/fs/super.c @@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s) security_sb_free(s); put_user_ns(s->s_user_ns); kfree(s->s_subtype); + free_prealloced_shrinker(&s->s_shrink); /* no delays needed */ destroy_super_work(&s->destroy_work); } @@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_shrink.count_objects = super_cache_count; s->s_shrink.batch = 1024; s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE; + if (prealloc_shrinker(&s->s_shrink)) + goto fail; return s; fail: @@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type, hlist_add_head(&s->s_instances, &type->fs_supers); spin_unlock(&sb_lock); get_filesystem(type); - err = register_shrinker(&s->s_shrink); - if (err) { - deactivate_locked_super(s); - s = ERR_PTR(err); - } + register_shrinker_prepared(&s->s_shrink); return s; } diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 388ff2936a87..6794490f25b2 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -75,6 +75,9 @@ struct shrinker { #define SHRINKER_NUMA_AWARE (1 << 0) #define SHRINKER_MEMCG_AWARE (1 << 1) -extern int register_shrinker(struct shrinker *); -extern void unregister_shrinker(struct shrinker *); +extern int prealloc_shrinker(struct shrinker *shrinker); +extern void register_shrinker_prepared(struct shrinker *shrinker); +extern int register_shrinker(struct shrinker *shrinker); +extern void unregister_shrinker(struct shrinker *shrinker); +extern void free_prealloced_shrinker(struct shrinker *shrinker); #endif diff --git a/mm/vmscan.c b/mm/vmscan.c index 8b920ce3ae02..9b697323a88c 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone /* * Add a shrinker callback to be called from the vm. */ -int register_shrinker(struct shrinker *shrinker) +int prealloc_shrinker(struct shrinker *shrinker) { size_t size = sizeof(*shrinker->nr_deferred); @@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker) shrinker->nr_deferred = kzalloc(size, GFP_KERNEL); if (!shrinker->nr_deferred) return -ENOMEM; + return 0; +} + +void free_prealloced_shrinker(struct shrinker *shrinker) +{ + kfree(shrinker->nr_deferred); + shrinker->nr_deferred = NULL; +} +void register_shrinker_prepared(struct shrinker *shrinker) +{ down_write(&shrinker_rwsem); list_add_tail(&shrinker->list, &shrinker_list); up_write(&shrinker_rwsem); +} + +int register_shrinker(struct shrinker *shrinker) +{ + int err = prealloc_shrinker(shrinker); + + if (err) + return err; + register_shrinker_prepared(shrinker); return 0; } EXPORT_SYMBOL(register_shrinker);

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] mm, vmscan: Allow preallocating memory for" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8e04944f0ea8b838399049bdcda920ab36ae3b04 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Wed, 4 Apr 2018 19:53:07 +0900 Subject: [PATCH] mm,vmscan: Allow preallocating memory for register_shrinker(). syzbot is catching so many bugs triggered by commit 9ee332d99e4d5a97 ("sget(): handle failures of register_shrinker()"). That commit expected that calling kill_sb() from deactivate_locked_super() without successful fill_super() is safe, but the reality was different; some callers assign attributes which are needed for kill_sb() after sget() succeeds. For example, [1] is a report where sb->s_mode (which seems to be either FMODE_READ | FMODE_EXCL | FMODE_WRITE or FMODE_READ | FMODE_EXCL) is not assigned unless sget() succeeds. But it does not worth complicate sget() so that register_shrinker() failure path can safely call kill_block_super() via kill_sb(). Making alloc_super() fail if memory allocation for register_shrinker() failed is much simpler. Let's avoid calling deactivate_locked_super() from sget_userns() by preallocating memory for the shrinker and making register_shrinker() in sget_userns() never fail. [1] https://syzkaller.appspot.com/bug?id=588996a25a2587be2e3a54e8646728fb9cae44… Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+5a170e19c963a2e0df79(a)syzkaller.appspotmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/super.c b/fs/super.c index 5fa9a8d8d865..122c402049a2 100644 --- a/fs/super.c +++ b/fs/super.c @@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s) security_sb_free(s); put_user_ns(s->s_user_ns); kfree(s->s_subtype); + free_prealloced_shrinker(&s->s_shrink); /* no delays needed */ destroy_super_work(&s->destroy_work); } @@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, s->s_shrink.count_objects = super_cache_count; s->s_shrink.batch = 1024; s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE; + if (prealloc_shrinker(&s->s_shrink)) + goto fail; return s; fail: @@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type, hlist_add_head(&s->s_instances, &type->fs_supers); spin_unlock(&sb_lock); get_filesystem(type); - err = register_shrinker(&s->s_shrink); - if (err) { - deactivate_locked_super(s); - s = ERR_PTR(err); - } + register_shrinker_prepared(&s->s_shrink); return s; } diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 388ff2936a87..6794490f25b2 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -75,6 +75,9 @@ struct shrinker { #define SHRINKER_NUMA_AWARE (1 << 0) #define SHRINKER_MEMCG_AWARE (1 << 1) -extern int register_shrinker(struct shrinker *); -extern void unregister_shrinker(struct shrinker *); +extern int prealloc_shrinker(struct shrinker *shrinker); +extern void register_shrinker_prepared(struct shrinker *shrinker); +extern int register_shrinker(struct shrinker *shrinker); +extern void unregister_shrinker(struct shrinker *shrinker); +extern void free_prealloced_shrinker(struct shrinker *shrinker); #endif diff --git a/mm/vmscan.c b/mm/vmscan.c index 8b920ce3ae02..9b697323a88c 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone /* * Add a shrinker callback to be called from the vm. */ -int register_shrinker(struct shrinker *shrinker) +int prealloc_shrinker(struct shrinker *shrinker) { size_t size = sizeof(*shrinker->nr_deferred); @@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker) shrinker->nr_deferred = kzalloc(size, GFP_KERNEL); if (!shrinker->nr_deferred) return -ENOMEM; + return 0; +} + +void free_prealloced_shrinker(struct shrinker *shrinker) +{ + kfree(shrinker->nr_deferred); + shrinker->nr_deferred = NULL; +} +void register_shrinker_prepared(struct shrinker *shrinker) +{ down_write(&shrinker_rwsem); list_add_tail(&shrinker->list, &shrinker_list); up_write(&shrinker_rwsem); +} + +int register_shrinker(struct shrinker *shrinker) +{ + int err = prealloc_shrinker(shrinker); + + if (err) + return err; + register_shrinker_prepared(shrinker); return 0; } EXPORT_SYMBOL(register_shrinker);

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] mac80211_hwsim: fix use-after-free bug in hwsim_exit_net" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8cfd36a0b53aeb4ec21d81eb79706697b84dfc3d Mon Sep 17 00:00:00 2001 From: Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> Date: Wed, 7 Mar 2018 18:11:07 +0100 Subject: [PATCH] mac80211_hwsim: fix use-after-free bug in hwsim_exit_net When destroying a net namespace, all hwsim interfaces, which are not created in default namespace are deleted. But the async deletion of the interfaces could last longer than the actual destruction of the namespace, which results to an use after free bug. Therefore use synchronous deletion in this case. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Reported-by: syzbot+70ce058e01259de7bb1d(a)syzkaller.appspotmail.com Signed-off-by: Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 930ddef91093..d9527c7b50d4 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3528,8 +3528,12 @@ static void __net_exit hwsim_exit_net(struct net *net) list_del(&data->list); rhashtable_remove_fast(&hwsim_radios_rht, &data->rht, hwsim_rht_params); - INIT_WORK(&data->destroy_work, destroy_radio); - queue_work(hwsim_wq, &data->destroy_work); + hwsim_radios_generation++; + spin_unlock_bh(&hwsim_radio_lock); + mac80211_hwsim_del_radio(data, + wiphy_name(data->hw->wiphy), + NULL); + spin_lock_bh(&hwsim_radio_lock); } spin_unlock_bh(&hwsim_radio_lock);

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] mac80211_hwsim: fix use-after-free bug in hwsim_exit_net" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8cfd36a0b53aeb4ec21d81eb79706697b84dfc3d Mon Sep 17 00:00:00 2001 From: Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> Date: Wed, 7 Mar 2018 18:11:07 +0100 Subject: [PATCH] mac80211_hwsim: fix use-after-free bug in hwsim_exit_net When destroying a net namespace, all hwsim interfaces, which are not created in default namespace are deleted. But the async deletion of the interfaces could last longer than the actual destruction of the namespace, which results to an use after free bug. Therefore use synchronous deletion in this case. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Reported-by: syzbot+70ce058e01259de7bb1d(a)syzkaller.appspotmail.com Signed-off-by: Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 930ddef91093..d9527c7b50d4 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3528,8 +3528,12 @@ static void __net_exit hwsim_exit_net(struct net *net) list_del(&data->list); rhashtable_remove_fast(&hwsim_radios_rht, &data->rht, hwsim_rht_params); - INIT_WORK(&data->destroy_work, destroy_radio); - queue_work(hwsim_wq, &data->destroy_work); + hwsim_radios_generation++; + spin_unlock_bh(&hwsim_radio_lock); + mac80211_hwsim_del_radio(data, + wiphy_name(data->hw->wiphy), + NULL); + spin_lock_bh(&hwsim_radio_lock); } spin_unlock_bh(&hwsim_radio_lock);

7 years, 4 months

1
0
0 0

[PATCH 03/20] drm/amd/display: Disallow enabling CRTC without primary plane with FB

by Harry Wentland

The below commit "drm/atomic: Try to preserve the crtc enabled state in drm_atomic_remove_fb, v2" introduces a slight behavioral change to rmfb. Instead of disabling a crtc when the primary plane is disabled, it now preserves it. Since DC is currently not equipped to handle this we need to fail such a commit, otherwise we might see a corrupted screen. This is based on Shirish's previous approach but avoids adding all planes to the new atomic state which leads to a full update in DC for any commit, and is not what we intend. Theoretically DM should be able to deal with states with fully populated planes, even for simple updates, such as cursor updates. This should still be addressed in the future. Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Tested-by: Michel Dänzer <michel.daenzer(a)amd.com> Reviewed-by: Tony Cheng <Tony.Cheng(a)amd.com> Cc: stable(a)vger.kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 72968958e2b1..75fe04692172 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -4671,6 +4671,7 @@ static int dm_update_crtcs_state(struct amdgpu_display_manager *dm, struct amdgpu_dm_connector *aconnector = NULL; struct drm_connector_state *new_con_state = NULL; struct dm_connector_state *dm_conn_state = NULL; + struct drm_plane_state *new_plane_state = NULL; new_stream = NULL; @@ -4678,6 +4679,13 @@ static int dm_update_crtcs_state(struct amdgpu_display_manager *dm, dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); acrtc = to_amdgpu_crtc(crtc); + new_plane_state = drm_atomic_get_new_plane_state(state, new_crtc_state->crtc->primary); + + if (new_crtc_state->enable && new_plane_state && !new_plane_state->fb) { + ret = -EINVAL; + goto fail; + } + aconnector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc); /* TODO This hack should go away */ @@ -4882,7 +4890,7 @@ static int dm_update_planes_state(struct dc *dc, if (!dm_old_crtc_state->stream) continue; - DRM_DEBUG_DRIVER("Disabling DRM plane: %d on DRM crtc %d\n", + DRM_DEBUG_ATOMIC("Disabling DRM plane: %d on DRM crtc %d\n", plane->base.id, old_plane_crtc->base.id); if (!dc_remove_plane_from_context( -- 2.17.0

7 years, 4 months

1
0
0 0

[PATCH] arm64: export tishift functions to modules

by Jason A. Donenfeld

Otherwise modules that use these arithmetic operations will fail to link. We accomplish this with EXPORT_SYMBOL in the .S file, but because of symbol versioning, we actually need to have a declaration of these too in C. So, we introduce asm-prototypes.h, which is the same file name and technique used for similar reasons in the m68k arch tree. While we're at it, we also fix this up to use SPDX, and I personally choose to relicense this as GPL2||BSD so that these symbols don't need to be export_symbol_gpl, so all modules can use the routines, since these are important general purpose compiler-generated function calls. Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reported-by: PaX Team <pageexec(a)freemail.hu> Cc: stable(a)vger.kernel.org --- arch/arm64/include/asm/asm-prototypes.h | 11 +++++++++++ arch/arm64/lib/tishift.S | 19 ++++++------------- 2 files changed, 17 insertions(+), 13 deletions(-) create mode 100644 arch/arm64/include/asm/asm-prototypes.h diff --git a/arch/arm64/include/asm/asm-prototypes.h b/arch/arm64/include/asm/asm-prototypes.h new file mode 100644 index 000000000000..8f1919e44f51 --- /dev/null +++ b/arch/arm64/include/asm/asm-prototypes.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) + * + * Copyright (C) 2017-2018 Jason A. Donenfeld <Jason(a)zx2c4.com>. All Rights Reserved. + */ + +/* These functions are defined in lib/tishift.S, but need to be declared + * here so that symbol versioning picks them up. + */ +extern long long __ashlti3(long long a, int b); +extern long long __ashrti3(long long a, int b); +extern long long __lshrti3(long long a, int b); diff --git a/arch/arm64/lib/tishift.S b/arch/arm64/lib/tishift.S index d3db9b2cd479..3bca433973cb 100644 --- a/arch/arm64/lib/tishift.S +++ b/arch/arm64/lib/tishift.S @@ -1,20 +1,10 @@ -/* - * Copyright (C) 2017 Jason A. Donenfeld <Jason(a)zx2c4.com>. All Rights Reserved. +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as - * published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. + * Copyright (C) 2017-2018 Jason A. Donenfeld <Jason(a)zx2c4.com>. All Rights Reserved. */ #include <linux/linkage.h> +#include <asm-generic/export.h> ENTRY(__ashlti3) cbz x2, 1f @@ -36,6 +26,7 @@ ENTRY(__ashlti3) mov x0, x2 ret ENDPROC(__ashlti3) +EXPORT_SYMBOL(__ashlti3) ENTRY(__ashrti3) cbz x2, 1f @@ -57,6 +48,7 @@ ENTRY(__ashrti3) mov x1, x2 ret ENDPROC(__ashrti3) +EXPORT_SYMBOL(__ashrti3) ENTRY(__lshrti3) cbz x2, 1f @@ -78,3 +70,4 @@ ENTRY(__lshrti3) mov x1, x2 ret ENDPROC(__lshrti3) +EXPORT_SYMBOL(__lshrti3) -- 2.17.0

7 years, 4 months

2
1
0 0

[GIT PULL] commits for Linux 4.9

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.9 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit f080bba272b1e3f9bbf0b6c1acef3efaf16b631d: Linux 4.9.92 (2018-03-31 18:11:36 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.9-15042018 for you to fetch changes up to ea63a9c35234ba149e7595523e11400ddbd5a9c8: irqchip/gic-v3: Change pr_debug message to pr_devel (2018-04-15 11:03:00 -0400) - ---------------------------------------------------------------- for-greg-4.9-15042018 - ---------------------------------------------------------------- Adam Lessnau (1): powercap/RAPL: prevent overridding bits outside of the mask Adrian Hunter (1): perf intel-pt: Do not use TSC packets for calculating CPU cycles to TSC Alex Estrin (1): IB/ipoib: Fix for potential no-carrier state Alex Williamson (1): PCI: Add function 1 DMA alias quirk for Marvell 9128 Alexey Dobriyan (1): proc: fix /proc/*/map_files lookup Alexey Khoroshilov (1): vmlfb: Fix error handling in cr_pll_init() Anand Jain (1): btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP Andrew Duggan (1): Input: synaptics-rmi4 - only read the F54 query registers which are used Andy Shevchenko (1): device property: Define type of PROPERTY_ENRTY_*() macros Andy Spencer (1): gianfar: prevent integer wrapping in the rx handler Anna-Maria Gleixner (1): tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account Arnaldo Carvalho de Melo (3): perf evsel: Fix probing of precise_ip level for default cycles event perf evsel: Set attr.exclude_kernel when probing max attr.precise_ip perf callchain: Fix attr.sample_max_stack setting Arnd Bergmann (4): xen: avoid type warning in xchg_xen_ulong scsi: fas216: fix sense buffer initialization x86/power: Fix swsusp_arch_resume prototype cifs: silence compiler warnings showing up with gcc-8.0.0 BenoÃ®t ThÃ©baudeau (2): mmc: sdhci-esdhc-imx: Fix DAT line software reset mmc: sdhci-esdhc: Add SDHCI_QUIRK_32BIT_DMA_ADDR Bjorn Helgaas (3): efi/fb: Correct PCI_STD_RESOURCE_END usage PCI: Correct PCI_STD_RESOURCE_END usage PCI: Enable ECRC only if device supports it Bob Moore (1): ACPICA: Disassembler: Abort on an invalid/unknown AML opcode Boris Brezillon (1): drm/vc4: Send a VBLANK event when disabling a CRTC Chao Yu (1): f2fs: fix to avoid panic when encountering corrupt node Chen Yu (1): ACPI: processor_perflib: Do not send _PPC change notification if not ready Chris Packham (1): mtd: handle partitioning on devices with 0 erasesize Chris Wilson (1): e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails Christian Lamparter (1): net: emac: fix reset timeout with AR8035 phy Christoph Hellwig (1): PCI: Protect pci_error_handlers->reset_notify() usage with device_lock() Christophe JAILLET (1): drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path Christophe Jaillet (1): cpuidle: dt: Add missing 'of_node_put()' Chuck Lever (1): sunrpc: Disable splice for krb5i Coly Li (1): bcache: properly set task state in bch_writeback_thread() Dan Carpenter (6): X.509: Fix error code in x509_cert_parse() x86/nmi: Fix timeout test in test_nmi_ipi() scsi: bnx2i: missing error code in bnx2i_ep_connect() libertas: Fix lbs_prb_rsp_limit_set() ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() Dan Williams (1): libnvdimm, pmem: fix persistence warning Daniel Axtens (1): sched/fair: WARN() and refuse to set buddy when !se->on_rq Daniel Borkmann (1): bpf: fix rlimit in reuseport net selftest Daniel Bristot de Oliveira (1): sched/deadline: Use the revised wakeup rule for suspending constrained dl tasks Daniel Scheller (1): media: dvb-frontends/cxd2841er: require STATE_ACTIVE_* for agc readout Dave Martin (4): arm64: ptrace: Flush user-RW TLS reg to thread_struct before reading arm64: ptrace: Fix VFP register dumping in compat coredumps arm64: ptrace: Avoid setting compat FP[SC]R to garbage if get_user fails arm64: ptrace: Fix incorrect get_user() use in compat_vfp_set() David Daney (1): MIPS: Give __secure_computing() access to syscall arguments. Dinh Nguyen (1): clk: socfpga: Fix the smplsel on Arria10 and Stratix10 Dmitry Monakhov (1): block: guard bvec iteration logic Dmitry Osipenko (1): drm/tegra: dc: Avoid reset asserts on Tegra20 Dmitry Safonov (1): ARM: 8683/1: ARM32: Support mremap() for sigpage/vDSO Dmitry Torokhov (1): Input: psmouse - fix Synaptics detection when protocol is disabled Doug Berger (1): libata: Add the AHCI_HFLAG_YES_ALPM flag Ed Swierk (1): openvswitch: Remove padding from packet before L3+ conntrack processing Edward Cree (1): sfc: remove duplicate up_write on VF filter_sem Emmanuel Grumbach (3): iwlwifi: mvm: reset the fw_dump_desc pointer after ASSERT iwlwifi: mvm: don't send fetch the TID from a non-QoS packet in TSO iwlwifi: mvm: don't mess the SNAP header in TSO for non-QoS packets Eric Biggers (2): KEYS: put keyring if install_session_keyring_to_cred() fails ext4: require key for truncate(2) of encrypted file Eric Ren (1): ocfs2: fix deadlock caused by recursive locking in xattr Fabio Estevam (1): net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272 Filipe Manana (1): Btrfs: send, fix invalid path after renaming and linking file Gal Pressman (1): net/mlx5: Fix driver load error flow when firmware is stuck Ganesh Goudar (1): cxgb4: fix a NULL dereference Geert Uytterhoeven (2): ARM: dts: armadillo800eva: Split LCD mux and gpio of: Provide dummy of_device_compatible_match() for compile-testing Girish Moodalbail (1): geneve: add missing rx stats accounting Goran Ferenc (3): MIPS: VDSO: Fix conversions in do_monotonic()/do_monotonic_coarse() MIPS: VDSO: Add implementation of clock_gettime() fallback MIPS: VDSO: Add implementation of gettimeofday() fallback Guanglei Li (1): RDS: IB: Fix null pointer issue Guenter Roeck (1): watchdog: sp5100_tco: Fix watchdog disable bit Gustavo A. R. Silva (1): tcp_nv: fix potential integer overflow in tcpnv_acked Haishuang Yan (3): ip_tunnel: fix potential issue in ip_tunnel_rcv ip6_tunnel: fix potential issue in __ip6_tnl_rcv ip6_tunnel: Correct tos value in collect_md mode Haiyang Zhang (1): hv_netvsc: Fix the carrier state error when data path is off Hans de Goede (3): brcmfmac: Use separate firmware for revision 0 of the brcm43430 chip Bluetooth: hci_bcm: Add active_low irq polarity quirk for Asus T100CHI ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs Hari Bathini (1): powerpc/fadump: avoid duplicates in crash memory ranges Hector Martin (1): firewire-ohci: work around oversized DMA reads on JMicron controllers Heiner Kallweit (1): pinctrl: meson-gxbb: remove non-existing pin GPIOX_22 Jacob Keller (3): ixgbe: fix race condition with PTP_TX_IN_PROGRESS bits ixgbe: avoid permanent lock of *_PTP_TX_IN_PROGRESS i40evf: assign num_active_queues inside i40evf_alloc_queues Jag Raman (1): sparc64: ldc abort during vds iso boot Jake Daryll Obina (1): jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path James Hogan (1): MIPS: generic: Fix machine compatible matching James Smart (2): scsi: lpfc: Fix return value of board_mode store routine in case of online failure scsi: lpfc: Fix crash after firmware flash when IO is running. James Wang (1): Fix loop device flush before configure v3 Jan Chochol (1): nfs: Do not convert nfs_idmap_cache_timeout to jiffies Jan HÃ¶ppner (1): s390/dasd: Display read-only attribute correctly Jason Gunthorpe (1): tpm_tis: Fix IRQ autoprobing when using platform_device Jean Delvare (3): firmware: dmi_scan: Look for SMBIOS 3 entry point first firmware: dmi_scan: Check DMI structure length firmware: dmi_scan: Fix handling of empty DMI strings Jean-Baptiste Maneyrol (1): iio: imu: inv_mpu6050: test whoami first and against all known values Jeff Mahoney (1): ixgbe: pci_set_drvdata must be called before register_netdev Jeffy Chen (1): spi: rockchip: Disable Runtime PM when chip select is asserted Jerome Brunet (1): clk: scpi: error when clock fails to register Jesper Dangaard Brouer (1): tools/libbpf: handle issues with bpf ELF objects containing .eh_frames Jia Zhang (1): vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page Jia-Ju Bai (1): scsi: megaraid: Fix a sleep-in-atomic bug Jim Mattson (1): KVM: nVMX: Update vmcs12->guest_linear_address on nested VM-exit Jiri Olsa (1): perf unwind: Do not fail due to missing unwind support Johan Hovold (2): NFC: nfcmrvl_uart: fix device-node leak during probe scsi: sun_esp: fix device reference leaks Johannes Berg (6): iwlwifi: mvm: track and report IBSS manager status to mac80211 iwlwifi: mvm: use scnprintf() instead of snprintf() iwlwifi: mvm: don't warn in queue sync on RF-kill iwlwifi: pcie: fix command completion name debug iwlwifi: mvm: unconditionally stop device after init iwlwifi: mvm: fix deduplication start logic John Hsu (1): ASoC: nau8825: fix jack type detection issue after resume Jonas Gorski (1): leds: bcm6328: fix signal source assignment for leds 4 to 7 Jonathan Corbet (1): Docs: Include the Latex "ifthen" package JoÃ£o Paulo Rechi Vita (1): platform/x86: acer-wmi: Detect RF Button capability Kai Heng Feng (1): platform/x86: dell-laptop: Fix bogus keyboard backlight sysfs interface Karicheri, Muralidharan (1): hsr: fix incorrect warning KarimAllah Ahmed (1): kvm: Map PFN-type memory regions as writable (if possible) Karol Herbst (1): drm/nouveau/pmu/fuc: don't use movw directly anymore Kees Cook (2): scsi: csiostor: Avoid content leaks and casts seccomp: Adjust selftests to avoid double-join Kevin Barnett (1): scsi: smartpqi: correct bdma hw bug Kirill A. Shutemov (1): asm-generic: provide generic_pmdp_establish() Kishon Vijay Abraham I (1): ARM: dts: am57xx-beagle-x15-revb1: Fix supply name used for MMC1 IO lines Krzysztof Kozlowski (1): clk: samsung: audss: Fix silent hang on Exynos4412 due to disabled EPLL Leon Romanovsky (1): RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure Lin Yun Sheng (1): net/hns:bugfix of ethtool -t phy self_test Liping Zhang (1): netfilter: ebt_nflog: fix unexpected truncated packet Liu Bo (4): Btrfs: skip commit transaction if we don't have enough pinned bytes Btrfs: tolerate errors if we have retried successfully Btrfs: set plug for fsync Btrfs: fix scrub to repair raid6 corruption Liwei Song (1): i2c: ismt: fix wrong device address when unmap the data buffer Logan Gunthorpe (1): ntb_transport: Fix bug with max_mw_size parameter Lorenzo Bianconi (1): iio: magnetometer: st_magn_spi: fix spi_device_id table Luc Van Oostenryck (2): arm64: pass machine size to sparse arm64: pass endianness info to sparse Luis R. Rodriguez (1): fs: warn in case userspace lied about modprobe return Lv Zheng (5): ACPICA: OSL: Add support to exclude stdarg.h ACPICA: Events: Add runtime stub support for event APIs ACPI: EC: Fix an EC event IRQ storming issue ACPI: EC: Fix EC command visibility for dynamic debug ACPI / EC: Add support to skip boot stage DSDT probe Marcel Holtmann (1): Bluetooth: Send HCI Set Event Mask Page 2 command only when needed Marcelo Ricardo Leitner (1): sctp: adjust ssthresh when transport is idle Marcin Nowakowski (2): MIPS: mm: fixed mappings: correct initialisation MIPS: kprobes: flush_insn_slot should flush only if probe initialised Mario Molitor (1): stmmac: fix ptp header for GMAC3 hw timestamp Mark Salter (1): irqchip/gic-v3: Change pr_debug message to pr_devel Martin Blumenstingl (3): clk: meson: meson8b: add compatibles for Meson8 and Meson8m2 net: stmmac: dwmac-meson8b: fix setting the RGMII TX clock on Meson8b net: stmmac: dwmac-meson8b: propagate rate changes to the parent clock Mateusz Jurczyk (2): caif: Add sockaddr length check before accessing sa_family in connect handler af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Mathieu Larouche (1): drm/mgag200: Fix to always set HiPri for G200e4 V2 Mathieu Malaterre (1): net: Extra '_get' in declaration of arch_get_platform_mac_address Matt Redfearn (1): MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS Matt Weber (1): i2c: cadance: fix ctrl/addr reg write order Mauro Carvalho Chehab (1): Docs: Fix breakage with Sphinx 1.5 and upper Mel Gorman (1): mm: pin address_space before dereferencing it while isolating an LRU page Michael Bringmann (2): powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes powerpc/numa: Ensure nodes initialized for hotplug Michael Grzeschik (1): arcnet: change irq handler to lock irqsave Michael Kelley (1): cpumask: Make for_each_cpu_wrap() available on UP as well Michael Neuling (1): powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 Michail Georgios Etairidis (1): i2c: imx: Use correct function to write to register MickaÃ«l SalaÃ¼n (1): selftests: kselftest_harness: Fix compile warning Mike Snitzer (1): Revert "dm mirror: use all available legs on multiple failures" Ming Lei (1): nvme: fix hang in remove path Mintz, Yuval (2): bnx2x: Allow vfs to disable txvlan offload bnx2x: Don't log mc removal needlessly Miroslav Lichvar (1): kselftests: timers: Fix inconsistency-check to not ignore first timestamp Namhyung Kim (3): perf annotate: Fix symbolic link of build-id cache perf tools: Decompress kernel module when reading DSO data perf tests: Decompress kernel module before objdump Naveen N. Rao (1): powerpc64/elfv1: Only dereference function descriptor for non-text symbols NeilBrown (1): NFSv4: always set NFS_LOCK_LOST when a lock is lost. Netanel Belgazal (5): net: ena: fix rare uncompleted admin command false alarm net: ena: fix race condition between submit and completion admin command net: ena: add missing return when ena_com_get_io_handlers() fails net: ena: add missing unmap bars on device removal net: ena: disable admin msix while working in polling mode Ngai-Mint Kwan (1): fm10k: fix "failed to kill vid" message for VF Nikolay Aleksandrov (1): bridge: allow ext learned entries to change ports Nikolay Borisov (1): btrfs: Fix out of bounds access in btrfs_search_slot Nitin Gupta (2): sparc64: Fix gup_huge_pmd sparc64: update pmdp_invalidate() to return old pmd value Omar Sandoval (1): Btrfs: always account pinned bytes when dropping a tree block ref Paolo Bonzini (1): kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl Paul Burton (6): MIPS: module: Ensure we always clean up r_mips_hi16_list MIPS: SEAD-3: Set interrupt-parent per-device, not at root node MIPS: CPS: Prevent multi-core with dcache aliasing MIPS: CPS: Handle spurious VP starts more gracefully MIPS: CPS: Handle cores not powering down more gracefully MIPS: Handle tlbex-tlbp race condition Paul E. McKenney (1): rcu: Make synchronize_rcu_mult() check for duplicates Peter Xu (1): iommu/vt-d: Use domain instead of cache fetching Peter Zijlstra (2): perf/core: Correct event creation with PERF_FORMAT_GROUP x86/tsc: Allow TSC calibration without PIT Phil Reid (2): iio: buffer-dma: Add missing header buffer_impl.h iio: buffer-dmaengine: Add missing header buffer_impl.h Phong LE (1): mmc: mediatek: Fixed size in dma_free_coherent Ping-Ke Shih (1): rtlwifi: btcoex: rtl8723be: fix ant_sel not work Priyalee Kushwaha (1): platform/x86: intel_telemetry_debugfs: fix oops when load/unload module Rafael J. Wysocki (1): PCI/PM: Avoid using device_may_wakeup() for runtime PM Raju Rangoju (1): rdma/cxgb4: Fix memory leaks during module exit Rakesh Pandit (1): nvme-pci: fix multiple ctrl removal scheduling Robin Murphy (2): coresight: tmc: Configure DMA mask appropriately irqchip/gic-v3-its: Fix MSI alias accounting Roopa Prabhu (1): vxlan: dont migrate permanent fdb entries during learn Ross Lagerwall (2): xen-netfront: Fix race between device setup and open xen/grant-table: Use put_page instead of free_page Sean Wang (1): net: ethernet: mediatek: fixed deadlock captured by lockdep Sebastian Andrzej Siewior (1): fs/dcache: init in_lookup_hashtable Sebastian Ott (2): s390/pci: improve error handling during interrupt deregistration s390/pci: improve unreg_ioat error handling Serhey Popovych (2): fib_rules: Resolve goto rules target on delete veth: Be more robust on network device creation when no attributes Shiraz Saleem (1): i40iw: Zero-out consumer key on allocate stag for FMR Sinan Kaya (1): dmaengine: qcom_hidma: correct API violation for submit Sowmini Varadhan (1): rds: tcp: Set linger when rejecting an incoming conn in rds_tcp_accept_one Stefan Haberland (1): s390/dasd: fix hanging safe offline Stephen Boyd (1): irqchip/gic-v3: Ignore disabled ITS nodes Steven Rostedt (VMware) (2): tools lib traceevent: Simplify pointer print logic and fix %pF tools lib traceevent: Fix get_field_str() for dynamic strings Subash Abhinov Kasiviswanathan (2): netfilter: ipv6: nf_defrag: Pass on packets to stack per RFC2460 netfilter: ipv6: nf_defrag: Kill frag queue on RFC2460 failure Sujith Pandel (1): PCI: Add domain number check to find_smbios_instance_string() Sunil Goutham (1): iommu/arm-smmu-v3: Increase CMDQ drain timeout value Suzuki K Poulose (4): coresight: Fix reference count for software sources irqchip/gic-v2: Report failures in gic_irq_domain_alloc irqchip/gic-v3: Report failures in gic_irq_domain_alloc irqchip/gic-v3: Honor forced affinity setting Tahsin Erdogan (1): ext4: change fast symlink test to not rely on i_blocks Takashi Iwai (3): ALSA: timer: Wrap with spinlock for queue access ALSA: hda: Fix potential race at unregistration and unsol events ALSA: hda - Use IS_REACHABLE() for dependency on input Tang Junhui (3): bcache: fix for allocator and register thread race bcache: fix for data collapse after re-attaching an attached device bcache: return attach error when no cache set exist Tayar, Tomer (1): qed: fix dump of context data Tero Kristo (2): crypto: omap-sham - buffer handling fixes for hashing later crypto: omap-sham - fix closing of hash with separate finalize call Thiago Jung Bauermann (2): powerpc/perf/hv-24x7: Fix passing of catalog version number powerpc/perf/hv-24x7: Fix off-by-one error in request_buffer check Thomas Petazzoni (1): irqchip/armada-370-xp: Re-enable per-CPU interrupts at resume time Thomas Richter (1): perf record: Fix failed memory allocation for get_cpuid_str Tonghao Zhang (1): datapath: Avoid using stack larger than 1024. Tore Anderson (1): net: cdc_mbim: apply "NDP to end" quirk to HP lt4132 Ulf Magnusson (3): kconfig: Don't leak main menus during parsing kconfig: Fix automatic menu creation mem leak kconfig: Fix expr_free() E_NOT leak Vignesh R (1): serial: 8250: 8250_omap: Fix race b/w dma completion and RX timeout Vlad Yasevich (1): macvlan: Do not return error when setting the same mac address Vladimir Murzin (2): dma: Take into account dma_pfn_offset drivers: dma-coherent: Account dma_pfn_offset when used with device tree WANG Cong (1): net_sched: move tcf_lock down after gen_replace_estimator() Wang Nan (1): perf test llvm: Avoid error when PROFILE_ALL_BRANCHES is set Wei Yongjun (1): ipmi/powernv: Fix error return code in ipmi_powernv_probe() Will Deacon (2): arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics locking/qspinlock: Ensure node->count is updated before initialising node Wolfram Sang (1): i2c: rcar: use correct length when unmapping DMA Xin Long (3): sctp: fix recursive locking warning in sctp_do_peeloff dccp: call inet_add_protocol after register_pernet_subsys in dccp_v4_init sctp: uncork the old asoc before changing to the new one Xose Vazquez Perez (1): scsi: devinfo: fix format of the device list Yang Shi (1): mm: thp: use down_read_trylock() in khugepaged to avoid long block Yazen Ghannam (1): x86/mce: Don't disable MCA banks when offlining a CPU on AMD Yisheng Xie (2): mm/mempolicy: fix the check of nodemask from user mm/mempolicy: add nodes_empty check in SYSC_migrate_pages Yonghong Song (1): bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y Yuyang Du (2): usb: usbip tool: Check the return of get_nports() usb: usbip tool: Fix refresh_imported_device_list() hayeswang (1): r8152: add byte_enable for ocp_read_word function mulhern (1): dm thin: fix documentation relative to low water mark threshold piaojun (3): ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute ocfs2: return error when we attempt to access a dirty bh in jbd2 shidao.ytt (1): mm/fadvise: discard partial page if endbyte is also EOF weiyongjun (A) (1): mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() Documentation/conf.py | 9 +- Documentation/device-mapper/thin-provisioning.txt | 8 +- .../bindings/clock/amlogic,meson8b-clkc.txt | 11 +- arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts | 2 +- arch/arm/boot/dts/r8a7740-armadillo800eva.dts | 2 + arch/arm/include/asm/xen/events.h | 2 +- arch/arm/kernel/process.c | 8 + arch/arm/kernel/vdso.c | 18 + arch/arm64/Makefile | 4 +- arch/arm64/include/asm/processor.h | 3 + arch/arm64/include/asm/spinlock.h | 4 +- arch/arm64/kernel/process.c | 8 +- arch/arm64/kernel/ptrace.c | 29 +- arch/mips/boot/dts/mti/sead3.dts | 5 +- arch/mips/generic/board-sead3.c | 26 +- arch/mips/include/asm/kprobes.h | 3 +- arch/mips/include/asm/machine.h | 2 +- arch/mips/include/asm/vdso.h | 4 +- arch/mips/kernel/cps-vec.S | 7 +- arch/mips/kernel/module.c | 28 +- arch/mips/kernel/ptrace.c | 22 +- arch/mips/kernel/smp-cps.c | 35 +- arch/mips/mm/pgtable-32.c | 6 +- arch/mips/mm/tlbex.c | 38 +- arch/mips/txx9/rbtx4939/setup.c | 4 +- arch/mips/vdso/gettimeofday.c | 57 +- arch/powerpc/include/asm/code-patching.h | 10 +- arch/powerpc/kernel/fadump.c | 15 +- arch/powerpc/kernel/setup-common.c | 4 + arch/powerpc/mm/numa.c | 78 +- arch/powerpc/perf/hv-24x7.c | 16 +- arch/s390/include/asm/pci_insn.h | 2 +- arch/s390/pci/pci.c | 48 +- arch/s390/pci/pci_dma.c | 4 +- arch/s390/pci/pci_insn.c | 10 +- arch/sparc/include/asm/pgtable_64.h | 2 +- arch/sparc/kernel/ldc.c | 7 +- arch/sparc/mm/gup.c | 4 +- arch/sparc/mm/tlb.c | 23 +- arch/x86/entry/vdso/vma.c | 3 - arch/x86/include/asm/i8259.h | 5 + arch/x86/kernel/cpu/mcheck/mce.c | 5 +- arch/x86/kernel/nmi_selftest.c | 2 +- arch/x86/kernel/tsc.c | 18 + arch/x86/kvm/vmx.c | 3 +- arch/x86/kvm/x86.c | 7 +- arch/x86/mm/init_64.c | 3 +- arch/x86/power/hibernate_32.c | 2 +- arch/x86/power/hibernate_64.c | 2 +- crypto/asymmetric_keys/x509_cert_parser.c | 1 + drivers/acpi/acpica/evxfevnt.c | 18 + drivers/acpi/acpica/psobject.c | 14 + drivers/acpi/ec.c | 27 +- drivers/acpi/processor_perflib.c | 2 +- drivers/acpi/scan.c | 20 +- drivers/ata/ahci.h | 1 + drivers/ata/libahci.c | 5 + drivers/base/dma-coherent.c | 15 +- drivers/block/loop.c | 3 + drivers/bluetooth/hci_bcm.c | 9 + drivers/char/ipmi/ipmi_powernv.c | 5 +- drivers/char/tpm/tpm_tis.c | 2 +- drivers/clk/clk-scpi.c | 8 +- drivers/clk/meson/Kconfig | 6 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/samsung/clk-exynos-audss.c | 1 + drivers/clk/socfpga/clk-gate-a10.c | 2 +- drivers/clk/socfpga/clk.h | 3 + drivers/cpuidle/dt_idle_states.c | 4 +- drivers/crypto/omap-sham.c | 31 +- drivers/dma/qcom/hidma.c | 15 +- drivers/dma/qcom/hidma.h | 1 + drivers/firewire/ohci.c | 8 +- drivers/firmware/dmi_scan.c | 62 +- drivers/gpu/drm/mgag200/mgag200_mode.c | 9 +- .../drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h | 746 +++++++-------- .../drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h | 802 ++++++++-------- .../drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h | 1006 ++++++++++---------- .../gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc | 30 +- drivers/gpu/drm/tegra/dc.c | 30 +- drivers/gpu/drm/vc4/vc4_crtc.c | 13 + drivers/gpu/drm/vc4/vc4_gem.c | 13 +- drivers/hid/hid-roccat-kovaplus.c | 2 + drivers/hwtracing/coresight/coresight-tmc.c | 7 + drivers/hwtracing/coresight/coresight.c | 15 +- drivers/i2c/busses/i2c-cadence.c | 6 +- drivers/i2c/busses/i2c-imx.c | 8 +- drivers/i2c/busses/i2c-ismt.c | 2 +- drivers/i2c/busses/i2c-rcar.c | 2 +- drivers/iio/buffer/industrialio-buffer-dma.c | 1 + drivers/iio/buffer/industrialio-buffer-dmaengine.c | 1 + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 33 +- drivers/iio/magnetometer/st_magn_spi.c | 2 - drivers/infiniband/hw/cxgb4/device.c | 10 +- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 1 + drivers/infiniband/hw/mlx5/qp.c | 5 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 + drivers/input/mouse/psmouse-base.c | 34 +- drivers/input/rmi4/rmi_f54.c | 17 +- drivers/iommu/arm-smmu-v3.c | 12 +- drivers/iommu/intel-iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 46 +- drivers/irqchip/irq-gic-v3-its-pci-msi.c | 37 +- drivers/irqchip/irq-gic-v3-its-platform-msi.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 2 + drivers/irqchip/irq-gic-v3.c | 16 +- drivers/irqchip/irq-gic.c | 7 +- drivers/leds/leds-bcm6328.c | 4 +- drivers/md/bcache/alloc.c | 4 +- drivers/md/bcache/bcache.h | 2 +- drivers/md/bcache/btree.c | 9 +- drivers/md/bcache/super.c | 23 +- drivers/md/bcache/sysfs.c | 11 +- drivers/md/bcache/writeback.c | 7 +- drivers/md/dm-raid1.c | 21 +- drivers/media/dvb-frontends/cxd2841er.c | 5 +- drivers/mmc/host/mtk-sd.c | 2 +- drivers/mmc/host/sdhci-esdhc-imx.c | 59 +- drivers/mmc/host/sdhci-esdhc.h | 1 + drivers/mtd/mtdpart.c | 26 +- drivers/net/arcnet/arcnet.c | 7 +- drivers/net/ethernet/amazon/ena/ena_com.c | 35 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 19 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 4 + drivers/net/ethernet/freescale/gianfar.c | 9 +- drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +- drivers/net/ethernet/ibm/emac/core.c | 26 +- drivers/net/ethernet/intel/e1000e/netdev.c | 7 +- drivers/net/ethernet/intel/fm10k/fm10k_netdev.c | 14 +- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 18 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 22 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 15 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_debug.c | 2 +- drivers/net/ethernet/sfc/ef10_sriov.c | 2 - .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h | 3 +- drivers/net/geneve.c | 36 +- drivers/net/hyperv/hyperv_net.h | 2 + drivers/net/hyperv/netvsc.c | 2 + drivers/net/hyperv/netvsc_drv.c | 8 +- drivers/net/macvlan.c | 4 + drivers/net/usb/cdc_mbim.c | 7 + drivers/net/usb/r8152.c | 4 +- drivers/net/veth.c | 4 +- drivers/net/vxlan.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +- .../net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | 22 +- drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 16 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 17 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 20 +- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 3 +- drivers/net/wireless/mac80211_hwsim.c | 4 +- drivers/net/wireless/marvell/libertas/mesh.c | 5 +- .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 3 + drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 + drivers/net/xen-netfront.c | 46 +- drivers/nfc/nfcmrvl/uart.c | 3 + drivers/ntb/ntb_transport.c | 3 + drivers/nvdimm/blk.c | 3 +- drivers/nvdimm/btt.c | 3 +- drivers/nvdimm/region_devs.c | 5 +- drivers/nvme/host/core.c | 4 + drivers/nvme/host/pci.c | 13 +- drivers/pci/pci-label.c | 7 +- drivers/pci/pci.c | 48 +- drivers/pci/probe.c | 5 + drivers/pci/quirks.c | 4 +- drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 1 - drivers/platform/x86/acer-wmi.c | 7 + drivers/platform/x86/dell-laptop.c | 6 +- drivers/platform/x86/intel_telemetry_debugfs.c | 16 +- drivers/powercap/intel_rapl.c | 4 +- drivers/s390/block/dasd.c | 8 +- drivers/s390/block/dasd_devmap.c | 19 +- drivers/scsi/arm/fas216.c | 2 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 3 +- drivers/scsi/csiostor/csio_lnode.c | 43 +- drivers/scsi/lpfc/lpfc_attr.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 2 +- drivers/scsi/megaraid/megaraid_mm.c | 2 +- drivers/scsi/scsi_devinfo.c | 7 +- drivers/scsi/smartpqi/smartpqi_init.c | 7 +- drivers/scsi/sun_esp.c | 9 +- drivers/spi/spi-rockchip.c | 51 +- .../staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c | 2 + drivers/tty/serial/8250/8250_omap.c | 23 +- drivers/video/fbdev/efifb.c | 2 +- drivers/video/fbdev/vermilion/cr_pll.c | 1 + drivers/watchdog/sp5100_tco.h | 2 +- drivers/xen/grant-table.c | 4 +- fs/btrfs/ctree.c | 12 +- fs/btrfs/disk-io.c | 6 +- fs/btrfs/extent-tree.c | 19 +- fs/btrfs/file.c | 9 + fs/btrfs/inode.c | 5 +- fs/btrfs/raid56.c | 18 +- fs/btrfs/send.c | 35 +- fs/btrfs/volumes.c | 9 +- fs/cifs/cifssmb.c | 4 +- fs/dcache.c | 5 + fs/ext4/inode.c | 28 +- fs/f2fs/node.c | 14 +- fs/filesystems.c | 4 +- fs/jffs2/fs.c | 1 - fs/nfs/nfs4proc.c | 12 +- fs/nfs/nfs4state.c | 5 +- fs/nfs/nfs4sysctl.c | 2 +- fs/ocfs2/acl.c | 6 + fs/ocfs2/dlmglue.c | 4 + fs/ocfs2/journal.c | 23 +- fs/ocfs2/super.c | 5 +- fs/ocfs2/xattr.c | 25 +- fs/proc/base.c | 29 +- fs/proc/kcore.c | 4 + include/acpi/platform/acgcc.h | 10 + include/acpi/platform/acintel.h | 2 + include/asm-generic/pgtable.h | 15 + include/linux/bio.h | 4 +- include/linux/bvec.h | 14 +- include/linux/cpumask.h | 2 + include/linux/etherdevice.h | 2 +- include/linux/kcore.h | 1 + include/linux/of.h | 6 + include/linux/property.h | 10 +- include/linux/sched.h | 1 + include/linux/suspend.h | 2 + include/trace/events/timer.h | 20 +- kernel/events/core.c | 15 +- kernel/locking/qspinlock.c | 8 + kernel/power/power.h | 3 - kernel/rcu/update.c | 13 +- kernel/sched/core.c | 2 + kernel/sched/deadline.c | 98 +- kernel/sched/fair.c | 10 +- lib/dma-noop.c | 9 +- lib/test_bpf.c | 31 +- mm/fadvise.c | 10 +- mm/khugepaged.c | 12 +- mm/mempolicy.c | 33 +- mm/mmap.c | 4 + mm/vmscan.c | 14 +- net/bluetooth/hci_core.c | 17 +- net/bridge/br_fdb.c | 28 +- net/bridge/netfilter/ebt_nflog.c | 1 + net/caif/caif_socket.c | 4 + net/core/fib_rules.c | 21 +- net/dccp/ipv4.c | 17 +- net/hsr/hsr_forward.c | 3 +- net/hsr/hsr_framereg.c | 9 +- net/hsr/hsr_framereg.h | 2 +- net/ipv4/ip_tunnel.c | 2 + net/ipv4/tcp_nv.c | 2 +- net/ipv6/ip6_tunnel.c | 6 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 16 +- net/iucv/af_iucv.c | 8 +- net/openvswitch/conntrack.c | 34 + net/openvswitch/datapath.c | 81 +- net/rds/ib.c | 3 +- net/rds/tcp_listen.c | 19 +- net/sched/act_police.c | 8 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/socket.c | 4 +- net/sctp/transport.c | 2 + net/sunrpc/auth_gss/svcauth_gss.c | 8 + net/sunrpc/svc.c | 2 +- scripts/kconfig/expr.c | 2 +- scripts/kconfig/menu.c | 1 + scripts/kconfig/zconf.y | 33 +- security/keys/process_keys.c | 7 +- sound/core/timer.c | 4 + sound/hda/hdac_bus.c | 1 + sound/hda/hdac_device.c | 1 + sound/pci/hda/Kconfig | 1 - sound/pci/hda/patch_realtek.c | 5 + sound/soc/au1x/ac97c.c | 6 +- sound/soc/codecs/nau8825.c | 17 +- tools/lib/bpf/libbpf.c | 26 + tools/lib/traceevent/event-parse.c | 17 +- tools/lib/traceevent/parse-filter.c | 10 +- tools/perf/arch/x86/util/header.c | 2 +- tools/perf/tests/bpf-script-test-prologue.c | 9 + tools/perf/tests/code-reading.c | 20 +- tools/perf/tests/task-exit.c | 2 +- tools/perf/util/annotate.c | 10 +- tools/perf/util/dso.c | 16 + tools/perf/util/evsel.c | 21 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 14 + tools/perf/util/unwind-libunwind.c | 2 +- tools/testing/selftests/net/reuseport_bpf.c | 21 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 53 +- .../testing/selftests/timers/inconsistency-check.c | 4 +- tools/usb/usbip/libsrc/vhci_driver.c | 36 +- virt/kvm/kvm_main.c | 7 +- 303 files changed, 3910 insertions(+), 2172 deletions(-) -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlrTxjQACgkQ3qZv95d3 LNzkbA//Sr5wLao5qsRJ7EKLdO5KVA+beDFs7hKuN/bJ/cy6Hd+0K5tBtFv6/phZ WVz/OaKwQmJk7YxRA2Fs+fzGfHcDhdg35dlPemWotvyoYTj/GxgKFPHW83X40cpf e2vBK1NZT7lJk06X424zk6DxSXA089K1be6CXqudG2vAo9WaHSkAx+hY9Nvr0jWV W7NYeqRoBL6RASC2bGLHgU4LZROI9pM9xb45nLl8c6W3OpBxS331usYRqQfQ4WY0 etkSfBceNJRPksdh6wsBl7/OczN67yZp4OxSrcdBlbZ3jLsrn5Xz7++ZNJP4JmII n3HT3Eaerx2w2yDCvhgwnd0LdVGCJwhkPc3UqWtuuM9bqrD3OS6fPBftsAYCQja3 6Ys4HbcCb2vDEeXqqSk4UNtD2FUOe9r0tY0uJkxmAqLYctu4XPKblkqOl5FxBMiB s6NnGydUU5uMAKagjLyPqZSjFnAp2MNFiJFcTg5Dh3zVlVNsxbi6keCSrEbxyx5D Qfuf9Wc0WZA96mWp9ZUiUeGTdP+exWCZwTb6H4FmO/WADTGIhZfvz8LXXXu3Bwxp S8pyiPr+CjungOYGmKF6qNgHtieJ1sxmeZjZWi/FAvj34xSuT4R57bL+vHDMgZDa kL4vuS8g+VZULI3gHmUm0CaKRI/JFZUxx6r6I2L9FAf1ggtFc2g= =y7vw -----END PGP SIGNATURE-----

7 years, 4 months

2
1
0 0

Re: [PATCH] [SCSI] mpt3sas: Fix secure erase premature termination (v2)

by Steffen Maier

On 11/04/2016 05:35 PM, Martin K. Petersen wrote: >>>>>> "Hannes" == Hannes Reinecke <hare(a)suse.de> writes: > > Hannes> Checking with SAT-3 (section 6.2.4: Commands the SATL queues > Hannes> internally) the implemented behaviour is standards conformant, > Hannes> although the standard also allows for returning 'TASK SET FULL' > Hannes> or 'BUSY' in these cases. Doing so would nicely solve this > Hannes> issue. > > I agree with Hannes that it would be appropriate for the SATL to report > busy when it makes an non-queued command queueable. Wouldn't this potentially still cause problems if the secure erase takes longer than max_retries * scmd_tmo. I.e. the command timing out by default after 180 seconds as in https://www.spinics.net/lists/linux-block/msg24837.html ? The fix approach here seems to also handle this gracefully. -- Mit freundlichen Grüßen / Kind regards Steffen Maier Linux on z Systems Development IBM Deutschland Research & Development GmbH Vorsitzende des Aufsichtsrats: Martina Koederitz Geschaeftsfuehrung: Dirk Wittkopp Sitz der Gesellschaft: Boeblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

7 years, 4 months

2
1
0 0

[PATCH 0/3] musb fixes backport to v4.9+

by Bin Liu

Hi, Here are several patches backported to v4.9+ to fix runtime PM problems in musb drivers. Regards, -Bin. ---- Andreas Kemnade (1): usb: musb: fix enumeration after resume Merlijn Wajer (2): usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers usb: musb: Fix external abort in musb_remove on omap2430 drivers/usb/musb/musb_core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) -- 1.9.1

7 years, 4 months

2
4
0 0

[PATCH 1/7] ARM: dts: sun8i: h3: fix ALL-H3-CC H3 ver VCC-1V2 regulator voltage

by Chen-Yu Tsai

The voltage of the VCC-1V2 regulator on the ALL-H3-CC H3 ver. should be 1.2V, not the 3.3V currently defined in the device tree. Fix the voltage in the device tree. Fixes: 6ca358645d4d ("ARM: dts: sun8i: h3: Add dts file for Libre Computer Board ALL-H3-CC H3 ver.") Cc: <stable(a)vger.kernel.org> # 4.16.x Signed-off-by: Chen-Yu Tsai <wens(a)csie.org> --- arch/arm/boot/dts/sun8i-h3-libretech-all-h3-cc.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/boot/dts/sun8i-h3-libretech-all-h3-cc.dts b/arch/arm/boot/dts/sun8i-h3-libretech-all-h3-cc.dts index 5971b8b0b768..db6b35bb65ff 100644 --- a/arch/arm/boot/dts/sun8i-h3-libretech-all-h3-cc.dts +++ b/arch/arm/boot/dts/sun8i-h3-libretech-all-h3-cc.dts @@ -62,8 +62,8 @@ reg_vcc1v2: vcc1v2 { compatible = "regulator-fixed"; regulator-name = "vcc1v2"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; regulator-always-on; regulator-boot-on; vin-supply = <&reg_vcc5v0>; -- 2.17.0

7 years, 4 months

2
1
0 0

[PATCH] ALSA: dice: fix OUI for TC group

by Takashi Sakamoto

OUI for TC Electronic is 0x000166, for TC GROUP A/S. 0x001486 is for Echo Digital Audio Corporation. Fixes: 7cafc65b3aa1 ('ALSA: dice: force to add two pcm devices for listed models') Cc: <stable(a)vger.kernel.org> # v4.6+ Reference: http://standards-oui.ieee.org/oui/oui.txt Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/firewire/dice/dice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c index 4ddb4cdd054b..96bb01b6b751 100644 --- a/sound/firewire/dice/dice.c +++ b/sound/firewire/dice/dice.c @@ -14,7 +14,7 @@ MODULE_LICENSE("GPL v2"); #define OUI_WEISS 0x001c6a #define OUI_LOUD 0x000ff2 #define OUI_FOCUSRITE 0x00130e -#define OUI_TCELECTRONIC 0x001486 +#define OUI_TCELECTRONIC 0x000166 #define DICE_CATEGORY_ID 0x04 #define WEISS_CATEGORY_ID 0x00 -- 2.14.1

7 years, 4 months

2
1
0 0

[PATCH] drm/i915/bxt, glk: Increase PCODE timeouts during CDCLK freq changing

by Imre Deak

commit 5e1df40f40ee45a97bb1066c3d71f0ae920a9672 upstream. Currently we see sporadic timeouts during CDCLK changing both on BXT and GLK as reported by the Bugzilla: ticket. It's easy to reproduce this by changing the frequency in a tight loop after blanking the display. The upper bound for the completion time is 800us based on my tests, so increase it from the current 500us to 2ms; with that I couldn't trigger the problem either on BXT or GLK. Note that timeouts happened during both the change notification and the voltage level setting PCODE request. (For the latter one BSpec doesn't require us to wait for completion before further HW programming.) This issue is similar to commit 2c7d0602c815 ("drm/i915/gen9: Fix PCODE polling during CDCLK change notification") but there the PCODE request does complete (as shown by the mbox busy flag), only the reply we get from PCODE indicates a failure. So there we keep resending the request until a success reply, here we just have to increase the timeout for the one PCODE request we send. v2: - s/snb_pcode_request/sandybridge_pcode_write_timeout/ (Ville) Cc: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v4.14 Acked-by: Chris Wilson <chris(a)chris-wilson.co.uk> (v1) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103326 Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Signed-off-by: Imre Deak <imre.deak(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20180130142939.17983-1-imre.d… (cherry picked from commit e76019a81921e87a4d9e7b3d86102bc708a6c227) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> (Rebased for v4.14 stable tree due to upstream cdclk_state and pcu_lock change) Signed-off-by: Imre Deak <imre.deak(a)intel.com> --- drivers/gpu/drm/i915/i915_drv.h | 6 +++++- drivers/gpu/drm/i915/intel_cdclk.c | 22 +++++++++++++++++----- drivers/gpu/drm/i915/intel_pm.c | 6 +++--- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index 3f818412765c..51411894d2cd 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -3995,7 +3995,11 @@ extern void intel_display_print_error_state(struct drm_i915_error_state_buf *e, struct intel_display_error_state *error); int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val); -int sandybridge_pcode_write(struct drm_i915_private *dev_priv, u32 mbox, u32 val); +int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, u32 mbox, + u32 val, int timeout_us); +#define sandybridge_pcode_write(dev_priv, mbox, val) \ + sandybridge_pcode_write_timeout(dev_priv, mbox, val, 500) + int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request, u32 reply_mask, u32 reply, int timeout_base_ms); diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c index 26a8dcd2c549..47ad24229c78 100644 --- a/drivers/gpu/drm/i915/intel_cdclk.c +++ b/drivers/gpu/drm/i915/intel_cdclk.c @@ -1289,10 +1289,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, break; } - /* Inform power controller of upcoming frequency change */ mutex_lock(&dev_priv->rps.hw_lock); - ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, - 0x80000000); + /* + * Inform power controller of upcoming frequency change. BSpec + * requires us to wait up to 150usec, but that leads to timeouts; + * the 2ms used here is based on experiment. + */ + ret = sandybridge_pcode_write_timeout(dev_priv, + HSW_PCODE_DE_WRITE_FREQ_REQ, + 0x80000000, 2000); mutex_unlock(&dev_priv->rps.hw_lock); if (ret) { @@ -1323,8 +1328,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, I915_WRITE(CDCLK_CTL, val); mutex_lock(&dev_priv->rps.hw_lock); - ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, - DIV_ROUND_UP(cdclk, 25000)); + /* + * The timeout isn't specified, the 2ms used here is based on + * experiment. + * FIXME: Waiting for the request completion could be delayed until + * the next PCODE request based on BSpec. + */ + ret = sandybridge_pcode_write_timeout(dev_priv, + HSW_PCODE_DE_WRITE_FREQ_REQ, + DIV_ROUND_UP(cdclk, 25000), 2000); mutex_unlock(&dev_priv->rps.hw_lock); if (ret) { diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c index 014e5c08571a..87cccb5f8c5d 100644 --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -8941,8 +8941,8 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val return 0; } -int sandybridge_pcode_write(struct drm_i915_private *dev_priv, - u32 mbox, u32 val) +int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, + u32 mbox, u32 val, int timeout_us) { int status; @@ -8965,7 +8965,7 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv, if (__intel_wait_for_register_fw(dev_priv, GEN6_PCODE_MAILBOX, GEN6_PCODE_READY, 0, - 500, 0, NULL)) { + timeout_us, 0, NULL)) { DRM_ERROR("timeout waiting for pcode write of 0x%08x to mbox %x to finish for %ps\n", val, mbox, __builtin_return_address(0)); return -ETIMEDOUT; -- 2.13.2

7 years, 4 months

2
1
0 0

[PULL 1/1] vfio: ccw: fix cleanup if cp_prefetch fails

by Cornelia Huck

From: Halil Pasic <pasic(a)linux.vnet.ibm.com> If the translation of a channel program fails, we may end up attempting to clean up (free, unpin) stuff that never got translated (and allocated, pinned) in the first place. By adjusting the lengths of the chains accordingly (so the element that failed, and all subsequent elements are excluded) cleanup activities based on false assumptions can be avoided. Let's make sure cp_free works properly after cp_prefetch returns with an error by setting ch_len of a ccw chain to the number of the translated CCWs on that chain. Cc: stable(a)vger.kernel.org #v4.12+ Acked-by: Pierre Morel <pmorel(a)linux.vnet.ibm.com> Reviewed-by: Dong Jia Shi <bjsdjshi(a)linux.vnet.ibm.com> Signed-off-by: Halil Pasic <pasic(a)linux.vnet.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi(a)linux.vnet.ibm.com> Message-Id: <20180423110113.59385-2-bjsdjshi(a)linux.vnet.ibm.com> [CH: fixed typos] Signed-off-by: Cornelia Huck <cohuck(a)redhat.com> --- drivers/s390/cio/vfio_ccw_cp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 2c7550797ec2..dce92b2a895d 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -715,6 +715,10 @@ void cp_free(struct channel_program *cp) * and stores the result to ccwchain list. @cp must have been * initialized by a previous call with cp_init(). Otherwise, undefined * behavior occurs. + * For each chain composing the channel program: + * - On entry ch_len holds the count of CCWs to be translated. + * - On exit ch_len is adjusted to the count of successfully translated CCWs. + * This allows cp_free to find in ch_len the count of CCWs to free in a chain. * * The S/390 CCW Translation APIS (prefixed by 'cp_') are introduced * as helpers to do ccw chain translation inside the kernel. Basically @@ -749,11 +753,18 @@ int cp_prefetch(struct channel_program *cp) for (idx = 0; idx < len; idx++) { ret = ccwchain_fetch_one(chain, idx, cp); if (ret) - return ret; + goto out_err; } } return 0; +out_err: + /* Only cleanup the chain elements that were actually translated. */ + chain->ch_len = idx; + list_for_each_entry_continue(chain, &cp->ccwchain_list, next) { + chain->ch_len = 0; + } + return ret; } /** -- 2.14.3

7 years, 4 months

1
0
0 0

v4.4.129 build: 0 failures 0 warnings (v4.4.129)

by Build bot for Mark Brown

Tree/Branch: v4.4.129 Git describe: v4.4.129 Commit: 8e2def054b Linux 4.4.129 Build Time: 60 min 23 sec Passed: 10 / 10 (100.00 %) Failed: 0 / 10 ( 0.00 %) Errors: 0 Warnings: 0 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): ------------------------------------------------------------------------------- =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allmodconfig arm-allnoconfig x86_64-allnoconfig x86_64-allmodconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

7 years, 4 months

1
0
0 0

[PATCH v2] cpufreq: armada-37xx: driver relies on cpufreq-dt

by Miquel Raynal

Armada-37xx driver registers a cpufreq-dt driver. Not having CONFIG_CPUFREQ_DT selected leads to a silent abort during the probe. Prevent that situation by having the former depending on the latter. Fixes: 92ce45fb875d7 ("cpufreq: Add DVFS support for Armada 37xx") Cc: stable(a)vger.kernel.org Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> --- Changes since v1 ================ * Changed 'select' by 'depends on' * Added Fixes + Cc: stable tags drivers/cpufreq/Kconfig.arm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm index 7f56fe5183f2..2c64ee68ea8b 100644 --- a/drivers/cpufreq/Kconfig.arm +++ b/drivers/cpufreq/Kconfig.arm @@ -20,7 +20,7 @@ config ACPI_CPPC_CPUFREQ config ARM_ARMADA_37XX_CPUFREQ tristate "Armada 37xx CPUFreq support" - depends on ARCH_MVEBU + depends on ARCH_MVEBU && CPUFREQ_DT help This adds the CPUFreq driver support for Marvell Armada 37xx SoCs. The Armada 37xx PMU supports 4 frequency and VDD levels. -- 2.14.1

7 years, 4 months

2
1
0 0

[PATCH v2] rtlwifi: cleanup 8723be ant_sel definition

by pkshih＠realtek.com

From: Ping-Ke Shih <pkshih(a)realtek.com> The module parameter ant_sel is used to control antenna number and path. There is an existing enum ANT_{X2,X1} defined the antenna number, so add a new enum ANT_{MAIN,AUX} to make it readable. After this work, incorrect given values depend on ant_sel were exposed, so refill values according following definition: ant_sel ant_num ant_path print_label 1 ANT_X1 ANT_AUX #2 2 ANT_X2 ANT_MAIN #1 Then, a workaround resulted from the incorrect values in halbtcoutsrc.c was removed. These is a existing bug in the workaround while ant_sel=2, but the case is rare use so user is hard to observe this bug. The experimental results with single antenna connected to specific path are in following: ant_sel ANT_MAIN(#1) ANT_AUX(#2) 0 -8 -62 1 -62 -10 2 -6 -60 Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Cc: Stable <stable(a)vger.kernel.org> # 4.7+ Reviewed-by: Larry Finger <Larry.Finger(a)lwfinger.net> --- v2: Add more description about fixed bugs in end of first paragraph. --- .../net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 15 --------------- drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 11 +++++++---- drivers/net/wireless/realtek/rtlwifi/wifi.h | 5 +++++ 3 files changed, 12 insertions(+), 19 deletions(-) diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c index e0f9985582f9..738a7ea7dc4a 100644 --- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c @@ -158,16 +158,6 @@ static u8 halbtc_get_wifi_central_chnl(struct btc_coexist *btcoexist) static u8 rtl_get_hwpg_single_ant_path(struct rtl_priv *rtlpriv) { - struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; - - /* override ant_num / ant_path */ - if (mod_params->ant_sel) { - rtlpriv->btcoexist.btc_info.ant_num = - (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); - - rtlpriv->btcoexist.btc_info.single_ant_path = - (mod_params->ant_sel == 1 ? 0 : 1); - } return rtlpriv->btcoexist.btc_info.single_ant_path; } @@ -178,7 +168,6 @@ static u8 rtl_get_hwpg_bt_type(struct rtl_priv *rtlpriv) static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv) { - struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; u8 num; if (rtlpriv->btcoexist.btc_info.ant_num == ANT_X2) @@ -186,10 +175,6 @@ static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv) else num = 1; - /* override ant_num / ant_path */ - if (mod_params->ant_sel) - num = (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1) + 1; - return num; } diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c index e7bbbc95cdb1..b4f3f91b590e 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c @@ -848,6 +848,9 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw) return false; } + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv); + bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL); rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3)); @@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B; rtlpriv->btcoexist.btc_info.ant_num = (value & 0x1); rtlpriv->btcoexist.btc_info.single_ant_path = - (value & 0x40); /*0xc3[6]*/ + (value & 0x40 ? ANT_AUX : ANT_MAIN); /*0xc3[6]*/ } else { rtlpriv->btcoexist.btc_info.btcoexist = 0; rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B; rtlpriv->btcoexist.btc_info.ant_num = ANT_X2; - rtlpriv->btcoexist.btc_info.single_ant_path = 0; + rtlpriv->btcoexist.btc_info.single_ant_path = ANT_MAIN; } /* override ant_num / ant_path */ if (mod_params->ant_sel) { rtlpriv->btcoexist.btc_info.ant_num = - (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); + (mod_params->ant_sel == 1 ? ANT_X1 : ANT_X2); rtlpriv->btcoexist.btc_info.single_ant_path = - (mod_params->ant_sel == 1 ? 0 : 1); + (mod_params->ant_sel == 1 ? ANT_AUX : ANT_MAIN); } } diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h index c32985cfe48d..ab32a62ead81 100644 --- a/drivers/net/wireless/realtek/rtlwifi/wifi.h +++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h @@ -2882,6 +2882,11 @@ enum bt_ant_num { ANT_X1 = 1, }; +enum bt_ant_path { + ANT_MAIN = 0, + ANT_AUX = 1, +}; + enum bt_co_type { BT_2WIRE = 0, BT_ISSC_3WIRE = 1, -- 2.15.1

7 years, 4 months

4
6
0 0

FAILED: patch "[PATCH] drm/amd/display: Don't program bypass on linear regamma LUT" failed to apply to 4.16-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.16-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d78fd7255881645fc645e23145d469385227170d Mon Sep 17 00:00:00 2001 From: Harry Wentland <harry.wentland(a)amd.com> Date: Thu, 12 Apr 2018 16:37:09 -0400 Subject: [PATCH] drm/amd/display: Don't program bypass on linear regamma LUT Even though this is required for degamma since DCE HW only supports a couple predefined LUTs we can just program the LUT directly for regamma. This fixes dark screens which occurs when we program regamma to bypass while degamma is using srgb LUT. Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Reviewed-by: Leo Li <sunpeng.li(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c index f6cb502c303f..25f064c01038 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c @@ -138,13 +138,6 @@ int amdgpu_dm_set_regamma_lut(struct dm_crtc_state *crtc) lut = (struct drm_color_lut *)blob->data; lut_size = blob->length / sizeof(struct drm_color_lut); - if (__is_lut_linear(lut, lut_size)) { - /* Set to bypass if lut is set to linear */ - stream->out_transfer_func->type = TF_TYPE_BYPASS; - stream->out_transfer_func->tf = TRANSFER_FUNCTION_LINEAR; - return 0; - } - gamma = dc_create_gamma(); if (!gamma) return -ENOMEM;

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d6ef1f194b7569af8b8397876dc9ab07649d63cb Mon Sep 17 00:00:00 2001 From: Joerg Roedel <jroedel(a)suse.de> Date: Tue, 17 Apr 2018 15:27:16 +0200 Subject: [PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y The walk_pte_level() function just uses __va to get the virtual address of the PTE page, but that breaks when the PTE page is not in the direct mapping with HIGHPTE=y. The result is an unhandled kernel paging request at some random address when accessing the current_kernel or current_user file. Use the correct API to access PTE pages. Fixes: fe770bf0310d ('x86: clean up the page table dumper and add 32-bit support') Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Cc: jgross(a)suse.com Cc: JBeulich(a)suse.com Cc: hpa(a)zytor.com Cc: aryabinin(a)virtuozzo.com Cc: kirill.shutemov(a)linux.intel.com Link: https://lkml.kernel.org/r/1523971636-4137-1-git-send-email-joro@8bytes.org diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c index 62a7e9f65dec..cc7ff5957194 100644 --- a/arch/x86/mm/dump_pagetables.c +++ b/arch/x86/mm/dump_pagetables.c @@ -18,6 +18,7 @@ #include <linux/init.h> #include <linux/sched.h> #include <linux/seq_file.h> +#include <linux/highmem.h> #include <asm/pgtable.h> @@ -334,16 +335,16 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, pgprotval_t eff_in, unsigned long P) { int i; - pte_t *start; + pte_t *pte; pgprotval_t prot, eff; - start = (pte_t *)pmd_page_vaddr(addr); for (i = 0; i < PTRS_PER_PTE; i++) { - prot = pte_flags(*start); - eff = effective_prot(eff_in, prot); st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT); + pte = pte_offset_map(&addr, st->current_address); + prot = pte_flags(*pte); + eff = effective_prot(eff_in, prot); note_page(m, st, __pgprot(prot), eff, 5); - start++; + pte_unmap(pte); } } #ifdef CONFIG_KASAN

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d6ef1f194b7569af8b8397876dc9ab07649d63cb Mon Sep 17 00:00:00 2001 From: Joerg Roedel <jroedel(a)suse.de> Date: Tue, 17 Apr 2018 15:27:16 +0200 Subject: [PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y The walk_pte_level() function just uses __va to get the virtual address of the PTE page, but that breaks when the PTE page is not in the direct mapping with HIGHPTE=y. The result is an unhandled kernel paging request at some random address when accessing the current_kernel or current_user file. Use the correct API to access PTE pages. Fixes: fe770bf0310d ('x86: clean up the page table dumper and add 32-bit support') Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Cc: jgross(a)suse.com Cc: JBeulich(a)suse.com Cc: hpa(a)zytor.com Cc: aryabinin(a)virtuozzo.com Cc: kirill.shutemov(a)linux.intel.com Link: https://lkml.kernel.org/r/1523971636-4137-1-git-send-email-joro@8bytes.org diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c index 62a7e9f65dec..cc7ff5957194 100644 --- a/arch/x86/mm/dump_pagetables.c +++ b/arch/x86/mm/dump_pagetables.c @@ -18,6 +18,7 @@ #include <linux/init.h> #include <linux/sched.h> #include <linux/seq_file.h> +#include <linux/highmem.h> #include <asm/pgtable.h> @@ -334,16 +335,16 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, pgprotval_t eff_in, unsigned long P) { int i; - pte_t *start; + pte_t *pte; pgprotval_t prot, eff; - start = (pte_t *)pmd_page_vaddr(addr); for (i = 0; i < PTRS_PER_PTE; i++) { - prot = pte_flags(*start); - eff = effective_prot(eff_in, prot); st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT); + pte = pte_offset_map(&addr, st->current_address); + prot = pte_flags(*pte); + eff = effective_prot(eff_in, prot); note_page(m, st, __pgprot(prot), eff, 5); - start++; + pte_unmap(pte); } } #ifdef CONFIG_KASAN

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d6ef1f194b7569af8b8397876dc9ab07649d63cb Mon Sep 17 00:00:00 2001 From: Joerg Roedel <jroedel(a)suse.de> Date: Tue, 17 Apr 2018 15:27:16 +0200 Subject: [PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y The walk_pte_level() function just uses __va to get the virtual address of the PTE page, but that breaks when the PTE page is not in the direct mapping with HIGHPTE=y. The result is an unhandled kernel paging request at some random address when accessing the current_kernel or current_user file. Use the correct API to access PTE pages. Fixes: fe770bf0310d ('x86: clean up the page table dumper and add 32-bit support') Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Cc: jgross(a)suse.com Cc: JBeulich(a)suse.com Cc: hpa(a)zytor.com Cc: aryabinin(a)virtuozzo.com Cc: kirill.shutemov(a)linux.intel.com Link: https://lkml.kernel.org/r/1523971636-4137-1-git-send-email-joro@8bytes.org diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c index 62a7e9f65dec..cc7ff5957194 100644 --- a/arch/x86/mm/dump_pagetables.c +++ b/arch/x86/mm/dump_pagetables.c @@ -18,6 +18,7 @@ #include <linux/init.h> #include <linux/sched.h> #include <linux/seq_file.h> +#include <linux/highmem.h> #include <asm/pgtable.h> @@ -334,16 +335,16 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, pgprotval_t eff_in, unsigned long P) { int i; - pte_t *start; + pte_t *pte; pgprotval_t prot, eff; - start = (pte_t *)pmd_page_vaddr(addr); for (i = 0; i < PTRS_PER_PTE; i++) { - prot = pte_flags(*start); - eff = effective_prot(eff_in, prot); st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT); + pte = pte_offset_map(&addr, st->current_address); + prot = pte_flags(*pte); + eff = effective_prot(eff_in, prot); note_page(m, st, __pgprot(prot), eff, 5); - start++; + pte_unmap(pte); } } #ifdef CONFIG_KASAN

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y" failed to apply to 4.16-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.16-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From d6ef1f194b7569af8b8397876dc9ab07649d63cb Mon Sep 17 00:00:00 2001 From: Joerg Roedel <jroedel(a)suse.de> Date: Tue, 17 Apr 2018 15:27:16 +0200 Subject: [PATCH] x86/mm: Prevent kernel Oops in PTDUMP code with HIGHPTE=y The walk_pte_level() function just uses __va to get the virtual address of the PTE page, but that breaks when the PTE page is not in the direct mapping with HIGHPTE=y. The result is an unhandled kernel paging request at some random address when accessing the current_kernel or current_user file. Use the correct API to access PTE pages. Fixes: fe770bf0310d ('x86: clean up the page table dumper and add 32-bit support') Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Cc: jgross(a)suse.com Cc: JBeulich(a)suse.com Cc: hpa(a)zytor.com Cc: aryabinin(a)virtuozzo.com Cc: kirill.shutemov(a)linux.intel.com Link: https://lkml.kernel.org/r/1523971636-4137-1-git-send-email-joro@8bytes.org diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c index 62a7e9f65dec..cc7ff5957194 100644 --- a/arch/x86/mm/dump_pagetables.c +++ b/arch/x86/mm/dump_pagetables.c @@ -18,6 +18,7 @@ #include <linux/init.h> #include <linux/sched.h> #include <linux/seq_file.h> +#include <linux/highmem.h> #include <asm/pgtable.h> @@ -334,16 +335,16 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, pgprotval_t eff_in, unsigned long P) { int i; - pte_t *start; + pte_t *pte; pgprotval_t prot, eff; - start = (pte_t *)pmd_page_vaddr(addr); for (i = 0; i < PTRS_PER_PTE; i++) { - prot = pte_flags(*start); - eff = effective_prot(eff_in, prot); st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT); + pte = pte_offset_map(&addr, st->current_address); + prot = pte_flags(*pte); + eff = effective_prot(eff_in, prot); note_page(m, st, __pgprot(prot), eff, 5); - start++; + pte_unmap(pte); } } #ifdef CONFIG_KASAN

7 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: Fix race condition between delayed refs and blockgroup" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 5e388e95815408c27f3612190d089afc0774b870 Mon Sep 17 00:00:00 2001 From: Nikolay Borisov <nborisov(a)suse.com> Date: Wed, 18 Apr 2018 09:41:54 +0300 Subject: [PATCH] btrfs: Fix race condition between delayed refs and blockgroup removal When the delayed refs for a head are all run, eventually cleanup_ref_head is called which (in case of deletion) obtains a reference for the relevant btrfs_space_info struct by querying the bg for the range. This is problematic because when the last extent of a bg is deleted a race window emerges between removal of that bg and the subsequent invocation of cleanup_ref_head. This can result in cache being null and either a null pointer dereference or assertion failure. task: ffff8d04d31ed080 task.stack: ffff9e5dc10cc000 RIP: 0010:assfail.constprop.78+0x18/0x1a [btrfs] RSP: 0018:ffff9e5dc10cfbe8 EFLAGS: 00010292 RAX: 0000000000000044 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff8d04ffc1f868 RSI: ffff8d04ffc178c8 RDI: ffff8d04ffc178c8 RBP: ffff8d04d29e5ea0 R08: 00000000000001f0 R09: 0000000000000001 R10: ffff9e5dc0507d58 R11: 0000000000000001 R12: ffff8d04d29e5ea0 R13: ffff8d04d29e5f08 R14: ffff8d04efe29b40 R15: ffff8d04efe203e0 FS: 00007fbf58ead500(0000) GS:ffff8d04ffc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe6c6975648 CR3: 0000000013b2a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __btrfs_run_delayed_refs+0x10e7/0x12c0 [btrfs] btrfs_run_delayed_refs+0x68/0x250 [btrfs] btrfs_should_end_transaction+0x42/0x60 [btrfs] btrfs_truncate_inode_items+0xaac/0xfc0 [btrfs] btrfs_evict_inode+0x4c6/0x5c0 [btrfs] evict+0xc6/0x190 do_unlinkat+0x19c/0x300 do_syscall_64+0x74/0x140 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x7fbf589c57a7 To fix this, introduce a new flag "is_system" to head_ref structs, which is populated at insertion time. This allows to decouple the querying for the spaceinfo from querying the possibly deleted bg. Fixes: d7eae3403f46 ("Btrfs: rework delayed ref total_bytes_pinned accounting") CC: stable(a)vger.kernel.org # 4.14+ Suggested-by: Omar Sandoval <osandov(a)osandov.com> Signed-off-by: Nikolay Borisov <nborisov(a)suse.com> Reviewed-by: Omar Sandoval <osandov(a)fb.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 9e98295de7ce..e1b0651686f7 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -540,8 +540,10 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info, struct btrfs_delayed_ref_head *head_ref, struct btrfs_qgroup_extent_record *qrecord, u64 bytenr, u64 num_bytes, u64 ref_root, u64 reserved, - int action, int is_data, int *qrecord_inserted_ret, + int action, int is_data, int is_system, + int *qrecord_inserted_ret, int *old_ref_mod, int *new_ref_mod) + { struct btrfs_delayed_ref_head *existing; struct btrfs_delayed_ref_root *delayed_refs; @@ -585,6 +587,7 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info, head_ref->ref_mod = count_mod; head_ref->must_insert_reserved = must_insert_reserved; head_ref->is_data = is_data; + head_ref->is_system = is_system; head_ref->ref_tree = RB_ROOT; INIT_LIST_HEAD(&head_ref->ref_add_list); RB_CLEAR_NODE(&head_ref->href_node); @@ -772,6 +775,7 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info, struct btrfs_delayed_ref_root *delayed_refs; struct btrfs_qgroup_extent_record *record = NULL; int qrecord_inserted; + int is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID); BUG_ON(extent_op && extent_op->is_data); ref = kmem_cache_alloc(btrfs_delayed_tree_ref_cachep, GFP_NOFS); @@ -800,8 +804,8 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info, */ head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record, bytenr, num_bytes, 0, 0, action, 0, - &qrecord_inserted, old_ref_mod, - new_ref_mod); + is_system, &qrecord_inserted, + old_ref_mod, new_ref_mod); add_delayed_tree_ref(fs_info, trans, head_ref, &ref->node, bytenr, num_bytes, parent, ref_root, level, action); @@ -868,7 +872,7 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info, */ head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record, bytenr, num_bytes, ref_root, reserved, - action, 1, &qrecord_inserted, + action, 1, 0, &qrecord_inserted, old_ref_mod, new_ref_mod); add_delayed_data_ref(fs_info, trans, head_ref, &ref->node, bytenr, @@ -898,9 +902,14 @@ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info, delayed_refs = &trans->transaction->delayed_refs; spin_lock(&delayed_refs->lock); + /* + * extent_ops just modify the flags of an extent and they don't result + * in ref count changes, hence it's safe to pass false/0 for is_system + * argument + */ add_delayed_ref_head(fs_info, trans, head_ref, NULL, bytenr, num_bytes, 0, 0, BTRFS_UPDATE_DELAYED_HEAD, - extent_op->is_data, NULL, NULL, NULL); + extent_op->is_data, 0, NULL, NULL, NULL); spin_unlock(&delayed_refs->lock); return 0; diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h index 741869dbc316..7f00db50bd24 100644 --- a/fs/btrfs/delayed-ref.h +++ b/fs/btrfs/delayed-ref.h @@ -127,6 +127,7 @@ struct btrfs_delayed_ref_head { */ unsigned int must_insert_reserved:1; unsigned int is_data:1; + unsigned int is_system:1; unsigned int processing:1; }; diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 055494ddcace..f99102063366 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -2601,13 +2601,19 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans, trace_run_delayed_ref_head(fs_info, head, 0); if (head->total_ref_mod < 0) { - struct btrfs_block_group_cache *cache; + struct btrfs_space_info *space_info; + u64 flags; - cache = btrfs_lookup_block_group(fs_info, head->bytenr); - ASSERT(cache); - percpu_counter_add(&cache->space_info->total_bytes_pinned, + if (head->is_data) + flags = BTRFS_BLOCK_GROUP_DATA; + else if (head->is_system) + flags = BTRFS_BLOCK_GROUP_SYSTEM; + else + flags = BTRFS_BLOCK_GROUP_METADATA; + space_info = __find_space_info(fs_info, flags); + ASSERT(space_info); + percpu_counter_add(&space_info->total_bytes_pinned, -head->num_bytes); - btrfs_put_block_group(cache); if (head->is_data) { spin_lock(&delayed_refs->lock);

7 years, 4 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror