aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-02-03netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()Taehee Yoo1-1/+1
When netdevsim dev is being created, a debugfs directory is created. The variable "dev_ddir_name" is 16bytes device name pointer and device name is "netdevsim<dev id>". The maximum dev id length is 10. So, 16bytes for device name isn't enough. Test commands: modprobe netdevsim echo "1000000000 0" > /sys/bus/netdevsim/new_device Splat looks like: [ 249.622710][ T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880 [ 249.623658][ T900] Write of size 1 at addr ffff88804c527988 by task bash/900 [ 249.624521][ T900] [ 249.624830][ T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322 [ 249.625691][ T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 249.626712][ T900] Call Trace: [ 249.627103][ T900] dump_stack+0x96/0xdb [ 249.627639][ T900] ? number+0x824/0x880 [ 249.628173][ T900] print_address_description.constprop.5+0x1be/0x360 [ 249.629022][ T900] ? number+0x824/0x880 [ 249.629569][ T900] ? number+0x824/0x880 [ 249.630105][ T900] __kasan_report+0x12a/0x170 [ 249.630717][ T900] ? number+0x824/0x880 [ 249.631201][ T900] kasan_report+0xe/0x20 [ 249.631723][ T900] number+0x824/0x880 [ 249.632235][ T900] ? put_dec+0xa0/0xa0 [ 249.632716][ T900] ? rcu_read_lock_sched_held+0x90/0xc0 [ 249.633392][ T900] vsnprintf+0x63c/0x10b0 [ 249.633983][ T900] ? pointer+0x5b0/0x5b0 [ 249.634543][ T900] ? mark_lock+0x11d/0xc40 [ 249.635200][ T900] sprintf+0x9b/0xd0 [ 249.635750][ T900] ? scnprintf+0xe0/0xe0 [ 249.636370][ T900] nsim_dev_probe+0x63c/0xbf0 [netdevsim] [ ... ] Reviewed-by: Jakub Kicinski <[email protected]> Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology") Signed-off-by: Taehee Yoo <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03netdevsim: fix panic in nsim_dev_take_snapshot_write()Taehee Yoo2-2/+12
nsim_dev_take_snapshot_write() uses nsim_dev and nsim_dev->dummy_region. So, during this function, these data shouldn't be removed. But there is no protecting stuff in this function. There are two similar cases. 1. reload case reload could be called during nsim_dev_take_snapshot_write(). When reload is being executed, nsim_dev_reload_down() is called and it calls nsim_dev_reload_destroy(). nsim_dev_reload_destroy() calls devlink_region_destroy() to destroy nsim_dev->dummy_region. So, during nsim_dev_take_snapshot_write(), nsim_dev->dummy_region() would be removed. At this point, snapshot_write() would access freed pointer. In order to fix this case, take_snapshot file will be removed before devlink_region_destroy(). The take_snapshot file will be re-created by ->reload_up(). 2. del_device_store case del_device_store() also could call nsim_dev_reload_destroy() during nsim_dev_take_snapshot_write(). If so, panic would occur. This problem is actually the same problem with the first case. So, this problem will be fixed by the first case's solution. Test commands: modprobe netdevsim while : do echo 1 > /sys/bus/netdevsim/new_device & echo 1 > /sys/bus/netdevsim/del_device & devlink dev reload netdevsim/netdevsim1 & echo 1 > /sys/kernel/debug/netdevsim/netdevsim1/take_snapshot & done Splat looks like: [ 45.564513][ T975] general protection fault, probably for non-canonical address 0xdffffc000000003a: 0000 [#1] SMP DEI [ 45.566131][ T975] KASAN: null-ptr-deref in range [0x00000000000001d0-0x00000000000001d7] [ 45.566135][ T975] CPU: 1 PID: 975 Comm: bash Not tainted 5.5.0+ #322 [ 45.569020][ T975] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 45.569026][ T975] RIP: 0010:__mutex_lock+0x10a/0x14b0 [ 45.570518][ T975] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f [ 45.570522][ T975] RSP: 0018:ffff888046ccfbf0 EFLAGS: 00010206 [ 45.572305][ T975] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 45.572308][ T975] RDX: 000000000000003a RSI: ffffffffac926440 RDI: 00000000000001d0 [ 45.576843][ T975] RBP: ffff888046ccfd70 R08: ffffffffab610645 R09: 0000000000000000 [ 45.576847][ T975] R10: ffff888046ccfd90 R11: ffffed100d6360ad R12: 0000000000000000 [ 45.578471][ T975] R13: dffffc0000000000 R14: ffffffffae1976c0 R15: 0000000000000168 [ 45.578475][ T975] FS: 00007f614d6e7740(0000) GS:ffff88806c400000(0000) knlGS:0000000000000000 [ 45.581492][ T975] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.582942][ T975] CR2: 00005618677d1cf0 CR3: 000000005fb9c002 CR4: 00000000000606e0 [ 45.584543][ T975] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.586633][ T975] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.589889][ T975] Call Trace: [ 45.591445][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 [ 45.601250][ T975] ? mutex_lock_io_nested+0x1380/0x1380 [ 45.602817][ T975] ? mutex_lock_io_nested+0x1380/0x1380 [ 45.603875][ T975] ? mark_held_locks+0xa5/0xe0 [ 45.604769][ T975] ? _raw_spin_unlock_irqrestore+0x2d/0x50 [ 45.606147][ T975] ? __mutex_unlock_slowpath+0xd0/0x670 [ 45.607723][ T975] ? crng_backtrack_protect+0x80/0x80 [ 45.613530][ T975] ? wait_for_completion+0x390/0x390 [ 45.615152][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 [ 45.616834][ T975] devlink_region_snapshot_create+0x55/0x4a0 [ ... ] Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots") Signed-off-by: Taehee Yoo <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03netdevsim: disable devlink reload when resources are being usedTaehee Yoo2-0/+21
devlink reload destroys resources and allocates resources again. So, when devices and ports resources are being used, devlink reload function should not be executed. In order to avoid this race, a new lock is added and new_port() and del_port() call devlink_reload_disable() and devlink_reload_enable(). Thread0 Thread1 {new/del}_port() {new/del}_port() devlink_reload_disable() devlink_reload_disable() devlink_reload_enable() //here devlink_reload_enable() Before Thread1's devlink_reload_enable(), the devlink is already allowed to execute reload because Thread0 allows it. devlink reload disable/enable variable type is bool. So the above case would exist. So, disable/enable should be executed atomically. In order to do that, a new lock is used. Test commands: modprobe netdevsim echo 1 > /sys/bus/netdevsim/new_device while : do echo 1 > /sys/devices/netdevsim1/new_port & echo 1 > /sys/devices/netdevsim1/del_port & devlink dev reload netdevsim/netdevsim1 & done Splat looks like: [ 23.342145][ T932] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) [ 23.342159][ T932] WARNING: CPU: 0 PID: 932 at kernel/locking/mutex-debug.c:103 mutex_destroy+0xc7/0xf0 [ 23.344182][ T932] Modules linked in: netdevsim openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_dx [ 23.346485][ T932] CPU: 0 PID: 932 Comm: devlink Not tainted 5.5.0+ #322 [ 23.347696][ T932] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 23.348893][ T932] RIP: 0010:mutex_destroy+0xc7/0xf0 [ 23.349505][ T932] Code: e0 07 83 c0 03 38 d0 7c 04 84 d2 75 2e 8b 05 00 ac b0 02 85 c0 75 8b 48 c7 c6 00 5e 07 96 40 [ 23.351887][ T932] RSP: 0018:ffff88806208f810 EFLAGS: 00010286 [ 23.353963][ T932] RAX: dffffc0000000008 RBX: ffff888067f6f2c0 RCX: ffffffff942c4bd4 [ 23.355222][ T932] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff96dac5b4 [ 23.356169][ T932] RBP: ffff888067f6f000 R08: fffffbfff2d235a5 R09: fffffbfff2d235a5 [ 23.357160][ T932] R10: 0000000000000001 R11: fffffbfff2d235a4 R12: ffff888067f6f208 [ 23.358288][ T932] R13: ffff88806208fa70 R14: ffff888067f6f000 R15: ffff888069ce3800 [ 23.359307][ T932] FS: 00007fe2a3876740(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000 [ 23.360473][ T932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.361319][ T932] CR2: 00005561357aa000 CR3: 000000005227a006 CR4: 00000000000606f0 [ 23.362323][ T932] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.363417][ T932] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.364414][ T932] Call Trace: [ 23.364828][ T932] nsim_dev_reload_destroy+0x77/0xb0 [netdevsim] [ 23.365655][ T932] nsim_dev_reload_down+0x84/0xb0 [netdevsim] [ 23.366433][ T932] devlink_reload+0xb1/0x350 [ 23.367010][ T932] genl_rcv_msg+0x580/0xe90 [ ...] [ 23.531729][ T1305] kernel BUG at lib/list_debug.c:53! [ 23.532523][ T1305] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 23.533467][ T1305] CPU: 2 PID: 1305 Comm: bash Tainted: G W 5.5.0+ #322 [ 23.534962][ T1305] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 23.536503][ T1305] RIP: 0010:__list_del_entry_valid+0xe6/0x150 [ 23.538346][ T1305] Code: 89 ea 48 c7 c7 00 73 1e 96 e8 df f7 4c ff 0f 0b 48 c7 c7 60 73 1e 96 e8 d1 f7 4c ff 0f 0b 44 [ 23.541068][ T1305] RSP: 0018:ffff888047c27b58 EFLAGS: 00010282 [ 23.542001][ T1305] RAX: 0000000000000054 RBX: ffff888067f6f318 RCX: 0000000000000000 [ 23.543051][ T1305] RDX: 0000000000000054 RSI: 0000000000000008 RDI: ffffed1008f84f61 [ 23.544072][ T1305] RBP: ffff88804aa0fca0 R08: ffffed100d940539 R09: ffffed100d940539 [ 23.545085][ T1305] R10: 0000000000000001 R11: ffffed100d940538 R12: ffff888047c27cb0 [ 23.546422][ T1305] R13: ffff88806208b840 R14: ffffffff981976c0 R15: ffff888067f6f2c0 [ 23.547406][ T1305] FS: 00007f76c0431740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 23.548527][ T1305] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.549389][ T1305] CR2: 00007f5048f1a2f8 CR3: 000000004b310006 CR4: 00000000000606e0 [ 23.550636][ T1305] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.551578][ T1305] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.552597][ T1305] Call Trace: [ 23.553004][ T1305] mutex_remove_waiter+0x101/0x520 [ 23.553646][ T1305] __mutex_lock+0xac7/0x14b0 [ 23.554218][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.554908][ T1305] ? mutex_lock_io_nested+0x1380/0x1380 [ 23.555570][ T1305] ? _parse_integer+0xf0/0xf0 [ 23.556043][ T1305] ? kstrtouint+0x86/0x110 [ 23.556504][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.557133][ T1305] nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.558024][ T1305] del_port_store+0xcc/0xf0 [netdevsim] [ ... ] Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload") Signed-off-by: Taehee Yoo <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03netdevsim: fix using uninitialized resourcesTaehee Yoo2-3/+41
When module is being initialized, __init() calls bus_register() and driver_register(). These functions internally create various resources and sysfs files. The sysfs files are used for basic operations(add/del device). /sys/bus/netdevsim/new_device /sys/bus/netdevsim/del_device These sysfs files use netdevsim resources, they are mostly allocated and initialized in ->probe() function, which is nsim_dev_probe(). But, sysfs files could be executed before ->probe() is finished. So, accessing uninitialized data would occur. Another problem is very similar. /sys/bus/netdevsim/new_device internally creates sysfs files. /sys/devices/netdevsim<id>/new_port /sys/devices/netdevsim<id>/del_port These sysfs files also use netdevsim resources, they are mostly allocated and initialized in creating device routine, which is nsim_bus_dev_new(). But they also could be executed before nsim_bus_dev_new() is finished. So, accessing uninitialized data would occur. To fix these problems, this patch adds flags, which means whether the operation is finished or not. The flag variable 'nsim_bus_enable' means whether netdevsim bus was initialized or not. This is protected by nsim_bus_dev_list_lock. The flag variable 'nsim_bus_dev->init' means whether nsim_bus_dev was initialized or not. This could be used in {new/del}_port_store() with no lock. Test commands: #SHELL1 modprobe netdevsim while : do echo "1 1" > /sys/bus/netdevsim/new_device echo "1 1" > /sys/bus/netdevsim/del_device done #SHELL2 while : do echo 1 > /sys/devices/netdevsim1/new_port echo 1 > /sys/devices/netdevsim1/del_port done Splat looks like: [ 47.508954][ T1008] general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 I [ 47.510793][ T1008] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 47.511963][ T1008] CPU: 2 PID: 1008 Comm: bash Not tainted 5.5.0+ #322 [ 47.512823][ T1008] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 47.514041][ T1008] RIP: 0010:__mutex_lock+0x10a/0x14b0 [ 47.514699][ T1008] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f [ 47.517163][ T1008] RSP: 0018:ffff888059b4fbb0 EFLAGS: 00010206 [ 47.517802][ T1008] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 47.518941][ T1008] RDX: 0000000000000021 RSI: ffffffff85926440 RDI: 0000000000000108 [ 47.519732][ T1008] RBP: ffff888059b4fd30 R08: ffffffffc073fad0 R09: 0000000000000000 [ 47.520729][ T1008] R10: ffff888059b4fd50 R11: ffff88804bb38040 R12: 0000000000000000 [ 47.521702][ T1008] R13: dffffc0000000000 R14: ffffffff871976c0 R15: 00000000000000a0 [ 47.522760][ T1008] FS: 00007fd4be05a740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 47.523877][ T1008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.524627][ T1008] CR2: 0000561c82b69cf0 CR3: 0000000065dd6004 CR4: 00000000000606e0 [ 47.527662][ T1008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.528604][ T1008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.529531][ T1008] Call Trace: [ 47.529874][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.530470][ T1008] ? mutex_lock_io_nested+0x1380/0x1380 [ 47.531018][ T1008] ? _kstrtoull+0x76/0x160 [ 47.531449][ T1008] ? _parse_integer+0xf0/0xf0 [ 47.531874][ T1008] ? kernfs_fop_write+0x1cf/0x410 [ 47.532330][ T1008] ? sysfs_file_ops+0x160/0x160 [ 47.532773][ T1008] ? kstrtouint+0x86/0x110 [ 47.533168][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.533721][ T1008] nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.534336][ T1008] ? sysfs_file_ops+0x160/0x160 [ 47.534858][ T1008] new_port_store+0x99/0xb0 [netdevsim] [ 47.535439][ T1008] ? del_port_store+0xb0/0xb0 [netdevsim] [ 47.536035][ T1008] ? sysfs_file_ops+0x112/0x160 [ 47.536544][ T1008] ? sysfs_kf_write+0x3b/0x180 [ 47.537029][ T1008] kernfs_fop_write+0x276/0x410 [ 47.537548][ T1008] ? __sb_start_write+0x215/0x2e0 [ 47.538110][ T1008] vfs_write+0x197/0x4a0 [ ... ] Fixes: f9d9db47d3ba ("netdevsim: add bus attributes to add new and delete devices") Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion") Signed-off-by: Taehee Yoo <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-04selftests/bpf: Fix trampoline_count.c selftest compilation warningAndrii Nakryiko1-1/+1
Fix missing braces compilation warning in trampoline_count test: .../prog_tests/trampoline_count.c: In function ‘test_trampoline_count’: .../prog_tests/trampoline_count.c:49:9: warning: missing braces around initializer [-Wmissing-braces] struct inst inst[MAX_TRAMP_PROGS] = { 0 }; ^ .../prog_tests/trampoline_count.c:49:9: warning: (near initialization for ‘inst[0]’) [-Wmissing-braces] Fixes: d633d57902a5 ("selftest/bpf: Add test for allowed trampolines count") Signed-off-by: Andrii Nakryiko <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Yonghong Song <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
2020-02-03Merge branch 'bnxt_en-Bug-fixes'Jakub Kicinski1-13/+24
Michael Chan says: ===================== bnxt_en: Bug fixes 3 patches that fix some issues in the firmware reset logic, starting with a small patch to refactor the code that re-enables SRIOV. The last patch fixes a TC queue mapping issue. ==================== Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03bnxt_en: Fix TC queue mapping.Michael Chan1-1/+1
The driver currently only calls netdev_set_tc_queue when the number of TCs is greater than 1. Instead, the comparison should be greater than or equal to 1. Even with 1 TC, we need to set the queue mapping. This bug can cause warnings when the number of TCs is changed back to 1. Fixes: 7809592d3e2e ("bnxt_en: Enable MSIX early in bnxt_init_one().") Signed-off-by: Michael Chan <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03bnxt_en: Fix logic that disables Bus Master during firmware reset.Vasundhara Volam1-4/+7
The current logic that calls pci_disable_device() in __bnxt_close_nic() during firmware reset is flawed. If firmware is still alive, we're disabling the device too early, causing some firmware commands to not reach the firmware. Fix it by moving the logic to bnxt_reset_close(). If firmware is in fatal condition, we call pci_disable_device() before we free any of the rings to prevent DMA corruption of the freed rings. If firmware is still alive, we call pci_disable_device() after the last firmware message has been sent. Fixes: 3bc7d4a352ef ("bnxt_en: Add BNXT_STATE_IN_FW_RESET state.") Signed-off-by: Vasundhara Volam <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03bnxt_en: Fix RDMA driver failure with SRIOV after firmware reset.Michael Chan1-2/+5
bnxt_ulp_start() needs to be called before SRIOV is re-enabled after firmware reset. Re-enabling SRIOV may consume all the resources and may cause the RDMA driver to fail to get MSIX and other resources. Fix it by calling bnxt_ulp_start() first before calling bnxt_reenable_sriov(). We re-arrange the logic so that we call bnxt_ulp_start() and bnxt_reenable_sriov() in proper sequence in bnxt_fw_reset_task() and bnxt_open(). The former is the normal coordinated firmware reset sequence and the latter is firmware reset while the function is down. This new logic is now more straight forward and will now fix both scenarios. Fixes: f3a6d206c25a ("bnxt_en: Call bnxt_ulp_stop()/bnxt_ulp_start() during error recovery.") Reported-by: Vasundhara Volam <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03bnxt_en: Refactor logic to re-enable SRIOV after firmware reset detected.Michael Chan1-7/+12
Put the current logic in bnxt_open() to re-enable SRIOV after detecting firmware reset into a new function bnxt_reenable_sriov(). This call needs to be invoked in the firmware reset path also in the next patch. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-04bpf: Fix modifier skipping logicAlexei Starovoitov1-5/+3
Fix the way modifiers are skipped while walking pointers. Otherwise second level dereferences of 'const struct foo *' will be rejected by the verifier. Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF") Signed-off-by: Alexei Starovoitov <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Yonghong Song <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
2020-02-04bpftool: Remove redundant "HAVE" prefix from the large INSN limit checkMichal Rostecki1-1/+1
"HAVE" prefix is already applied by default to feature macros and before this change, the large INSN limit macro had the incorrect name with double "HAVE". Fixes: 2faef64aa6b3 ("bpftool: Add misc section and probe for large INSN limit") Signed-off-by: Michal Rostecki <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Yonghong Song <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
2020-02-03net: stmmac: Delete txtimer in suspend()Nicolin Chen1-0/+4
When running v5.5 with a rootfs on NFS, memory abort may happen in the system resume stage: Unable to handle kernel paging request at virtual address dead00000000012a [dead00000000012a] address between user and kernel address ranges pc : run_timer_softirq+0x334/0x3d8 lr : run_timer_softirq+0x244/0x3d8 x1 : ffff800011cafe80 x0 : dead000000000122 Call trace: run_timer_softirq+0x334/0x3d8 efi_header_end+0x114/0x234 irq_exit+0xd0/0xd8 __handle_domain_irq+0x60/0xb0 gic_handle_irq+0x58/0xa8 el1_irq+0xb8/0x180 arch_cpu_idle+0x10/0x18 do_idle+0x1d8/0x2b0 cpu_startup_entry+0x24/0x40 secondary_start_kernel+0x1b4/0x208 Code: f9000693 a9400660 f9000020 b4000040 (f9000401) ---[ end trace bb83ceeb4c482071 ]--- Kernel panic - not syncing: Fatal exception in interrupt SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 2-3 Kernel Offset: disabled CPU features: 0x00002,2300aa30 Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- It's found that stmmac_xmit() and stmmac_resume() sometimes might run concurrently, possibly resulting in a race condition between mod_timer() and setup_timer(), being called by stmmac_xmit() and stmmac_resume() respectively. Since the resume() runs setup_timer() every time, it'd be safer to have del_timer_sync() in the suspend() as the counterpart. Signed-off-by: Nicolin Chen <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03Merge branch 'for-5.6' of ↵Linus Torvalds2-7/+6
git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu updates from Dennis Zhou: "Separate out variables that can be decrypted into their own page anytime encryption can be enabled and fix __percpu annotations in asm-generic for sparse" * 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: percpu: Separate decrypted varaibles anytime encryption can be enabled percpu: fix __percpu annotation in asm-generic
2020-02-03Merge branch 'stable/for-linus-5.6' of ↵Linus Torvalds1-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft Pull ibft update from Konrad Rzeszutek Wilk: "Adhere to the iBFT spec and extend the structure to handle more than two NICs" * 'stable/for-linus-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: Don't limits Targets and NICs to two
2020-02-03Merge tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfioLinus Torvalds4-7/+9
Pull VFIO updates from Alex Williamson: - Fix nvlink error path (Alexey Kardashevskiy) - Update nvlink and spapr to use mmgrab() (Julia Lawall) - Update static declaration (Ben Dooks) - Annotate __iomem to fix sparse warnings (Ben Dooks) * tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfio: vfio: platform: fix __iomem in vfio_platform_amdxgbe.c vfio/mdev: make create attribute static vfio/spapr_tce: use mmgrab vfio: vfio_pci_nvlink2: use mmgrab vfio/spapr/nvlink2: Skip unpinning pages on error exit
2020-02-03SMB3: Backup intent flag missing from some more opsAmir Goldstein14-118/+68
When "backup intent" is requested on the mount (e.g. backupuid or backupgid mount options), the corresponding flag was missing from some of the operations. Change all operations to use the macro cifs_create_options() to set the backup intent flag if needed. Signed-off-by: Amir Goldstein <[email protected]> Signed-off-by: Steve French <[email protected]>
2020-02-03Merge tag 'clk-for-linus' of ↵Linus Torvalds146-1806/+15018
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "There are a few changes to the core framework this time around, in addition to the normal collection of driver updates to support new SoCs, fix incorrect data, and convert various drivers to clk_hw based APIs. In the core, we allow clk_ops::init() to return an error code now so that we can fail clk registration if the callback does something like fail to allocate memory. We also add a new "terminate" clk_op so that things done in clk_ops::init() can be undone, e.g. free memory. We also spit out a warning now when critical clks fail to enable and we support changing clk rates and enable/disable state through debugfs when developers compile the kernel themselves. On the driver front, we get support for what seems like a lot of Qualcomm and NXP SoCs given that those vendors dominate the diffstat. There are a couple new drivers for Xilinx and Amlogic SoCs too. The updates are all small things like fixing the way glitch free muxes switch parents, avoiding div-by-zero problems, or fixing data like parent names. See the updates section below for more details. Finally, the "basic" clk types have been converted to support specifying parents with clk_hw pointers. This work includes an overhaul of the fixed-rate clk type to be more modern by using clk_hw APIs. Core: - Let clk_ops::init() return an error code - Add a clk_ops::terminate() callback to undo clk_ops::init() - Warn about critical clks that fail to enable or prepare - Support dangerous debugfs actions on clks with dead code New Drivers: - Support for Xilinx Versal platform clks - Display clk controller on qcom sc7180 - Video clk controller on qcom sc7180 - Graphics clk controller on qcom sc7180 - CPU PLLs for qcom msm8916 - Move qcom msm8974 gfx3d clk to RPM control - Display port clk support on qcom sdm845 SoCs - Global clk controller on qcom ipq6018 - Add a driver for BCLK of Freescale SAI cores - Add cam, vpe and sgx clock support for TI dra7 - Add aess clock support for TI omap5 - Enable clks for CPUfreq on Allwinner A64 SoCs - Add Amlogic meson8b DDR clock controller - Add input clocks to Amlogic meson8b controllers - Add SPIBSC (SPI FLASH) clock on Renesas RZ/A2 - i.MX8MP clk driver support Updates: - Convert gpio, fixed-factor, mux, gate, divider basic clks to hw based APIs - Detect more PRMCU variants in ux500 driver - Adjust the composite clk type to new way of describing clk parents - Fixes for clk controllers on qcom msm8998 SoCs - Fix gmac main clock for TI dra7 - Move TI dra7-atl clock header to correct location - Fix hidden node name dependency on TI clkctrl clocks - Fix Amlogic meson8b mali clock update using the glitch free mux - Fix Amlogic pll driver division by zero at init - Prepare for split of Renesas R-Car H3 ES1.x and ES2.0+ config symbols - Switch more i.MX clk drivers to clk_hw based APIs - Disable non-functional divider between pll4_audio_div and pll4_post_div on imx6q - Fix watchdog2 clock name typo in imx7ulp clock driver - Set CLK_GET_RATE_NOCACHE flag for DRAM related clocks on i.MX8M SoCs - Suppress bind attrs for i.MX8M clock driver - Add a big comment in imx8qxp-lpcg driver to tell why devm_platform_ioremap_resource() shouldn't be used for the driver - A correction on i.MX8MN usb1_ctrl parent clock setting" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (140 commits) dt/bindings: clk: fsl,plldig: Drop 'bindings' from schema id clk: ls1028a: Fix warning on clamp() usage clk: qoriq: add ls1088a hwaccel clocks support clk: ls1028a: Add clock driver for Display output interface dt/bindings: clk: Add YAML schemas for LS1028A Display Clock bindings clk: fsl-sai: new driver dt-bindings: clock: document the fsl-sai driver clk: composite: add _register_composite_pdata() variants clk: qcom: rpmh: Sort OF match table dt-bindings: fix warnings in validation of qcom,gcc.yaml dt-binding: fix compilation error of the example in qcom,gcc.yaml clk: zynqmp: Add support for clock with CLK_DIVIDER_POWER_OF_TWO flag clk: zynqmp: Fix divider calculation clk: zynqmp: Add support for get max divider clk: zynqmp: Warn user if clock user are more than allowed clk: zynqmp: Extend driver for versal dt-bindings: clock: Add bindings for versal clock driver clk: ti: clkctrl: Fix hidden dependency to node name clk: ti: add clkctrl data dra7 sgx clk: ti: omap5: Add missing AESS clock ...
2020-02-03Merge branch 'for-linus' of ↵Linus Torvalds14-144/+544
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a driver for SGI IOC3 PS/2 controller - updates to driver for FocalTech FT5x06 series touch screen controllers - other assorted fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - switch to reduced reporting mode dt-bindings: touchscreen: Convert Goodix touchscreen to json-schema dt-bindings: touchscreen: Add touchscreen schema Input: add IOC3 serio driver Input: axp20x-pek - enable wakeup for all AXP variants Input: axp20x-pek - respect userspace wakeup configuration Input: ads7846 - use new `delay` structure for SPI transfer delays Input: edt-ft5x06 - use pm core to enable/disable the wake irq Input: edt-ft5x06 - make wakeup-source switchable Input: edt-ft5x06 - document wakeup-source capability Input: edt-ft5x06 - alphabetical include reorder Input: edt-ft5x06 - work around first register access error Input: apbps2 - add __iomem to register struct Input: axp20x-pek - make device attributes static Input: elants_i2c - check Remark ID when attempting firmware update
2020-02-03parisc: Regenerate parisc defconfigsHelge Deller8-1168/+43
Regenerate the 32- and 64-bit defconfigs and drop the outdated specific machine defconfigs for the 712, A500, B160, C3000 and C8000 workstations. Signed-off-by: Helge Deller <[email protected]>
2020-02-03NFS: Switch readdir to using iterate_shared()Trond Myklebust1-1/+1
Now that the page cache locking is repaired, we should be able to switch to using iterate_shared() for improved concurrency when doing readdir(). Signed-off-by: Trond Myklebust <[email protected]> Reviewed-by: Benjamin Coddington <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: Use kmemdup_nul() in nfs_readdir_make_qstr()Trond Myklebust1-1/+1
The directory strings stored in the readdir cache may be used with printk(), so it is better to ensure they are nul-terminated. Signed-off-by: Trond Myklebust <[email protected]> Reviewed-by: Benjamin Coddington <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: Directory page cache pages need to be locked when readTrond Myklebust1-11/+19
When a NFS directory page cache page is removed from the page cache, its contents are freed through a call to nfs_readdir_clear_array(). To prevent the removal of the page cache entry until after we've finished reading it, we must take the page lock. Fixes: 11de3b11e08c ("NFS: Fix a memory leak in nfs_readdir") Cc: [email protected] # v2.6.37+ Signed-off-by: Trond Myklebust <[email protected]> Reviewed-by: Benjamin Coddington <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: Fix memory leaks and corruption in readdirTrond Myklebust1-2/+15
nfs_readdir_xdr_to_array() must not exit without having initialised the array, so that the page cache deletion routines can safely call nfs_readdir_clear_array(). Furthermore, we should ensure that if we exit nfs_readdir_filler() with an error, we free up any page contents to prevent a leak if we try to fill the page again. Fixes: 11de3b11e08c ("NFS: Fix a memory leak in nfs_readdir") Cc: [email protected] # v2.6.37+ Signed-off-by: Trond Myklebust <[email protected]> Reviewed-by: Benjamin Coddington <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03SUNRPC: Use kmemdup_nul() in rpc_parse_scope_id()Trond Myklebust1-1/+1
Using kmemdup_nul() is more efficient when the length is known. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: Replace various occurrences of kstrndup() with kmemdup_nul()Trond Myklebust2-2/+2
When we already know the string length, it is more efficient to use kmemdup_nul(). Signed-off-by: Trond Myklebust <[email protected]> [Anna - Changes to super.c were already made during fscontext conversion] Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFSv4: Limit the total number of cached delegationsTrond Myklebust1-1/+7
Delegations can be expensive to return, and can cause scalability issues for the server. Let's therefore try to limit the number of inactive delegations we hold. Once the number of delegations is above a certain threshold, start to return them on close. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFSv4: Add accounting for the number of active delegations heldTrond Myklebust1-12/+24
In order to better manage our delegation caching, add a counter to track the number of active delegations. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFSv4: Try to return the delegation immediately when marked for return on closeTrond Myklebust3-0/+35
Add a routine to return the delegation immediately upon close of the file if it was marked for return-on-close. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: Clear NFS_DELEGATION_RETURN_IF_CLOSED when the delegation is returnedTrond Myklebust1-1/+3
If a delegation is marked as needing to be returned when the file is closed, then don't clear that marking until we're ready to return it. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFSv4: nfs_inode_evict_delegation() should set NFS_DELEGATION_RETURNINGTrond Myklebust1-0/+1
In particular, the pnfs return-on-close code will check for that flag, so ensure we set it appropriately. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: nfs_find_open_context() should use cred_fscmp()Trond Myklebust1-1/+1
We want to find open contexts that match our filesystem access properties. They don't have to exactly match the cred. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFS: nfs_access_get_cached_rcu() should use cred_fscmp()Trond Myklebust1-1/+1
We do not need to have the rcu lookup method fail in the case where the fsuid/fsgid and supplemental groups match. Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03NFSv4: pnfs_roc() must use cred_fscmp() to compare credsTrond Myklebust1-1/+1
When comparing two 'struct cred' for equality w.r.t. behaviour under filesystem access, we need to use cred_fscmp(). Fixes: a52458b48af1 ("NFS/NFSD/SUNRPC: replace generic creds with 'struct cred'.") Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2020-02-03dt-bindings: clk: qcom: Fix self-validation, split, and clean cruftDouglas Anderson8-194/+529
The 'qcom,gcc.yaml' file failed self-validation (dt_binding_check) because it required a property to be either (3 entries big), (3 entries big), or (7 entries big), but not more than one of those things. That didn't make a ton of sense. This patch splits all of the exceptional device trees (AKA those that would have needed if/then/else rules) from qcom,gcc.yaml. It also cleans up some cruft found while doing that. After this lands, this worked for me atop clk-next with just the known error about msm8998: for f in \ Documentation/devicetree/bindings/clock/qcom,gcc-apq8064.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-ipq8074.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-msm8996.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-msm8998.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-qcs404.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-sc7180.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-sm8150.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc.yaml; do \ ARCH=arm64 make dtbs_check DT_SCHEMA_FILES=$f; \ done I then picked this patch atop linux-next (next-20200129) and ran: # Delete broken yaml: rm Documentation/devicetree/bindings/pci/intel-gw-pcie.yaml ARCH=arm64 make dt_binding_check | grep 'clock/qcom' ...and that didn't seem to indicate problems. Arbitrary decisions made (yell if you want changed): - Left all the older devices (where clocks / clock-names weren't specified) in a single file. - Didn't make clocks "required" for msm8996 but left them as listed. This seems a little weird but it matches the old binding. Misc cleanups as part of this patch: - Fixed schema id to not have "bindings/" as per Rob [1]. - Listed include files as per Stephen. - sm8150 was claimed to be same set of clocks as sc7180, but driver and dts appear to say that "bi_tcxo_ao" doesn't exist. Fixed. - In "apq8064", "#thermal-sensor-cells" was missing the "#". - Got rid of "|" at the end of top description since spacing doesn't matter. - Changed indentation to consistently 2 spaces (it was 3 in some places). - Added period at the end of protected-clocks description. - No space before ":". - Updated sc7180/sm8150 example to use the 'qcom,rpmh.h' include. - Updated sc7180/sm8150 example to use larger address/size cells as per reality. - Updated sc7180/sm8150 example to point to the sleep_clk rather than <0>. - Made it so that gcc-ipq8074 didn't require #power-domain-cells since actual dts didn't have it and I got no hits from: git grep _GDSC include/dt-bindings/clock/qcom,gcc-ipq8074.h - Made it so that gcc-qcs404 didn't require #power-domain-cells since actual dts didn't have it and I got no hits from: git grep _GDSC include/dt-bindings/clock/qcom,gcc-qcs404.h Noticed, but not done in this patch (volunteers needed): - Add "aud_ref_clk" to sm8150 bindings / dts even though I found a reference to it in "gcc-sm8150.c". - Fix node name in actual ipq8074 to be "clock-controller" (it's gcc). - Since the example doesn't need phandes to exist, in msm8998 could just make up places providing some of the clocks currently bogused out with <0>. - On msm8998 clocks are listed as required but current dts doesn't have them. [1] https://lore.kernel.org/r/CAL_Jsq+_2E-bAbP9F6VYkWRp0crEyRGa5peuwP58-PZniVny7w@mail.gmail.com Fixes: ab91f72e018a ("clk: qcom: gcc-msm8996: Fix parent for CLKREF clocks") Signed-off-by: Douglas Anderson <[email protected]> Reviewed-by: Rob Herring <[email protected]> Reviewed-by: Jeffrey Hugo <[email protected]> Link: https://lkml.kernel.org/r/20200203094843.v3.1.I4452dc951d7556ede422835268742b25a18b356b@changeid Signed-off-by: Stephen Boyd <[email protected]>
2020-02-03clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq()Stephen Boyd1-4/+4
The DFS frequency table logic overwrites 'cfg' while detecting the parent clk and then later on in clk_rcg2_dfs_populate_freq() we use that same variable to figure out the mode of the clk, either MND or not. Add a new variable to hold the parent clk bit so that 'cfg' is left untouched for use later. This fixes problems in detecting the supported frequencies for any clks in DFS mode. Fixes: cc4f6944d0e3 ("clk: qcom: Add support for RCG to register for DFS") Reported-by: Rajendra Nayak <[email protected]> Signed-off-by: Stephen Boyd <[email protected]> Link: https://lkml.kernel.org/r/[email protected] Tested-by: Rajendra Nayak <[email protected]>
2020-02-03dt/bindings: clk: fsl,plldig: Drop 'bindings' from schema idStephen Boyd1-1/+1
Having 'bindings' in here causes a warning when checking the schema. Documentation/devicetree/bindings/clock/fsl,plldig.yaml: $id: relative path/filename doesn't match actual path or filename expected: http://devicetree.org/schemas/clock/fsl,plldig.yaml# Remove it. Cc: Rob Herring <[email protected]> Cc: Wen He <[email protected]> Signed-off-by: Stephen Boyd <[email protected]> Link: https://lkml.kernel.org/r/[email protected] Acked-by: Rob Herring <[email protected]>
2020-02-03clk: ls1028a: Fix warning on clamp() usageStephen Boyd1-2/+2
These constants are used in clamp() with the value being clamped an unsigned long. Make them unsigned long defines so that clamp() doesn't complain about comparing different types. In file included from include/linux/list.h:9, from include/linux/kobject.h:19, from include/linux/of.h:17, from include/linux/clk-provider.h:9, from drivers/clk/clk-plldig.c:8: drivers/clk/clk-plldig.c: In function 'plldig_determine_rate': include/linux/kernel.h:835:29: warning: comparison of distinct pointer types lacks a cast 835 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | Reported-by: Stephen Rothwell <[email protected]> Cc: Wen He <[email protected]> Fixes: d37010a3c162 ("clk: ls1028a: Add clock driver for Display output interface") Signed-off-by: Stephen Boyd <[email protected]> Link: https://lkml.kernel.org/r/[email protected]
2020-02-03Merge tag 'rxrpc-fixes-20200203' of ↵Jakub Kicinski10-69/+83
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== RxRPC fixes Here are a number of fixes for AF_RXRPC: (1) Fix a potential use after free in rxrpc_put_local() where it was accessing the object just put to get tracing information. (2) Fix insufficient notifications being generated by the function that queues data packets on a call. This occasionally causes recvmsg() to stall indefinitely. (3) Fix a number of packet-transmitting work functions to hold an active count on the local endpoint so that the UDP socket doesn't get destroyed whilst they're calling kernel_sendmsg() on it. (4) Fix a NULL pointer deref that stemmed from a call's connection pointer being cleared when the call was disconnected. Changes: v2: Removed a couple of BUG() statements that got added. ==================== Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-03rtw88: Fix return value of rtw_wow_check_fw_statusChin-Yen Lee1-12/+11
Clang warns that ret is used uninitialzed. And we found that actually the return type should be "int" instead of "bool". Fixes: 44bc17f7f5b3 ("rtw88: support wowlan feature for 8822c") Link: https://github.com/ClangBuiltLinux/linux/issues/850 Reported-by: Nathan Chancellor <[email protected]> Signed-off-by: Chin-Yen Lee <[email protected]> Signed-off-by: Yan-Hsuan Chuang <[email protected]> Reviewed-by: Nathan Chancellor <[email protected]> Tested-by: Nathan Chancellor <[email protected]> # build Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: d3: read all FW CPUs error infoMordechay Goodstein1-12/+40
Continue the wakeup flow only if no FW CPUs have an error If we don't check for error in all FW CPUs the driver can think based on one CPU that the FW is operational and try to access and send commands. Also, handle the error_id endianness correctly as le32 Signed-off-by: Mordechay Goodstein <[email protected]> Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: mvm: fix TDLS discovery with the new firmware APIEmmanuel Grumbach4-15/+72
I changed the API for asking for a session protection but I omitted the TDLS flows. Fix that now. Note that for the TDLS flow, we need to block until the session protection actually starts, so add this option to iwl_mvm_schedule_session_protection. This patch fixes a firmware assert in the TDLS flow since the old TIME_EVENT_CMD is not supported anymore by newer firwmare versions. Signed-off-by: Emmanuel Grumbach <[email protected]> Fixes: fe959c7b2049 ("iwlwifi: mvm: use the new session protection command") Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta()Andrei Otcheretianski1-5/+3
Fix a kernel panic by checking that the sta is not NULL. This could happen during a reconfig flow, as mac80211 moves the sta between all the states without really checking if the previous state was successfully set. So, if for some reason we failed to add back the station, subsequent calls to sta_state() callback will be done when the station is NULL. This would result in a following panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 IP: iwl_mvm_cfg_he_sta+0xfc/0x690 [iwlmvm] [..] Call Trace: iwl_mvm_mac_sta_state+0x629/0x6f0 [iwlmvm] drv_sta_state+0xf4/0x950 [mac80211] ieee80211_reconfig+0xa12/0x2180 [mac80211] ieee80211_restart_work+0xbb/0xe0 [mac80211] process_one_work+0x1e2/0x610 worker_thread+0x4d/0x3e0 [..] Signed-off-by: Andrei Otcheretianski <[email protected]> Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: mvm: avoid use after free for pmsr requestAvraham Stern1-1/+4
When a FTM request is aborted, the driver sends the abort command to the fw and waits for a response. When the response arrives, the driver calls cfg80211_pmsr_complete() for that request. However, cfg80211 frees the requested data immediately after sending the abort command, so this may lead to use after free. Fix it by clearing the request data in the driver when the abort command arrives and ignoring the fw notification that will come afterwards. Signed-off-by: Avraham Stern <[email protected]> Fixes: fc36ffda3267 ("iwlwifi: mvm: support FTM initiator") Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: mvm: update the DTS measurement typeGolan Ben Ami1-3/+3
Till now, the driver asked the fw for a DTS measurement in automatic mode. This triggered a flow in which the fw actively measured the temperature. This is not needed anymore, as the fw performs measurements by itself, without the driver triggering them, and the current cadence in which the fw performs such measurements is sufficient. In addition, in some time-sensitive scenarios, in which the driver asks the fw for an active measurement twice in a short time (<100ms), the fw asserts with code 0x20100801. Change the DTS measurement to _WITHOUT_MEASURE instead, so the fw will respond with the last measurement it has performed. Signed-off-by: Golan Ben Ami <[email protected]> Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: don't throw error when trying to remove IGTKLuca Coelho1-3/+7
The IGTK keys are only removed by mac80211 after it has already removed the AP station. This causes the driver to throw an error because mac80211 is trying to remove the IGTK when the station doesn't exist anymore. The firmware is aware that the station has been removed and can deal with it the next time we try to add an IGTK for a station, so we shouldn't try to remove the key if the station ID is IWL_MVM_INVALID_STA. Do this by removing the check for mvm_sta before calling iwl_mvm_send_sta_igtk() and check return from that function gracefully if the station ID is invalid. Cc: [email protected] # 4.12+ Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-03iwlwifi: mvm: Fix thermal zone registrationAndrei Otcheretianski1-1/+3
Use a unique name when registering a thermal zone. Otherwise, with multiple NICS, we hit the following warning during the unregistration. WARNING: CPU: 2 PID: 3525 at fs/sysfs/group.c:255 RIP: 0010:sysfs_remove_group+0x80/0x90 Call Trace: dpm_sysfs_remove+0x57/0x60 device_del+0x5a/0x350 ? sscanf+0x4e/0x70 device_unregister+0x1a/0x60 hwmon_device_unregister+0x4a/0xa0 thermal_remove_hwmon_sysfs+0x175/0x1d0 thermal_zone_device_unregister+0x188/0x1e0 iwl_mvm_thermal_exit+0xe7/0x100 [iwlmvm] iwl_op_mode_mvm_stop+0x27/0x180 [iwlmvm] _iwl_op_mode_stop.isra.3+0x2b/0x50 [iwlwifi] iwl_opmode_deregister+0x90/0xa0 [iwlwifi] __exit_compat+0x10/0x2c7 [iwlmvm] __x64_sys_delete_module+0x13f/0x270 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Signed-off-by: Andrei Otcheretianski <[email protected]> Signed-off-by: Luca Coelho <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2020-02-04nvme-pci: remove nvmeq->tagsChristoph Hellwig1-15/+8
There is no real need to have a pointer to the tagset in struct nvme_queue, as we only need it in a single place, and that place can derive the used tagset from the device and qid trivially. This fixes a problem with stale pointer exposure when tagsets are reset, and also shrinks the nvme_queue structure. It also matches what most other transports have done since day 1. Reported-by: Edmund Nadolski <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Keith Busch <[email protected]>
2020-02-04nvmet: fix dsm failure when payload does not match sgl descriptorSagi Grimberg4-2/+14
The host is allowed to pass the controller an sgl describing a buffer that is larger than the dsm payload itself, allow it when executing dsm. Reported-by: Dakshaja Uppalapati <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]>, Reviewed-by: Max Gurtovoy <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]> Signed-off-by: Keith Busch <[email protected]>
2020-02-04nvmet: Pass lockdep expression to RCU listsAmol Grover1-2/+4
ctrl->subsys->namespaces and subsys->namespaces are traversed with list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of ctrl->subsys->lock and subsys->lock respectively. Hence, add the corresponding lockdep expression to the list traversal primitive to silence false-positive lockdep warnings, and harden RCU lists. Reported-by: kbuild test robot <[email protected]> Reviewed-by: Joel Fernandes (Google) <[email protected]> Signed-off-by: Amol Grover <[email protected]> Signed-off-by: Keith Busch <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.