aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-08-23KVM: arm/arm64: VGIC: Properly initialise private IRQ affinityAndre Przywara1-10/+20
At the moment we initialise the target *mask* of a virtual IRQ to the VCPU it belongs to, even though this mask is only defined for GICv2 and quickly runs out of bits for many GICv3 guests. This behaviour triggers an UBSAN complaint for more than 32 VCPUs: ------ [ 5659.462377] UBSAN: Undefined behaviour in virt/kvm/arm/vgic/vgic-init.c:223:21 [ 5659.471689] shift exponent 32 is too large for 32-bit type 'unsigned int' ------ Also for GICv3 guests the reporting of TARGET in the "vgic-state" debugfs dump is wrong, due to this very same problem. Because there is no requirement to create the VGIC device before the VCPUs (and QEMU actually does it the other way round), we can't safely initialise mpidr or targets in kvm_vgic_vcpu_init(). But since we touch every private IRQ for each VCPU anyway later (in vgic_init()), we can just move the initialisation of those fields into there, where we definitely know the VGIC type. On the way make sure we really have either a VGICv2 or a VGICv3 device, since the existing code is just checking for "VGICv3 or not", silently ignoring the uninitialised case. Signed-off-by: Andre Przywara <[email protected]> Reported-by: Dave Martin <[email protected]> Tested-by: Julien Grall <[email protected]> Signed-off-by: Marc Zyngier <[email protected]>
2019-08-23Merge tag 'modules-for-v5.3-rc6' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules fixes from Jessica Yu: "Fix BUG_ON() being triggered in frob_text() due to non-page-aligned module sections" * tag 'modules-for-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: modules: page-align module section allocations only for arches supporting strict module rwx modules: always page-align module section allocations
2019-08-23batman-adv: Only read OGM2 tvlv_len after buffer len checkSven Eckelmann1-6/+12
Multiple batadv_ogm2_packet can be stored in an skbuff. The functions batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there is another additional batadv_ogm2_packet in the skb or not before they continue processing the packet. The length for such an OGM2 is BATADV_OGM2_HLEN + batadv_ogm2_packet->tvlv_len. The check must first check that at least BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") Signed-off-by: Sven Eckelmann <[email protected]> Signed-off-by: Simon Wunderlich <[email protected]>
2019-08-23batman-adv: Only read OGM tvlv_len after buffer len checkSven Eckelmann1-7/+13
Multiple batadv_ogm_packet can be stored in an skbuff. The functions batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use batadv_iv_ogm_aggr_packet() to check if there is another additional batadv_ogm_packet in the skb or not before they continue processing the packet. The length for such an OGM is BATADV_OGM_HLEN + batadv_ogm_packet->tvlv_len. The check must first check that at least BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure") Reported-by: [email protected] Signed-off-by: Sven Eckelmann <[email protected]> Acked-by: Antonio Quartulli <[email protected]> Signed-off-by: Simon Wunderlich <[email protected]>
2019-08-23Merge tag 'ceph-for-5.3-rc6' of git://github.com/ceph/ceph-clientLinus Torvalds9-21/+36
Pull ceph fixes from Ilya Dryomov: "Three important fixes tagged for stable (an indefinite hang, a crash on an assert and a NULL pointer dereference) plus a small series from Luis fixing instances of vfree() under spinlock" * tag 'ceph-for-5.3-rc6' of git://github.com/ceph/ceph-client: libceph: fix PG split vs OSD (re)connect race ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply ceph: clear page dirty before invalidate page ceph: fix buffer free while holding i_ceph_lock in fill_inode() ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
2019-08-23RDMA/siw: Fix 64/32bit pointer inconsistencyBernard Metzler9-109/+108
Fixes improper casting between addresses and unsigned types. Changes siw_pbl_get_buffer() function to return appropriate dma_addr_t, and not u64. Also fixes debug prints. Now any potentially kernel private pointers are printed formatted as '%pK', to allow keeping that information secret. Fixes: d941bfe500be ("RDMA/siw: Change CQ flags from 64->32 bits") Fixes: b0fff7317bb4 ("rdma/siw: completion queue methods") Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Fixes: f29dd55b0236 ("rdma/siw: queue pair methods") Fixes: 2251334dcac9 ("rdma/siw: application buffer management") Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Fixes: a531975279f3 ("rdma/siw: main include file") Reported-by: Geert Uytterhoeven <[email protected]> Reported-by: Jason Gunthorpe <[email protected]> Reported-by: Leon Romanovsky <[email protected]> Signed-off-by: Bernard Metzler <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Doug Ledford <[email protected]>
2019-08-23Merge tag 'drm-fixes-2019-08-23' of git://anongit.freedesktop.org/drm/drmLinus Torvalds18-28/+126
Pull drm fixes from Dave Airlie: "Live from the laundromat after my washing machine broke down, we have the 5.3-rc6 fixes. Changelog is in the tag below, but nothing too noteworthy in here: rcar-du: - LVDS dual-link mode fix mediatek: - of node refcount fix - prime buffer import fix - dma max seg fix komeda: - output polling fix - abfc format fix - memory-region DT fix amdgpu: - bpc display fix - ioctl memory leak fix - gfxoff fix - smu warnings fix i915: - HDMI mode readout fix" * tag 'drm-fixes-2019-08-23' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu/powerplay: silence a warning in smu_v11_0_setup_pptable drm/amd/display: Calculate bpc based on max_requested_bpc drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl drm/amd/amdgpu: disable MMHUB PG for navi10 drm/amd/powerplay: remove duplicate macro smu_get_uclk_dpm_states in amdgpu_smu.h drm/amd/powerplay: fix variable type errors in smu_v11_0_setup_pptable drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible drm/i915: Fix HW readout for crtc_clock in HDMI mode drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto drm: rcar_lvds: Fix dual link mode operations drm/mediatek: set DMA max segment size drm/mediatek: use correct device to import PRIME buffers drm/omap: ensure we have a valid dma_mask drm/komeda: Add support for 'memory-region' DT node property drm/komeda: Adds internal bpp computing for arm afbc only format YU08 YU10 drm/komeda: Initialize and enable output polling on Komeda
2019-08-23x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386Sean Christopherson1-1/+1
Use 'lea' instead of 'add' when adjusting %rsp in CALL_NOSPEC so as to avoid clobbering flags. KVM's emulator makes indirect calls into a jump table of sorts, where the destination of the CALL_NOSPEC is a small blob of code that performs fast emulation by executing the target instruction with fixed operands. adcb_al_dl: 0x000339f8 <+0>: adc %dl,%al 0x000339fa <+2>: ret A major motiviation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of CALL_NOSPEC. Clobbering flags results in all sorts of incorrect emulation, e.g. Jcc instructions often take the wrong path. Sans the nops... asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n" 0x0003595a <+58>: mov 0xc0(%ebx),%eax 0x00035960 <+64>: mov 0x60(%ebx),%edx 0x00035963 <+67>: mov 0x90(%ebx),%ecx 0x00035969 <+73>: push %edi 0x0003596a <+74>: popf 0x0003596b <+75>: call *%esi 0x000359a0 <+128>: pushf 0x000359a1 <+129>: pop %edi 0x000359a2 <+130>: mov %eax,0xc0(%ebx) 0x000359b1 <+145>: mov %edx,0x60(%ebx) ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); 0x000359a8 <+136>: mov -0x10(%ebp),%eax 0x000359ab <+139>: and $0x8d5,%edi 0x000359b4 <+148>: and $0xfffff72a,%eax 0x000359b9 <+153>: or %eax,%edi 0x000359bd <+157>: mov %edi,0x4(%ebx) For the most part this has gone unnoticed as emulation of guest code that can trigger fast emulation is effectively limited to MMIO when running on modern hardware, and MMIO is rarely, if ever, accessed by instructions that affect or consume flags. Breakage is almost instantaneous when running with unrestricted guest disabled, in which case KVM must emulate all instructions when the guest has invalid state, e.g. when the guest is in Big Real Mode during early BIOS. Fixes: 776b043848fd2 ("x86/retpoline: Add initial retpoline support") Fixes: 1a29b5b7f347a ("KVM: x86: Make indirect calls in emulator speculation safe") Signed-off-by: Sean Christopherson <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Acked-by: Peter Zijlstra (Intel) <[email protected]> Cc: [email protected] Link: https://lkml.kernel.org/r/[email protected]
2019-08-23dm table: fix invalid memory accesses with too high sector numberMikulas Patocka1-1/+4
If the sector number is too high, dm_table_find_target() should return a pointer to a zeroed dm_target structure (the caller should test it with dm_target_is_valid). However, for some table sizes, the code in dm_table_find_target() that performs btree lookup will access out of bound memory structures. Fix this bug by testing the sector number at the beginning of dm_table_find_target(). Also, add an "inline" keyword to the function dm_table_get_size() because this is a hot path. Fixes: 512875bd9661 ("dm: table detect io beyond device") Cc: [email protected] Reported-by: Zhang Tao <[email protected]> Signed-off-by: Mikulas Patocka <[email protected]> Signed-off-by: Mike Snitzer <[email protected]>
2019-08-23drm/komeda: Add missing of_node_get() callMihail Atanassov1-1/+1
komeda_pipeline_destroy has the matching of_node_put(). Fixes: 29e56aec911dd ("drm/komeda: Add DT parsing") Signed-off-by: Mihail Atanassov <[email protected]> Reviewed-by: Ayan Kumar Halder <[email protected]> [Rebased on the latest drm-misc-fixes] Signed-off-by: Ayan Kumar Halder <[email protected]> Link: https://patchwork.freedesktop.org/patch/325278/ Change-Id: I5fa2479d6cb3a77182f1a92833c1c0bca8668cb4
2019-08-23drm/komeda: Clean warning 'komeda_component_add' might be a candidate for ↵james qian wang (Arm Technology China)1-0/+1
'gnu_printf' komeda/komeda_pipeline.c: In function 'komeda_component_add': komeda/komeda_pipeline.c:212:3: warning: function 'komeda_component_add' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] vsnprintf(c->name, sizeof(c->name), name_fmt, args); ^~~~~~~~~ Signed-off-by: james qian wang (Arm Technology China) <[email protected]> Reviewed-by: Ayan Kumar Halder <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23drm/komeda: Fix warning -Wunused-but-set-variablejames qian wang (Arm Technology China)1-4/+2
Fixed two -Wunused-but-set-variable warnings: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c: In function ‘komeda_crtc_normalize_zpos’: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c:150:26: warning: variable ‘fb’ set but not used [-Wunused-but-set-variable] struct drm_framebuffer *fb; ^~ /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c: In function ‘komeda_kms_check’: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c:209:25: warning: variable ‘old_crtc_st’ set but not used [-Wunused-but-set-variable] struct drm_crtc_state *old_crtc_st, *new_crtc_st; ^~~~~~~~~~~ Signed-off-by: james qian wang (Arm Technology China) <[email protected]> Reviewed-by: Ayan Kumar Halder <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23drm/komeda: Fix error: not allocating enough data 1592 vs 1584james qian wang (Arm Technology China)1-1/+1
The patch 5d51f6c0da1b: "drm/komeda: Add writeback support" from May 23, 2019, leads to the following static checker warning: drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c:151 komeda_wb_connector_add() error: not allocating enough data 1592 vs 1584 This is a typo which misuse "wb_conn" but which should be "kwb_conn" to allocate the memory. Reported-by: Dan Carpenter <[email protected]> Signed-off-by: james qian wang (Arm Technology China) <[email protected]> Reviewed-by: Ayan Kumar Halder <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23ARM: 8897/1: check stmfd instruction using right shiftLvqiang Huang1-1/+1
In the commit ef41b5c92498 ("ARM: make kernel oops easier to read"), - .word 0xe92d0000 >> 10 @ stmfd sp!, {} + .word 0xe92d0000 >> 11 @ stmfd sp!, {} then the shift need to change to 11. Signed-off-by: Lvqiang Huang <[email protected]> Signed-off-by: Chunyan Zhang <[email protected]> Signed-off-by: Russell King <[email protected]>
2019-08-23ARM: 8874/1: mm: only adjust sections of valid mm structuresDoug Berger1-1/+2
A timing hazard exists when an early fork/exec thread begins exiting and sets its mm pointer to NULL while a separate core tries to update the section information. This commit ensures that the mm pointer is not NULL before setting its section parameters. The arguments provided by commit 11ce4b33aedc ("ARM: 8672/1: mm: remove tasklist locking from update_sections_early()") are equally valid for not requiring grabbing the task_lock around this check. Fixes: 08925c2f124f ("ARM: 8464/1: Update all mm structures with section adjustments") Signed-off-by: Doug Berger <[email protected]> Acked-by: Laura Abbott <[email protected]> Cc: Mike Rapoport <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Florian Fainelli <[email protected]> Cc: Rob Herring <[email protected]> Cc: "Steven Rostedt (VMware)" <[email protected]> Cc: Peng Fan <[email protected]> Cc: Geert Uytterhoeven <[email protected]> Signed-off-by: Russell King <[email protected]>
2019-08-23gpio: Fix irqchip initialization orderLinus Walleij1-15/+15
The new API for registering a gpio_irq_chip along with a gpio_chip has a different semantic ordering than the old API which added the irqchip explicitly after registering the gpio_chip. Move the calls to add the gpio_irq_chip *last* in the function, so that the different hooks setting up OF and ACPI and machine gpio_chips are called *before* we try to register the interrupts, preserving the elder semantic order. This cropped up in the PL061 driver which used to work fine with no special ACPI quirks, but started to misbehave using the new API. Fixes: e0d897289813 ("gpio: Implement tighter IRQ chip integration") Cc: Thierry Reding <[email protected]> Cc: Grygorii Strashko <[email protected]> Cc: Andy Shevchenko <[email protected]> Reported-by: Wei Xu <[email protected]> Tested-by: Wei Xu <[email protected]> Reported-by: Andy Shevchenko <[email protected]> Signed-off-by: Linus Walleij <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2019-08-23drm/virtio: use virtio_max_dma_sizeGerd Hoffmann1-2/+8
We must make sure our scatterlist segments are not too big, otherwise we might see swiotlb failures (happens with sev, also reproducable with swiotlb=force). Suggested-by: Laszlo Ersek <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Reviewed-by: Laszlo Ersek <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23drm/omap: Fix port lookup for SDI outputLaurent Pinchart1-1/+3
When refactoring port lookup for DSS outputs, commit d17eb4537a7e ("drm/omap: Factor out common init/cleanup code for output devices") incorrectly hardcoded usage of DT port 0. This breaks operation for SDI (which uses the DT port 1) and DPI outputs other than DPI0 (which are not used in mainline DT sources). Fix this by using the port number from the output omap_dss_device of_ports field. Fixes: d17eb4537a7e ("drm/omap: Factor out common init/cleanup code for output devices") Signed-off-by: Laurent Pinchart <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected] Tested-by: Aaro Koskinen <[email protected]>
2019-08-23drm/qxl: get vga ioportsGerd Hoffmann1-1/+19
qxl has two modes: "native" (used by the drm driver) and "vga" (vga compatibility mode, typically used for boot display and firmware framebuffers). Accessing any vga ioport will switch the qxl device into vga mode. The qxl driver never does that, but other drivers accessing vga ports can trigger that too and therefore disturb qxl operation. So aquire the legacy vga ioports from vgaarb to avoid that. Reproducer: Boot kvm guest with both qxl and i915 vgpu, with qxl being first in pci scan order. v2: Skip this for secondary qxl cards which don't have vga mode in the first place (Frediano). Cc: Frediano Ziglio <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Reviewed-by: Dave Airlie <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23phy: mvebu-a3700-comphy: Inform users if their firmware is too oldMiquel Raynal1-1/+8
PHY configuration has been implemented in the firmware and accessed through SMC calls. In the past, it worked magically if the bootloader was correctly doing the initializations. With up-to-date bindings, the kernel will need a recent firmware in order to do the initializations himself (we assume people must update their firmware along with their kernel). People might not understand why IPs that were working correctly before stopped to be probed suddendly. In this case, let's advise the users to update their firmware with a visual warning. Signed-off-by: Miquel Raynal <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: samsung: disable bind/unbind platform driver featureMarek Szyprowski6-0/+6
Samsung PHY drivers control the power to the SoC core components needed by their client devices (USB HCDs, SATA, camera ISP bridge, DP encoder) to properly operate. Disabling PHYs in runtime usually causes the client device to crash with external abort exception or similar issue due to lack of API to notify clients about PHY removal. This patch removes the possiblity to unbind Samsung Exynos PHY drivers in runtime. Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: core: document phy_calibrate()Marek Szyprowski1-0/+10
Commit 36914111e682 ("drivers: phy: add calibrate method") added support for generic phy_calibrate() method, but it didn't explain in detail when such method is supposed to be called. Add some more documentation directly to the phy.h to make it clean that it is intended to be called after every host controller reset. Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: marvell: phy-mvebu-a3700-comphy: Add of_node_put() before returnNishka Dasgupta1-2/+6
Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return in two places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: marvell: phy-mvebu-cp110-comphy: Add of_node_put() before returnNishka Dasgupta1-2/+6
Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return in two places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: marvell: phy-armada38x-comphy: Add of_node_put() before returnNishka Dasgupta1-1/+3
Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: enable compile-testing for the Lantiq PHY driversMartin Blumenstingl1-1/+1
Unconditionally include the lantiq subdirectory in the phy Makefile. All drivers in there have their dependencies maintained. One of these (optional) dependencies is COMPILE_TEST, however this can only be evaluated when Kconfig scans the lantiq subdirectory. Signed-off-by: Martin Blumenstingl <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23phy: lantiq: vrx200-pcie: add a driver for the Lantiq VRX200 PCIe PHYMartin Blumenstingl3-0/+506
The Lantiq VRX200 SoCs embed a PCIe PHY in the "sram" bus. Unlike most other IP blocks on this SoC the register values are only 16-bit wide. Like other IP blocks on this SoC the register values are in big endian. The PHY embeds a PLL which can be configured in various modes. Only the 36MHz mode is supported for now, the other modes can be implemented when there's a board which actually needs them. OpenWrt uses the out-of-tree vendor driver and all supported boards there only need the 36MHz mode. There are two input clocks: - the "pdi" clock enables the register access - the "phy" clock is the clock input and enables the internal PLL There are two reset lines: - "phy" resets the PHY itself - the "pcie" reset line is shared between the PHY and the PCIe controller While the VRX200 SoC has only one PCIe controller and PHY the ARX300 uses two identical PCIe controllers and PHYs which are compatible with the PCIe controller and PHY on VRX200. Add a driver for this PHY so PCIe support can be enabled on these SoCs. Signed-off-by: Martin Blumenstingl <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-23dt-bindings: phy: add binding for the Lantiq VRX200 and ARX300 PCIe PHYsMartin Blumenstingl2-0/+106
Add the bindings for the PCIe PHY on Lantiq VRX200 and ARX300 SoCs. The IP block contains settings for the PHY and a PLL. The PLL mode is configurable through a dedicated #phy-cell in .dts. Signed-off-by: Martin Blumenstingl <[email protected]> Reviewed-by: Rob Herring <[email protected]> Signed-off-by: Kishon Vijay Abraham I <[email protected]>
2019-08-22xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOTDarrick J. Wong1-0/+1
Benjamin Moody reported to Debian that XFS partially wedges when a chgrp fails on account of being out of disk quota. I ran his reproducer script: # adduser dummy # adduser dummy plugdev # dd if=/dev/zero bs=1M count=100 of=test.img # mkfs.xfs test.img # mount -t xfs -o gquota test.img /mnt # mkdir -p /mnt/dummy # chown -c dummy /mnt/dummy # xfs_quota -xc 'limit -g bsoft=100k bhard=100k plugdev' /mnt (and then as user dummy) $ dd if=/dev/urandom bs=1M count=50 of=/mnt/dummy/foo $ chgrp plugdev /mnt/dummy/foo and saw: ================================================ WARNING: lock held when returning to user space! 5.3.0-rc5 #rc5 Tainted: G W ------------------------------------------------ chgrp/47006 is leaving the kernel with locks still held! 1 lock held by chgrp/47006: #0: 000000006664ea2d (&xfs_nondir_ilock_class){++++}, at: xfs_ilock+0xd2/0x290 [xfs] ...which is clearly caused by xfs_setattr_nonsize failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. Add the missing unlock. Reported-by: [email protected] Fixes: 253f4911f297 ("xfs: better xfs_trans_alloc interface") Signed-off-by: Darrick J. Wong <[email protected]> Reviewed-by: Dave Chinner <[email protected]> Tested-by: Salvatore Bonaccorso <[email protected]>
2019-08-23Merge branch 'linux-5.3' of git://github.com/skeggsb/linux into drm-fixesDave Airlie1-7/+17
Fixes i2c on DP with some docks. Signed-off-by: Dave Airlie <[email protected]> From: Ben Skeggs <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv713t2_BQ44gVV7Lqic6Vwmhq0r4FB5v-t0kD1jzFrbmQ@mail.gmail.com
2019-08-23drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUXLyude Paul1-7/+17
While I had thought I had fixed this issue in: commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after ->fini()") It turns out that while I did fix the error messages I was seeing on my P50 when trying to access i2c busses with the GPU in runtime suspend, I accidentally had missed one important detail that was mentioned on the bug report this commit was supposed to fix: that the CPU would only lock up when trying to access i2c busses _on connected devices_ _while the GPU is not in runtime suspend_. Whoops. That definitely explains why I was not able to get my machine to hang with i2c bus interactions until now, as plugging my P50 into it's dock with an HDMI monitor connected allowed me to finally reproduce this locally. Now that I have managed to reproduce this issue properly, it looks like the problem is much simpler then it looks. It turns out that some connected devices, such as MST laptop docks, will actually ACK i2c reads even if no data was actually read: [ 275.063043] nouveau 0000:01:00.0: i2c: aux 000a: 1: 0000004c 1 [ 275.063447] nouveau 0000:01:00.0: i2c: aux 000a: 00 01101000 10040000 [ 275.063759] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000001 [ 275.064024] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 [ 275.064285] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 [ 275.064594] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 Because we don't handle the situation of i2c ack without any data, we end up entering an infinite loop in nvkm_i2c_aux_i2c_xfer() since the value of cnt always remains at 0. This finally properly explains how this could result in a CPU hang like the ones observed in the aforementioned commit. So, fix this by retrying transactions if no data is written or received, and give up and fail the transaction if we continue to not write or receive any data after 32 retries. Signed-off-by: Lyude Paul <[email protected]> Cc: [email protected] Signed-off-by: Ben Skeggs <[email protected]>
2019-08-22net/ncsi: Fix the payload copying for the request coming from Netlink[email protected]1-2/+9
The request coming from Netlink should use the OEM generic handler. The standard command handler expects payload in bytes/words/dwords but the actual payload is stored in data if the request is coming from Netlink. Signed-off-by: Justin Lee <[email protected]> Reviewed-by: Vijay Khemka <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-08-23drm/amdgpu/powerplay: silence a warning in smu_v11_0_setup_pptableAlex Deucher1-1/+1
I think gcc is confused as I don't see how size could be used unitialized, but go ahead and silence the warning. Signed-off-by: Alex Deucher <[email protected]> Reviewed-by: Evan Quan <[email protected]> Signed-off-by: Dave Airlie <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23Merge tag 'drm-misc-fixes-2019-08-22' of ↵Dave Airlie6-3/+40
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v5.3-rc6: - dma fix for omap. - Make output polling work on komeda. - Fix bpp computing for AFBC formats in komeda. - Support the memory-region property in komeda. Signed-off-by: Dave Airlie <[email protected]> From: Maarten Lankhorst <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23Merge tag 'drm-intel-fixes-2019-08-22' of ↵Dave Airlie2-3/+3
git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.3-rc6: - fix hardware state readout for 10 bpc HDMI Signed-off-by: Dave Airlie <[email protected]> From: Jani Nikula <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-08-23timekeeping/vsyscall: Prevent math overflow in BOOTTIME updateThomas Gleixner3-9/+23
The VDSO update for CLOCK_BOOTTIME has a overflow issue as it shifts the nanoseconds based boot time offset left by the clocksource shift. That overflows once the boot time offset becomes large enough. As a consequence CLOCK_BOOTTIME in the VDSO becomes a random number causing applications to misbehave. Fix it by storing a timespec64 representation of the offset when boot time is adjusted and add that to the MONOTONIC base time value in the vdso data page. Using the timespec64 representation avoids a 64bit division in the update code. Fixes: 44f57d788e7d ("timekeeping: Provide a generic update_vsyscall() implementation") Reported-by: Chris Clayton <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Tested-by: Chris Clayton <[email protected]> Tested-by: Vincenzo Frascino <[email protected]> Link: https://lkml.kernel.org/r/[email protected]
2019-08-22Merge tag 'wireless-drivers-for-davem-2019-08-21' of ↵David S. Miller9-19/+93
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.3 Third set of fixes for 5.3, and most likely the last one. The rt2x00 regression has been reported multiple times, others are of lower priority. mt76 * fix hang on resume on certain machines rt2x00 * fix AP mode regression related to encryption iwlwifi * avoid unnecessary error messages due to multicast frames when not associated * fix configuration for ax201 devices * fix recognition of QuZ devices ==================== Signed-off-by: David S. Miller <[email protected]>
2019-08-22qed: Add cleanup in qed_slowpath_start()Wenwen Wang1-1/+3
If qed_mcp_send_drv_version() fails, no cleanup is executed, leading to memory leaks. To fix this issue, introduce the label 'err4' to perform the cleanup work before returning the error. Signed-off-by: Wenwen Wang <[email protected]> Acked-by: Sudarsana Reddy Kalluru <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-08-22ocelot_ace: fix action of trapYangbo Lu1-1/+1
The trap action should be copying the frame to CPU and dropping it for forwarding, but current setting was just copying frame to CPU. Fixes: b596229448dd ("net: mscc: ocelot: Add support for tcam") Signed-off-by: Yangbo Lu <[email protected]> Acked-by: Allan W. Nielsen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-08-23um: fix time travel modeJohannes Berg3-12/+20
Unfortunately, my build fix for when time travel mode isn't enabled broke time travel mode, because I forgot that we need to use the timer time after the timer has been marked disabled, and thus need to leave the time stored instead of zeroing it. Fix that by splitting the inline into two, so we can call only the _mode() one in the relevant code path. Fixes: b482e48d29f1 ("um: fix build without CONFIG_UML_TIME_TRAVEL_SUPPORT") Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Richard Weinberger <[email protected]>
2019-08-22io_uring: add need_resched() check in inner poll loopJens Axboe1-1/+7
The outer poll loop checks for whether we need to reschedule, and returns to userspace if we do. However, it's possible to get stuck in the inner loop as well, if the CPU we are running on needs to reschedule to finish the IO work. Add the need_resched() check in the inner loop as well. This fixes a potential hang if the kernel is configured with CONFIG_PREEMPT_VOLUNTARY=y. Reported-by: Sagi Grimberg <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Tested-by: Sagi Grimberg <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-08-22misc: xilinx_sdfec: fix spelling mistake: "Schdule" -> "Schedule"Colin Ian King1-1/+1
There is a spelling mistake in a dev_dbg message, fix it. Signed-off-by: Colin Ian King <[email protected]> Reviewed-by: Dragan Cvetic <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-08-22misc: xilinx_sdfec: Prevent integer overflow in xsdfec_table_write()Dan Carpenter1-1/+3
The checking here needs to handle integer overflows because "offset" and "len" come from the user. Fixes: 20ec628e8007 ("misc: xilinx_sdfec: Add ability to configure LDPC") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Michal Simek <[email protected]> Reviewed-by: Dragan Cvetic <[email protected]> Link: https://lore.kernel.org/r/20190821071122.GD26957@mwanda Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-08-22misc: xilinx_sdfec: Prevent a divide by zero in xsdfec_reg0_write()Dan Carpenter1-1/+1
The "psize" value comes from the user so we need to verify that it's non-zero before we check if "n % psize" or it will crash. Fixes: 20ec628e8007 ("misc: xilinx_sdfec: Add ability to configure LDPC") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Michal Simek <[email protected]> Link: https://lore.kernel.org/r/20190821070953.GC26957@mwanda Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-08-22misc: xilinx_sdfec: Return -EFAULT if copy_from_user() failsDan Carpenter1-2/+3
The copy_from_user() function returns the number of bytes remaining to be copied but we want to return -EFAULT to the user. Fixes: 20ec628e8007 ("misc: xilinx_sdfec: Add ability to configure LDPC") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Michal Simek <[email protected]> Reviewed-by: Dragan Cvetic <[email protected]> Link: https://lore.kernel.org/r/20190822083105.GI3964@kadam Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-08-22misc: xilinx_sdfec: Fix a couple small information leaksDan Carpenter1-0/+2
These structs have holes in them so we end up disclosing a few bytes of uninitialized stack data. drivers/misc/xilinx_sdfec.c:305 xsdfec_get_status() warn: check that 'status' doesn't leak information (struct has a hole after 'activity') drivers/misc/xilinx_sdfec.c:449 xsdfec_get_turbo() warn: check that 'turbo_params' doesn't leak information (struct has a hole after 'scale') We need to zero out the holes with memset(). Fixes: 6bd6a690c2e7 ("misc: xilinx_sdfec: Add stats & status ioctls") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Dragan Cvetic <[email protected]> Reviewed-by: Michal Simek <[email protected]> Link: https://lore.kernel.org/r/20190821070606.GA26957@mwanda Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-08-22Merge tag 'pci-v5.3-fixes-1' of ↵Linus Torvalds3-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Reset both NVIDIA GPU and HDA in ThinkPad P50 quirk, which was broken by another quirk that enabled the HDA device (Lyude Paul) - Fix pciebus-howto.rst documentation filename typo (Bjorn Helgaas) * tag 'pci-v5.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: Documentation PCI: Fix pciebus-howto.rst filename typo PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround
2019-08-22net/mlx5e: Remove ethernet segment from dump WQEEran Ben Elisha1-16/+10
Dump WQE shall not include Ethernet segment. Define mlx5e_dump_wqe to be used for "Dump WQEs" instead of sharing it with the general mlx5e_tx_wqe layout. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Eran Ben Elisha <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2019-08-22net/mlx5e: Add num bytes metadata to WQE infoEran Ben Elisha1-5/+7
For TLS WQEs, metadata info did not include num_bytes. Due to this issue, tx_tls_dump_bytes counter did not increment. Modify tx_fill_wi() to fill num bytes. When it is called for non-traffic WQE, zero is expected. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Eran Ben Elisha <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2019-08-22net/mlx5: Fix delay in fw fatal report handling due to fw reportMoshe Shemesh1-9/+10
When fw fatal error occurs, poll health() first detects and reports on a fw error. Afterwards, it detects and reports on the fw fatal error itself. That can cause a long delay in fw fatal error handling which waits in a queue for the fw error handling to be finished. The fw error handle will try asking for fw core dump command while fw in fatal state may not respond and driver will wait for command timeout. Changing the flow to detect and handle first fw fatal errors and only if no fatal error detected look for a fw error to handle. Fixes: d1bf0e2cc4a6 ("net/mlx5: Report devlink health on FW issues") Signed-off-by: Moshe Shemesh <[email protected]> Reviewed-by: Eran Ben Elisha <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.