aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-02-04nvmet: fix dsm failure when payload does not match sgl descriptorSagi Grimberg4-2/+14
The host is allowed to pass the controller an sgl describing a buffer that is larger than the dsm payload itself, allow it when executing dsm. Reported-by: Dakshaja Uppalapati <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]>, Reviewed-by: Max Gurtovoy <[email protected]> Signed-off-by: Sagi Grimberg <[email protected]> Signed-off-by: Keith Busch <[email protected]>
2020-02-04nvmet: Pass lockdep expression to RCU listsAmol Grover1-2/+4
ctrl->subsys->namespaces and subsys->namespaces are traversed with list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of ctrl->subsys->lock and subsys->lock respectively. Hence, add the corresponding lockdep expression to the list traversal primitive to silence false-positive lockdep warnings, and harden RCU lists. Reported-by: kbuild test robot <[email protected]> Reviewed-by: Joel Fernandes (Google) <[email protected]> Signed-off-by: Amol Grover <[email protected]> Signed-off-by: Keith Busch <[email protected]>
2020-02-03initramfs: do not show compression mode choice if INITRAMFS_SOURCE is emptyMasahiro Yamada2-1/+2
Since commit ddd09bcc899f ("initramfs: make compression options not depend on INITRAMFS_SOURCE"), Kconfig asks the compression mode for the built-in initramfs regardless of INITRAMFS_SOURCE. It is technically simpler, but pointless from a UI perspective, Linus says [1]. When INITRAMFS_SOURCE is empty, usr/Makefile creates a tiny default cpio, which is so small that nobody cares about the compression. This commit hides the Kconfig choice in that case. The default cpio is embedded without compression, which was the original behavior. [1]: https://lkml.org/lkml/2020/2/1/160 Suggested-by: Linus Torvalds <[email protected]> Signed-off-by: Masahiro Yamada <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2020-02-03Merge tag 'for-5.6-tag' of ↵Linus Torvalds13-83/+193
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull more btrfs updates from David Sterba: "Fixes that arrived after the merge window freeze, mostly stable material. - fix race in tree-mod-log element tracking - fix bio flushing inside extent writepages - fix assertion when in-memory tracking of discarded extents finds an empty tree (eg. after adding a new device) - update logic of temporary read-only block groups to take into account overcommit - fix some fixup worker corner cases: - page could not go through proper COW cycle and the dirty status is lost due to page migration - deadlock if delayed allocation is performed under page lock - fix send emitting invalid clones within the same file - fix statfs reporting 0 free space when global block reserve size is larger than remaining free space but there is still space for new chunks" * tag 'for-5.6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: do not zero f_bavail if we have available space Btrfs: send, fix emission of invalid clone operations within the same file btrfs: do not do delalloc reservation under page lock btrfs: drop the -EBUSY case in __extent_writepage_io Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker btrfs: take overcommit into account in inc_block_group_ro btrfs: fix force usage in inc_block_group_ro btrfs: Correctly handle empty trees in find_first_clear_extent_bit btrfs: flush write bio if we loop in extent_write_cache_pages Btrfs: fix race between adding and putting tree mod seq elements and nodes
2020-02-03Merge tag 'kgdb-5.6-rc1' of ↵Linus Torvalds7-39/+19
git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Everything for kgdb this time around is either simplifications or clean ups. In particular Douglas Anderson's modifications to the backtrace machine in the *last* dev cycle have enabled Doug to tidy up some MIPS specific backtrace code and stop sharing certain data structures across the kernel. Note that The MIPS folks were on Cc: for the MIPS patch and reacted positively (but without an explicit Acked-by). Doug also got rid of the implicit switching between tasks and register sets during some but not of kdb's backtrace actions (because the implicit switching was either confusing for users, pointless or both). Finally there is a coverity fix and patch to replace open coded console traversal with the proper helper function" * tag 'kgdb-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: Use for_each_console() helper kdb: remove redundant assignment to pointer bp kdb: Get rid of confusing diag msg from "rd" if current task has no regs kdb: Gid rid of implicit setting of the current task / regs kdb: kdb_current_task shouldn't be exported kdb: kdb_current_regs should be private MIPS: kdb: Remove old workaround for backtracing on other CPUs
2020-02-03platform/chrome: cros_ec: Match implementation with headersEnric Balletbo i Serra8-10/+30
The 'cros_ec' core driver is the common interface for the cros_ec transport drivers to do the shared operations to register, unregister, suspend, resume and handle_event. The interface is provided by including the header 'include/linux/platform_data/cros_ec_proto.h', however, instead of have the implementation of these functions in cros_ec_proto.c, it is in 'cros_ec.c', which is a different kernel module. Apart from being a bad practice, this can induce confusions allowing the users of the cros_ec protocol to call these functions. The register, unregister, suspend, resume and handle_event functions *should* only be called by the different transport drivers (i2c, spi, lpc, etc.), so make this a bit less confusing by moving these functions from the public in-kernel space to a private include in platform/chrome, and then, the interface for cros_ec module and for the cros_ec_proto module is clean. Signed-off-by: Enric Balletbo i Serra <[email protected]> Signed-off-by: Benson Leung <[email protected]>
2020-02-03Merge tag 'char-misc-5.6-rc1-2' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fix from Greg KH: "Here is a single patch, that fixes up a commit that came in the previous char/misc merge. It fixes a bug in the hpet driver that everyone keeps tripping over in their automated testing. Good thing is, people are catching it. Bad thing it wasn't caught by anyone testing before this. Oh well... This has been in linux-next for a few days with no reported issues" * tag 'char-misc-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: char: hpet: Fix out-of-bounds read bug
2020-02-03Merge tag 'backlight-next-5.6' of ↵Linus Torvalds4-12/+18
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Fix-ups: - Remove superfluous code in ams369fg06 - Convert over to GPIO descriptor (gpiod) in bd6107 Bug Fixes: - Fix unsigned comparison to less than zero in qcom-wled" * tag 'backlight-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: qcom-wled: Fix unsigned comparison to zero backlight: bd6107: Convert to use GPIO descriptor backlight: ams369fg06: Drop GPIO include
2020-02-03Merge tag 'mfd-next-5.6' of ↵Linus Torvalds47-416/+2810
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Add support for ROHM BD71828 PMICs and GPIOs - Add support for Qualcomm Aqstic Audio Codecs WCD9340 and WCD9341 New Device Support: - Add support for BD71828 to BD70528 RTC driver - Add support for Intel's Jasper Lake to LPSS PCI New Functionality: - Add support for Power Key to ROHM BD71828 - Add support for Clocks to ROHM BD71828 - Add support for GPIOs to Dialog DA9062 - Add support for USB PD Notify to ChromiumOS EC - Allow callers to specify args when requesting regmap lookup; syscon Fix-ups: - Improve error handling and sanity checking; atmel-hlcdc, dln2 - Device Tree support/documentation; bd71828, da9062, xylon,logicvc, ab8500, max14577, atmel-usart - Match devices using platform IDs; bd7xxxx - Refactor BD718x7 regulator component; bd718x7-regulator - Use standard interfaces/helpers; syscon, sm501 - Trivial (whitespace, spelling, etc); ab8500-core, Kconfig - Remove unused code; db8500-prcmu, tqmx86 - Wait until boot has finished before accessing registers; madera-core - Provide missing register value defaults; cs47l15-tables - Allow more time for hardware to reset; madera-core Bug Fixes: - Fix erroneous register values; rohm-bd70528 - Fix register volatility; axp20x, rn5t618 - Fix Kconfig dependencies; MFD_MAX77650 - Fix incorrect compatible string; da9062-core - Fix syscon_regmap_lookup_by_phandle_args() stub; syscon" * tag 'mfd-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits) mfd: syscon: Fix syscon_regmap_lookup_by_phandle_args() dummy mfd: wcd934x: Add support to wcd9340/wcd9341 codec mfd: syscon: Add arguments support for syscon reference mfd: rn5t618: Mark ADC control register volatile dt-bindings: atmel-usart: Add microchip,sam9x60-{usart, dbgu} dt-bindings: atmel-usart: Remove wildcard mfd: cros_ec: Add cros-usbpd-notify subdevice mfd: da9062: Fix watchdog compatible string mfd: madera: Allow more time for hardware reset mfd: cs47l15: Add missing register default mfd: madera: Wait for boot done before accessing any other registers mfd: Kconfig: Rename Samsung to lowercase mfd: tqmx86: remove set but not used variable 'i2c_ien' mfd: dbx500-prcmu: Drop DSI pll clock functions mfd: dbx500-prcmu: Drop set_display_clocks() mfd: max77650: Select REGMAP_IRQ in Kconfig mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile mfd: ab8500: Fix ab8500-clk typo mfd: intel-lpss: Add Intel Jasper Lake PCI IDs dt-bindings: mfd: max14577: Add reference to max14040_battery.txt descriptions ...
2020-02-03Merge tag 'hyperv-next-signed' of ↵Linus Torvalds15-108/+574
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V updates from Sasha Levin: - Most of the commits here are work to enable host-initiated hibernation support by Dexuan Cui. - Fix for a warning shown when host sends non-aligned balloon requests by Tianyu Lan. * tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hv_utils: Add the support of hibernation hv_utils: Support host-initiated hibernation request hv_utils: Support host-initiated restart request Tools: hv: Reopen the devices if read() or write() returns errors video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs. Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) video: hyperv_fb: Fix hibernation for the deferred IO feature Input: hyperv-keyboard: Add the support of hibernation hv_balloon: Balloon up according to request page number
2020-02-03block, bfq: clarify the goal of bfq_split_bfqq()Paolo Valente1-0/+2
The exact, general goal of the function bfq_split_bfqq() is not that apparent. Add a comment to make it clear. Tested-by: Oleksandr Natalenko <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: get a ref to a group when adding it to a service treePaolo Valente3-3/+12
BFQ schedules generic entities, which may represent either bfq_queues or groups of bfq_queues. When an entity is inserted into a service tree, a reference must be taken, to make sure that the entity does not disappear while still referred in the tree. Unfortunately, such a reference is mistakenly taken only if the entity represents a bfq_queue. This commit takes a reference also in case the entity represents a group. Tested-by: Oleksandr Natalenko <[email protected]> Tested-by: Chris Evich <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: remove ifdefs from around gets/puts of bfq groupsPaolo Valente3-5/+6
ifdefs around gets and puts of bfq groups reduce readability, remove them. Tested-by: Oleksandr Natalenko <[email protected]> Reported-by: Jens Axboe <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: extend incomplete name of field on_stPaolo Valente4-7/+10
The flag on_st in the bfq_entity data structure is true if the entity is on a service tree or is in service. Yet the name of the field, confusingly, does not mention the second, very important case. Extend the name to mention the second case too. Tested-by: Oleksandr Natalenko <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: get extra ref to prevent a queue from being freed during a group ↵Paolo Valente1-0/+8
move In bfq_bfqq_move(), the bfq_queue, say Q, to be moved to a new group may happen to be deactivated in the scheduling data structures of the source group (and then activated in the destination group). If Q is referred only by the data structures in the source group when the deactivation happens, then Q is freed upon the deactivation. This commit addresses this issue by getting an extra reference before the possible deactivation, and releasing this extra reference after Q has been moved. Tested-by: Chris Evich <[email protected]> Tested-by: Oleksandr Natalenko <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: do not insert oom queue into position treePaolo Valente1-0/+4
BFQ maintains an ordered list, implemented with an RB tree, of head-request positions of non-empty bfq_queues. This position tree, inherited from CFQ, is used to find bfq_queues that contain I/O close to each other. BFQ merges these bfq_queues into a single shared queue, if this boosts throughput on the device at hand. There is however a special-purpose bfq_queue that does not participate in queue merging, the oom bfq_queue. Yet, also this bfq_queue could be wrongly added to the position tree. So bfqq_find_close() could return the oom bfq_queue, which is a source of further troubles in an out-of-memory situation. This commit prevents the oom bfq_queue from being inserted into the position tree. Tested-by: Patrick Dung <[email protected]> Tested-by: Oleksandr Natalenko <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03block, bfq: do not plug I/O for bfq_queues with no proc refsPaolo Valente1-0/+12
Commit 478de3380c1c ("block, bfq: deschedule empty bfq_queues not referred by any process") fixed commit 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging") by descheduling an empty bfq_queue when it remains with not process reference. Yet, this still left a case uncovered: an empty bfq_queue with not process reference that remains in service. This happens for an in-service sync bfq_queue that is deemed to deserve I/O-dispatch plugging when it remains empty. Yet no new requests will arrive for such a bfq_queue if no process sends requests to it any longer. Even worse, the bfq_queue may happen to be prematurely freed while still in service (because there may remain no reference to it any longer). This commit solves this problem by preventing I/O dispatch from being plugged for the in-service bfq_queue, if the latter has no process reference (the bfq_queue is then prevented from remaining in service). Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging") Tested-by: Oleksandr Natalenko <[email protected]> Reported-by: Patrick Dung <[email protected]> Tested-by: Patrick Dung <[email protected]> Signed-off-by: Paolo Valente <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-03ovl: fix lseek overflow on 32bitMiklos Szeredi1-1/+1
ovl_lseek() is using ssize_t to return the value from vfs_llseek(). On a 32-bit kernel ssize_t is a 32-bit signed int, which overflows above 2 GB. Assign the return value of vfs_llseek() to loff_t to fix this. Reported-by: Boris Gjenero <[email protected]> Fixes: 9e46b840c705 ("ovl: support stacked SEEK_HOLE/SEEK_DATA") Cc: <[email protected]> # v4.19 Signed-off-by: Miklos Szeredi <[email protected]>
2020-02-03rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnectDavid Howells5-24/+15
When a call is disconnected, the connection pointer from the call is cleared to make sure it isn't used again and to prevent further attempted transmission for the call. Unfortunately, there might be a daemon trying to use it at the same time to transmit a packet. Fix this by keeping call->conn set, but setting a flag on the call to indicate disconnection instead. Remove also the bits in the transmission functions where the conn pointer is checked and a ref taken under spinlock as this is now redundant. Fixes: 8d94aa381dab ("rxrpc: Calls shouldn't hold socket refs") Signed-off-by: David Howells <[email protected]>
2020-02-03mfd: syscon: Fix syscon_regmap_lookup_by_phandle_args() dummyGeert Uytterhoeven1-1/+1
If CONFIG_MFD_SYSCON=n: include/linux/mfd/syscon.h:54:23: warning: ‘syscon_regmap_lookup_by_phandle_args’ defined but not used [-Wunused-function] Fix this by adding the missing inline keyword. Fixes: 6a24f567af4accef ("mfd: syscon: Add arguments support for syscon reference") Signed-off-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Lee Jones <[email protected]>
2020-02-03dmaengine: Cleanups for the slave <-> channel symlink supportPeter Ujfalusi1-9/+9
No need to use goto to jump over the return chan ? chan : ERR_PTR(-EPROBE_DEFER); We can just revert the check and return right there. Do not fail the channel request if the chan->name allocation fails, but print a warning about it. Change the dev_err to dev_warn if sysfs_create_link() fails as it is not fatal. Only attempt to remove the DMA_SLAVE_NAME symlink if it is created - or it was attempted to be created. Signed-off-by: Peter Ujfalusi <[email protected]> Reviewed-by: Geert Uytterhoeven <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]>
2020-02-03dmaengine: fix null ptr check for __dma_async_device_channel_register()Dave Jiang1-0/+3
Add check to pointer after assignment before accessing members. Fixes: d2fb0a043838: ("dmaengine: break out channel registration") Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Dave Jiang <[email protected]> Link: https://lore.kernel.org/r/158049351973.45445.3291586905226032744.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul <[email protected]>
2020-02-03dmaengine: idxd: fix boolconv.cocci warningskbuild test robot1-1/+1
Remove unneeded conversion to bool Generated by: scripts/coccinelle/misc/boolconv.cocci CC: Dave Jiang <[email protected]> Signed-off-by: kbuild test robot <[email protected]> Signed-off-by: Julia Lawall <[email protected]> Acked-by: Dave Jiang <[email protected]> Link: https://lore.kernel.org/r/alpine.DEB.2.21.2001301543150.7476@hadrien Signed-off-by: Vinod Koul <[email protected]>
2020-02-02Merge branch 'Fix-reconnection-latency-caused-by-FIN-ACK-handling-race'Jakub Kicinski5-1/+196
SeongJae Park says: ==================== Fix reconnection latency caused by FIN/ACK handling race The first patch fixes the problem by adjusting the first resend delay of the SYN in the case. The second one adds a user space test to reproduce this problem. From v2 (https://lore.kernel.org/linux-kselftest/[email protected]/) - Use TCP_TIMEOUT_MIN as reduced delay (Neal Cardwall) - Add Reviewed-by and Signed-off-by from Eric Dumazet From v1 (https://lore.kernel.org/linux-kselftest/[email protected]/) - Drop the trivial comment fix patch (Eric Dumazet) - Limit the delay adjustment to only the first SYN resend (Eric Dumazet) - selftest: Avoid use of hard-coded port number (Eric Dumazet) - Explain RST/ACK and FIN/ACK has no big difference (Neal Cardwell) ==================== Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-02selftests: net: Add FIN_ACK processing order related latency spike testSeongJae Park4-0/+189
This commit adds a test for FIN_ACK process races related reconnection latency spike issues. The issue has described and solved by the previous commit ("tcp: Reduce SYN resend delay if a suspicous ACK is received"). The test program is configured with a server and a client process. The server creates and binds a socket to a port that dynamically allocated, listen on it, and start a infinite loop. Inside the loop, it accepts connection, reads 4 bytes from the socket, and closes the connection. The client is constructed as an infinite loop. Inside the loop, it creates a socket with LINGER and NODELAY option, connect to the server, send 4 bytes data, try read some data from server. After the read() returns, it measure the latency from the beginning of this loop to this point and if the latency is larger than 1 second (spike), print a message. Reviewed-by: Eric Dumazet <[email protected]> Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-02tcp: Reduce SYN resend delay if a suspicous ACK is receivedSeongJae Park1-1/+7
When closing a connection, the two acks that required to change closing socket's status to FIN_WAIT_2 and then TIME_WAIT could be processed in reverse order. This is possible in RSS disabled environments such as a connection inside a host. For example, expected state transitions and required packets for the disconnection will be similar to below flow. 00 (Process A) (Process B) 01 ESTABLISHED ESTABLISHED 02 close() 03 FIN_WAIT_1 04 ---FIN--> 05 CLOSE_WAIT 06 <--ACK--- 07 FIN_WAIT_2 08 <--FIN/ACK--- 09 TIME_WAIT 10 ---ACK--> 11 LAST_ACK 12 CLOSED CLOSED In some cases such as LINGER option applied socket, the FIN and FIN/ACK will be substituted to RST and RST/ACK, but there is no difference in the main logic. The acks in lines 6 and 8 are the acks. If the line 8 packet is processed before the line 6 packet, it will be just ignored as it is not a expected packet, and the later process of the line 6 packet will change the status of Process A to FIN_WAIT_2, but as it has already handled line 8 packet, it will not go to TIME_WAIT and thus will not send the line 10 packet to Process B. Thus, Process B will left in CLOSE_WAIT status, as below. 00 (Process A) (Process B) 01 ESTABLISHED ESTABLISHED 02 close() 03 FIN_WAIT_1 04 ---FIN--> 05 CLOSE_WAIT 06 (<--ACK---) 07 (<--FIN/ACK---) 08 (fired in right order) 09 <--FIN/ACK--- 10 <--ACK--- 11 (processed in reverse order) 12 FIN_WAIT_2 Later, if the Process B sends SYN to Process A for reconnection using the same port, Process A will responds with an ACK for the last flow, which has no increased sequence number. Thus, Process A will send RST, wait for TIMEOUT_INIT (one second in default), and then try reconnection. If reconnections are frequent, the one second latency spikes can be a big problem. Below is a tcpdump results of the problem: 14.436259 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [S], seq 2560603644 14.436266 IP 127.0.0.1.4242 > 127.0.0.1.45150: Flags [.], ack 5, win 512 14.436271 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [R], seq 2541101298 /* ONE SECOND DELAY */ 15.464613 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [S], seq 2560603644 This commit mitigates the problem by reducing the delay for the next SYN if the suspicous ACK is received while in SYN_SENT state. Following commit will add a selftest, which can be also helpful for understanding of this issue. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-02MAINTAINERS: correct entries for ISDN/mISDN sectionLukas Bulwahn1-2/+4
Commit 6d97985072dc ("isdn: move capi drivers to staging") cleaned up the isdn drivers and split the MAINTAINERS section for ISDN, but missed to add the terminal slash for the two directories mISDN and hardware. Hence, all files in those directories were not part of the new ISDN/mISDN SUBSYSTEM, but were considered to be part of "THE REST". Rectify the situation, and while at it, also complete the section with two further build files that belong to that subsystem. This was identified with a small script that finds all files belonging to "THE REST" according to the current MAINTAINERS file, and I investigated upon its output. Fixes: 6d97985072dc ("isdn: move capi drivers to staging") Signed-off-by: Lukas Bulwahn <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds1-2/+2
Pull sparc fix from David Miller: "adjtimex regression fix from Arnd" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: fix adjtimex regression
2020-02-02Merge tag 'leds-5.6-rc1' of ↵Linus Torvalds13-94/+425
git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: - New driver for TI TPS6105X - Add managed API to get a LED from a device driver - Misc fixes and updates * tag 'leds-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: (22 commits) leds: lm3692x: Disable chip on brightness 0 leds: lm3692x: Split out lm3692x_leds_disable leds: lm3692x: Move lm3692x_init and rename to lm3692x_leds_enable leds: lm3692x: Make sure we don't exceed the maximum LED current dt: bindings: lm3692x: Add led-max-microamp property leds: lm3692x: Allow to configure over voltage protection dt: bindings: lm3692x: Add ti,ovp-microvolt property leds: populate the device's of_node leds: Add managed API to get a LED from a device driver leds: Add of_led_get() and led_put() leds: lm3532: add pointer to documentation and fix typo leds: lm3532: use extended registration so that LED can be used for backlight leds: lm3642: remove warnings for bad strtol, cleanup gotos leds: rb532: cleanup whitespace ledtrig-pattern: fix email address quoting in MODULE_AUTHOR() dt-bindings: mfd: update TI tps6105x chip bindings leds: tps6105x: add driver for MFD chip LED mode led: max77650: add of_match table leds: bd2802: Convert to use GPIO descriptors leds: pca963x: Fix open-drain initialization ...
2020-02-02Merge branch 'pcmcia-next' of ↵Linus Torvalds2-348/+311
git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull pcmcia updates from Dominik Brodowski: "This is a series co-developed by Simon Geis and Lukas Panzer to clean up the i82092 PCMCIA device driver" * 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: PCMCIA/i82092: remove #if 0 block PCMCIA/i82092: delete enter/leave macro PCMCIA/i82092: include <linux/io.h> instead of <asm/io.h> PCMCIA/i82092: shorten the lines with over 80 characters PCMCIA/i82092: move assignment out of if condition PCMCIA/i82092: change code indentation PCMCIA/i82092: insert blank line after declarations PCMCIA/i82092: remove braces around single statement blocks PCMCIA/i82092: add/remove spaces to improve readability PCMCIA/i82092: use dev_<level> instead of printk
2020-02-02btrfs: do not zero f_bavail if we have available spaceJosef Bacik1-1/+9
There was some logic added a while ago to clear out f_bavail in statfs() if we did not have enough free metadata space to satisfy our global reserve. This was incorrect at the time, however didn't really pose a problem for normal file systems because we would often allocate chunks if we got this low on free metadata space, and thus wouldn't really hit this case unless we were actually full. Fast forward to today and now we are much better about not allocating metadata chunks all of the time. Couple this with d792b0f19711 ("btrfs: always reserve our entire size for the global reserve") which now means we'll easily have a larger global reserve than our free space, we are now more likely to trip over this while still having plenty of space. Fix this by skipping this logic if the global rsv's space_info is not full. space_info->full is 0 unless we've attempted to allocate a chunk for that space_info and that has failed. If this happens then the space for the global reserve is definitely sacred and we need to report b_avail == 0, but before then we can just use our calculated b_avail. Reported-by: Martin Steigerwald <[email protected]> Fixes: ca8a51b3a979 ("btrfs: statfs: report zero available if metadata are exhausted") CC: [email protected] # 4.5+ Reviewed-by: Qu Wenruo <[email protected]> Tested-By: Martin Steigerwald <[email protected]> Signed-off-by: Josef Bacik <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: David Sterba <[email protected]>
2020-02-02sparc64: fix adjtimex regressionArnd Bergmann1-2/+2
Anatoly Pugachev reported one of the y2038 patches to introduce a fatal bug from a stupid typo: [ 96.384129] watchdog: BUG: soft lockup - CPU#8 stuck for 22s! ... [ 96.385624] [0000000000652ca4] handle_mm_fault+0x84/0x320 [ 96.385668] [0000000000b6f2bc] do_sparc64_fault+0x43c/0x820 [ 96.385720] [0000000000407754] sparc64_realfault_common+0x10/0x20 [ 96.385769] [000000000042fa28] __do_sys_sparc_clock_adjtime+0x28/0x80 [ 96.385819] [00000000004307f0] sys_sparc_clock_adjtime+0x10/0x20 [ 96.385866] [0000000000406294] linux_sparc_syscall+0x34/0x44 Fix the code to dereference the correct pointer again. Reported-by: Anatoly Pugachev <[email protected]> Tested-by: Anatoly Pugachev <[email protected]> Fixes: 251ec1c159e4 ("y2038: sparc: remove use of struct timex") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2020-02-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfJakub Kicinski6-26/+28
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix suspicious RCU usage in ipset, from Jozsef Kadlecsik. 2) Use kvcalloc, from Joe Perches. 3) Flush flowtable hardware workqueue after garbage collection run, from Paul Blakey. 4) Missing flowtable hardware workqueue flush from nf_flow_table_free(), also from Paul. 5) Restore NF_FLOW_HW_DEAD in flow_offload_work_del(), from Paul. 6) Flowtable documentation fixes, from Matteo Croce. ==================== Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-01cls_rsvp: fix rsvp_policyEric Dumazet1-4/+2
NLA_BINARY can be confusing, since .len value represents the max size of the blob. cls_rsvp really wants user space to provide long enough data for TCA_RSVP_DST and TCA_RSVP_SRC attributes. BUG: KMSAN: uninit-value in rsvp_get net/sched/cls_rsvp.h:258 [inline] BUG: KMSAN: uninit-value in gen_handle net/sched/cls_rsvp.h:402 [inline] BUG: KMSAN: uninit-value in rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 CPU: 1 PID: 13228 Comm: syz-executor.1 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 rsvp_get net/sched/cls_rsvp.h:258 [inline] gen_handle net/sched/cls_rsvp.h:402 [inline] rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 tc_new_tfilter+0x31fe/0x5010 net/sched/cls_api.c:2104 rtnetlink_rcv_msg+0xcb7/0x1570 net/core/rtnetlink.c:5415 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b349 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f269d43dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f269d43e6d4 RCX: 000000000045b349 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000009c2 R14: 00000000004cb338 R15: 000000000075bfd4 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x7d3/0x14d0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 6fa8c0144b77 ("[NET_SCHED]: Use nla_policy for attribute validation in classifiers") Signed-off-by: Eric Dumazet <[email protected]> Reported-by: syzbot <[email protected]> Acked-by: Cong Wang <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-01MAINTAINERS: Orphan HSR network protocolSven Eckelmann1-2/+1
The current maintainer Arvid Brodin <[email protected]> hasn't contributed to the kernel since 2015-02-27. His company mail address is also bouncing and the company confirmed (2020-01-31) that no Arvid Brodin is working for them: > Vi har dessvärre ingen Arvid Brodin som arbetar på ALTEN. A MIA person cannot be the maintainer. It is better to mark is as orphaned until some other person can jump in and take over the responsibility for HSR. Signed-off-by: Sven Eckelmann <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-01qed: Fix a error code in qed_hw_init()Dan Carpenter1-0/+1
If the qed_fw_overlay_mem_alloc() then we should return -ENOMEM instead of success. Fixes: 30d5f85895fa ("qed: FW 8.42.2.0 Add fw overlay feature") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-01octeontx2-pf: Fix an IS_ERR() vs NULL bugDan Carpenter1-2/+2
The otx2_mbox_get_rsp() function never returns NULL, it returns error pointers on error. Fixes: 34bfe0ebedb7 ("octeontx2-pf: MTU, MAC and RX mode config support") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-02-01Merge tag '5.6-rc-small-smb3-fix-for-stable' of ↵Linus Torvalds2-2/+2
git://git.samba.org/sfrench/cifs-2.6 Pull cifs fix from Steve French: "Small SMB3 fix for stable (fixes problem with soft mounts)" * tag '5.6-rc-small-smb3-fix-for-stable' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number cifs: fix soft mounts hanging in the reconnect code
2020-02-01vfs: fix do_last() regressionAl Viro1-2/+2
Brown paperbag time: fetching ->i_uid/->i_mode really should've been done from nd->inode. I even suggested that, but the reason for that has slipped through the cracks and I went for dir->d_inode instead - made for more "obvious" patch. Analysis: - at the entry into do_last() and all the way to step_into(): dir (aka nd->path.dentry) is known not to have been freed; so's nd->inode and it's equal to dir->d_inode unless we are already doomed to -ECHILD. inode of the file to get opened is not known. - after step_into(): inode of the file to get opened is known; dir might be pointing to freed memory/be negative/etc. - at the call of may_create_in_sticky(): guaranteed to be out of RCU mode; inode of the file to get opened is known and pinned; dir might be garbage. The last was the reason for the original patch. Except that at the do_last() entry we can be in RCU mode and it is possible that nd->path.dentry->d_inode has already changed under us. In that case we are going to fail with -ECHILD, but we need to be careful; nd->inode is pointing to valid struct inode and it's the same as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we should use that. Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <[email protected]> Reported-by: [email protected] Wearing-brown-paperbag: Al Viro <[email protected]> Cc: [email protected] Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late") Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2020-02-01Merge tag 'kconfig-v5.6' of ↵Linus Torvalds14-133/+174
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kconfig updates from Masahiro Yamada: - add 'yes2modconfig' and 'mod2yesconfig' targets (useful mainly for turning syzbot configs into more modular ones as a step to minimizing the result) - sanitize help text - various code cleanups * tag 'kconfig-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: fix documentation typos kconfig: fix an "implicit declaration of function" warning kconfig: fix nesting of symbol help text kconfig: distinguish between dependencies and visibility in help text kconfig: list all definitions of a symbol in help text kconfig: Add yes2modconfig and mod2yesconfig targets. kconfig: use $(PERL) in Makefile kconfig: fix too deep indentation in Makefile kconfig: localmodconfig: fix indentation for closing brace kconfig: localmodconfig: remove unused $config kconfig: squash prop_alloc() into menu_add_prop() kconfig: remove sym from struct property kconfig: remove 'prompt' argument from menu_add_prop() kconfig: move prompt handling to menu_add_prompt() from menu_add_prop() kconfig: remove 'prompt' symbol kconfig: drop T_WORD from the RHS of 'prompt' symbol kconfig: use parent->dep as the parentdep of 'menu' kconfig: remove the rootmenu check in menu_add_prop()
2020-02-01Merge tag 'kbuild-v5.6' of ↵Linus Torvalds20-449/+281
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - detect missing include guard in UAPI headers - do not create orphan built-in.a or obj-y objects - generate modules.builtin more simply, and drop tristate.conf - simplify built-in initramfs creation - make linux-headers deb package thinner - optimize the deb package build script - misc cleanups * tag 'kbuild-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (34 commits) builddeb: split libc headers deployment out into a function builddeb: split kernel headers deployment out into a function builddeb: remove redundant make for ARCH=um builddeb: avoid invoking sub-shells where possible builddeb: remove redundant $objtree/ builddeb: match temporary directory name to the package name builddeb: remove unneeded files in hdrobjfiles for headers package kbuild: use -S instead of -E for precise cc-option test in Kconfig builddeb: allow selection of .deb compressor kbuild: remove 'Building modules, stage 2.' log kbuild: remove *.tmp file when filechk fails kbuild: remove PYTHON2 variable modpost: assume STT_SPARC_REGISTER is defined gen_initramfs.sh: remove intermediate cpio_list on errors initramfs: refactor the initramfs build rules gen_initramfs.sh: always output cpio even without -o option initramfs: add default_cpio_list, and delete -d option support initramfs: generate dependency list and cpio at the same time initramfs: specify $(src)/gen_initramfs.sh as a prerequisite in Makefile initramfs: make initramfs compression choice non-optional ...
2020-02-01Merge tag 'random_for_linus' of ↵Linus Torvalds6-330/+89
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random Pull random changes from Ted Ts'o: "Change /dev/random so that it uses the CRNG and only blocking if the CRNG hasn't initialized, instead of the old blocking pool. Also clean up archrandom.h, and some other miscellaneous cleanups" * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: (24 commits) s390x: Mark archrandom.h functions __must_check powerpc: Mark archrandom.h functions __must_check powerpc: Use bool in archrandom.h x86: Mark archrandom.h functions __must_check linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check linux/random.h: Use false with bool linux/random.h: Remove arch_has_random, arch_has_random_seed s390: Remove arch_has_random, arch_has_random_seed powerpc: Remove arch_has_random, arch_has_random_seed x86: Remove arch_has_random, arch_has_random_seed random: remove some dead code of poolinfo random: fix typo in add_timer_randomness() random: Add and use pr_fmt() random: convert to ENTROPY_BITS for better code readability random: remove unnecessary unlikely() random: remove kernel.random.read_wakeup_threshold random: delete code to pull data into pools random: remove the blocking pool random: make /dev/random be almost like /dev/urandom random: ignore GRND_RANDOM in getentropy(2) ...
2020-02-01bcache: check return value of prio_read()Coly Li1-5/+16
Now if prio_read() failed during starting a cache set, we can print out error message in run_cache_set() and handle the failure properly. Signed-off-by: Coly Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-01bcache: fix incorrect data type usage in btree_flush_write()Coly Li1-1/+2
Dan Carpenter points out that from commit 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()"), there is a incorrect data type usage which leads to the following static checker warning: drivers/md/bcache/journal.c:444 btree_flush_write() warn: 'ref_nr' unsigned <= 0 drivers/md/bcache/journal.c 422 static void btree_flush_write(struct cache_set *c) 423 { 424 struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR]; 425 unsigned int i, nr, ref_nr; ^^^^^^ 426 atomic_t *fifo_front_p, *now_fifo_front_p; 427 size_t mask; 428 429 if (c->journal.btree_flushing) 430 return; 431 432 spin_lock(&c->journal.flush_write_lock); 433 if (c->journal.btree_flushing) { 434 spin_unlock(&c->journal.flush_write_lock); 435 return; 436 } 437 c->journal.btree_flushing = true; 438 spin_unlock(&c->journal.flush_write_lock); 439 440 /* get the oldest journal entry and check its refcount */ 441 spin_lock(&c->journal.lock); 442 fifo_front_p = &fifo_front(&c->journal.pin); 443 ref_nr = atomic_read(fifo_front_p); 444 if (ref_nr <= 0) { ^^^^^^^^^^^ Unsigned can't be less than zero. 445 /* 446 * do nothing if no btree node references 447 * the oldest journal entry 448 */ 449 spin_unlock(&c->journal.lock); 450 goto out; 451 } 452 spin_unlock(&c->journal.lock); As the warning information indicates, local varaible ref_nr in unsigned int type is wrong, which does not matche atomic_read() and the "<= 0" checking. This patch fixes the above error by defining local variable ref_nr as int type. Fixes: 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()") Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Coly Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-01bcache: add readahead cache policy options via sysfs interfaceColy Li3-5/+37
In year 2007 high performance SSD was still expensive, in order to save more space for real workload or meta data, the readahead I/Os for non-meta data was bypassed and not cached on SSD. In now days, SSD price drops a lot and people can find larger size SSD with more comfortable price. It is unncessary to alway bypass normal readahead I/Os to save SSD space for now. This patch adds options for readahead data cache policies via sysfs file /sys/block/bcache<N>/readahead_cache_policy, the options are, - "all": cache all readahead data I/Os. - "meta-only": only cache meta data, and bypass other regular I/Os. If users want to make bcache continue to only cache readahead request for metadata and bypass regular data readahead, please set "meta-only" to this sysfs file. By default, bcache will back to cache all read- ahead requests now. Cc: [email protected] Signed-off-by: Coly Li <[email protected]> Acked-by: Eric Wheeler <[email protected]> Cc: Michael Lyle <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-01bcache: explicity type cast in bset_bkey_last()Coly Li1-1/+2
In bset.h, macro bset_bkey_last() is defined as, bkey_idx((struct bkey *) (i)->d, (i)->keys) Parameter i can be variable type of data structure, the macro always works once the type of struct i has member 'd' and 'keys'. bset_bkey_last() is also used in macro csum_set() to calculate the checksum of a on-disk data structure. When csum_set() is used to calculate checksum of on-disk bcache super block, the parameter 'i' data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in struct cache_sb) the member keys is __u16 type. But bkey_idx() expects unsigned int (a 32bit width), so there is problem when sending parameters via stack to call bkey_idx(). Sparse tool from Intel 0day kbuild system reports this incompatible problem. bkey_idx() is part of user space API, so the simplest fix is to cast the (i)->keys to unsigned int type in macro bset_bkey_last(). Reported-by: kbuild test robot <[email protected]> Signed-off-by: Coly Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-01bcache: fix memory corruption in bch_cache_accounting_clear()Coly Li1-3/+7
Commit 83ff9318c44ba ("bcache: not use hard coded memset size in bch_cache_accounting_clear()") tries to make the code more easy to understand by removing the hard coded number with following change, void bch_cache_accounting_clear(...) { memset(&acc->total.cache_hits, 0, - sizeof(unsigned long) * 7); + sizeof(struct cache_stats)); } Unfortunately the change was wrong (it also tells us the original code was not easy to correctly understand). The hard coded number 7 is used because in struct cache_stats, 15 struct cache_stats { 16 struct kobject kobj; 17 18 unsigned long cache_hits; 19 unsigned long cache_misses; 20 unsigned long cache_bypass_hits; 21 unsigned long cache_bypass_misses; 22 unsigned long cache_readaheads; 23 unsigned long cache_miss_collisions; 24 unsigned long sectors_bypassed; 25 26 unsigned int rescale; 27 }; only members in LINE 18-24 want to be set to 0. It is wrong to use 'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the memory objects behind acc->total is staled by this change. Сорокин Артем Сергеевич reports that by the following steps, kernel panic will be triggered, 1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache 2. Run in /sys/fs/bcache/<uuid>: echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits I can reproduce the panic and get following dmesg with KASAN enabled, [22613.172742] ================================================================== [22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230 [22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753 [22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11 [22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.172873] Call Trace: [22613.172964] dump_stack+0x8b/0xbb [22613.172968] ? sysfs_kf_seq_show+0x117/0x230 [22613.172970] ? sysfs_kf_seq_show+0x117/0x230 [22613.173031] __kasan_report+0x176/0x192 [22613.173064] ? pr_cont_kernfs_name+0x40/0x60 [22613.173067] ? sysfs_kf_seq_show+0x117/0x230 [22613.173070] kasan_report+0xe/0x20 [22613.173072] sysfs_kf_seq_show+0x117/0x230 [22613.173105] seq_read+0x199/0x6d0 [22613.173110] vfs_read+0xa5/0x1a0 [22613.173113] ksys_read+0x110/0x160 [22613.173115] ? kernel_write+0xb0/0xb0 [22613.173177] do_syscall_64+0x77/0x290 [22613.173238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.173241] RIP: 0033:0x7fc2c886ac61 [22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.173255] ================================================================== [22613.173256] Disabling lock debugging due to kernel taint [22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000 [22613.178380] #PF: supervisor read access in kernel mode [22613.180959] #PF: error_code(0x0000) - not-present page [22613.183444] PGD 0 P4D 0 [22613.184867] Oops: 0000 [#1] SMP KASAN PTI [22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G B 5.5.0-rc7-lp151.28.16-default+ #11 [22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.226290] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.229637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 [22613.234909] Call Trace: [22613.235931] seq_read+0x199/0x6d0 [22613.237259] vfs_read+0xa5/0x1a0 [22613.239229] ksys_read+0x110/0x160 [22613.240590] ? kernel_write+0xb0/0xb0 [22613.242040] do_syscall_64+0x77/0x290 [22613.243625] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.245450] RIP: 0033:0x7fc2c886ac61 [22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [22613.292429] CR2: 0000000000000000 [22613.293563] ---[ end trace a074b26a8508f378 ]--- [22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.318116] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.320743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 Here this patch fixes the following problem by explicity set all the 7 members to 0 in bch_cache_accounting_clear(). Reported-by: Сорокин Артем Сергеевич <[email protected]> Signed-off-by: Coly Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2020-02-01Merge branch 'topic/user-access-begin' into nextMichael Ellerman535-3224/+4298
Merge the user_access_begin() series from Christophe. This is based on a commit from Linus that went into v5.5-rc7.
2020-01-31tcp: clear tp->segs_{in|out} in tcp_disconnect()Eric Dumazet1-0/+2
tp->segs_in and tp->segs_out need to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: 2efd055c53c0 ("tcp: add tcpi_segs_in and tcpi_segs_out to tcp_info") Signed-off-by: Eric Dumazet <[email protected]> Cc: Marcelo Ricardo Leitner <[email protected]> Cc: Yuchung Cheng <[email protected]> Cc: Neal Cardwell <[email protected]> Acked-by: Neal Cardwell <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
2020-01-31tcp: clear tp->data_segs{in|out} in tcp_disconnect()Eric Dumazet1-0/+2
tp->data_segs_in and tp->data_segs_out need to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: a44d6eacdaf5 ("tcp: Add RFC4898 tcpEStatsPerfDataSegsOut/In") Signed-off-by: Eric Dumazet <[email protected]> Cc: Martin KaFai Lau <[email protected]> Cc: Yuchung Cheng <[email protected]> Cc: Neal Cardwell <[email protected]> Acked-by: Neal Cardwell <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.