aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-08-02zram: do not free pool->size_classMinchan Kim1-1/+0
Mike reported kernel goes oops with ltp:zram03 testcase. zram: Added device: zram0 zram0: detected capacity change from 0 to 107374182400 BUG: unable to handle kernel paging request at 0000306d61727a77 IP: zs_map_object+0xb9/0x260 PGD 0 P4D 0 Oops: 0000 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: zram(E) xfs(E) libcrc32c(E) btrfs(E) xor(E) raid6_pq(E) loop(E) ebtable_filter(E) ebtables(E) ip6table_filter(E) ip6_tables(E) iptable_filter(E) ip_tables(E) x_tables(E) af_packet(E) br_netfilter(E) bridge(E) stp(E) llc(E) iscsi_ibft(E) iscsi_boot_sysfs(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) intel_powerclamp(E) coretemp(E) cdc_ether(E) kvm_intel(E) usbnet(E) mii(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) iTCO_wdt(E) ghash_clmulni_intel(E) bnx2(E) iTCO_vendor_support(E) pcbc(E) ioatdma(E) ipmi_ssif(E) aesni_intel(E) i5500_temp(E) i2c_i801(E) aes_x86_64(E) lpc_ich(E) shpchp(E) mfd_core(E) crypto_simd(E) i7core_edac(E) dca(E) glue_helper(E) cryptd(E) ipmi_si(E) button(E) acpi_cpufreq(E) ipmi_devintf(E) pcspkr(E) ipmi_msghandler(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) ext4(E) crc16(E) mbcache(E) jbd2(E) sd_mod(E) ata_generic(E) i2c_algo_bit(E) ata_piix(E) drm_kms_helper(E) ahci(E) syscopyarea(E) sysfillrect(E) libahci(E) sysimgblt(E) fb_sys_fops(E) uhci_hcd(E) ehci_pci(E) ttm(E) ehci_hcd(E) libata(E) drm(E) megaraid_sas(E) usbcore(E) sg(E) dm_multipath(E) dm_mod(E) scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) scsi_mod(E) efivarfs(E) autofs4(E) [last unloaded: zram] CPU: 6 PID: 12356 Comm: swapon Tainted: G E 4.13.0.g87b2c3f-default #194 Hardware name: IBM System x3550 M3 -[7944K3G]-/69Y5698 , BIOS -[D6E150AUS-1.10]- 12/15/2010 task: ffff880158d2c4c0 task.stack: ffffc90001680000 RIP: 0010:zs_map_object+0xb9/0x260 Call Trace: zram_bvec_rw.isra.26+0xe8/0x780 [zram] zram_rw_page+0x6e/0xa0 [zram] bdev_read_page+0x81/0xb0 do_mpage_readpage+0x51a/0x710 mpage_readpages+0x122/0x1a0 blkdev_readpages+0x1d/0x20 __do_page_cache_readahead+0x1b2/0x270 ondemand_readahead+0x180/0x2c0 page_cache_sync_readahead+0x31/0x50 generic_file_read_iter+0x7e7/0xaf0 blkdev_read_iter+0x37/0x40 __vfs_read+0xce/0x140 vfs_read+0x9e/0x150 SyS_read+0x46/0xa0 entry_SYSCALL_64_fastpath+0x1a/0xa5 Code: 81 e6 00 c0 3f 00 81 fe 00 00 16 00 0f 85 9f 01 00 00 0f b7 13 65 ff 05 5e 07 dc 7e 66 c1 ea 02 81 e2 ff 01 00 00 49 8b 54 d4 08 <8b> 4a 48 41 0f af ce 81 e1 ff 0f 00 00 41 89 c9 48 c7 c3 a0 70 RIP: zs_map_object+0xb9/0x260 RSP: ffffc90001683988 CR2: 0000306d61727a77 He bisected the problem is [1]. After commit cf8e0fedf078 ("mm/zsmalloc: simplify zs_max_alloc_size handling"), zram doesn't use double pointer for pool->size_class any more in zs_create_pool so counter function zs_destroy_pool don't need to free it, either. Otherwise, it does kfree wrong address and then, kernel goes Oops. Link: http://lkml.kernel.org/r/20170725062650.GA12134@bbox Fixes: cf8e0fedf078 ("mm/zsmalloc: simplify zs_max_alloc_size handling") Signed-off-by: Minchan Kim <[email protected]> Reported-by: Mike Galbraith <[email protected]> Tested-by: Mike Galbraith <[email protected]> Reviewed-by: Sergey Senozhatsky <[email protected]> Cc: Jerome Marchand <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02kthread: fix documentation build warningJonathan Corbet1-1/+1
The kerneldoc comment for kthread_create() had an incorrect argument name, leading to a warning in the docs build. Correct it, and make one more small step toward a warning-free build. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Jonathan Corbet <[email protected]> Cc: Randy Dunlap <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02kasan: avoid -Wmaybe-uninitialized warningArnd Bergmann1-0/+1
gcc-7 produces this warning: mm/kasan/report.c: In function 'kasan_report': mm/kasan/report.c:351:3: error: 'info.first_bad_addr' may be used uninitialized in this function [-Werror=maybe-uninitialized] print_shadow_for_address(info->first_bad_addr); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/kasan/report.c:360:27: note: 'info.first_bad_addr' was declared here The code seems fine as we only print info.first_bad_addr when there is a shadow, and we always initialize it in that case, but this is relatively hard for gcc to figure out after the latest rework. Adding an intialization to the most likely value together with the other struct members shuts up that warning. Fixes: b235b9808664 ("kasan: unify report headers") Link: https://patchwork.kernel.org/patch/9641417/ Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Arnd Bergmann <[email protected]> Suggested-by: Alexander Potapenko <[email protected]> Suggested-by: Andrey Ryabinin <[email protected]> Acked-by: Andrey Ryabinin <[email protected]> Cc: Dmitry Vyukov <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02userfaultfd: non-cooperative: notify about unmap of destination during mremapMike Rapoport1-2/+5
When mremap is called with MREMAP_FIXED it unmaps memory at the destination address without notifying userfaultfd monitor. If the destination were registered with userfaultfd, the monitor has no way to distinguish between the old and new ranges and to properly relate the page faults that would occur in the destination region. Fixes: 897ab3e0c49e ("userfaultfd: non-cooperative: add event for memory unmaps") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Mike Rapoport <[email protected]> Acked-by: Pavel Emelyanov <[email protected]> Cc: Andrea Arcangeli <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02mm, mprotect: flush TLB if potentially racing with a parallel reclaim ↵Mel Gorman7-1/+48
leaving stale TLB entries Nadav Amit identified a theoritical race between page reclaim and mprotect due to TLB flushes being batched outside of the PTL being held. He described the race as follows: CPU0 CPU1 ---- ---- user accesses memory using RW PTE [PTE now cached in TLB] try_to_unmap_one() ==> ptep_get_and_clear() ==> set_tlb_ubc_flush_pending() mprotect(addr, PROT_READ) ==> change_pte_range() ==> [ PTE non-present - no flush ] user writes using cached RW PTE ... try_to_unmap_flush() The same type of race exists for reads when protecting for PROT_NONE and also exists for operations that can leave an old TLB entry behind such as munmap, mremap and madvise. For some operations like mprotect, it's not necessarily a data integrity issue but it is a correctness issue as there is a window where an mprotect that limits access still allows access. For munmap, it's potentially a data integrity issue although the race is massive as an munmap, mmap and return to userspace must all complete between the window when reclaim drops the PTL and flushes the TLB. However, it's theoritically possible so handle this issue by flushing the mm if reclaim is potentially currently batching TLB flushes. Other instances where a flush is required for a present pte should be ok as either the page lock is held preventing parallel reclaim or a page reference count is elevated preventing a parallel free leading to corruption. In the case of page_mkclean there isn't an obvious path that userspace could take advantage of without using the operations that are guarded by this patch. Other users such as gup as a race with reclaim looks just at PTEs. huge page variants should be ok as they don't race with reclaim. mincore only looks at PTEs. userfault also should be ok as if a parallel reclaim takes place, it will either fault the page back in or read some of the data before the flush occurs triggering a fault. Note that a variant of this patch was acked by Andy Lutomirski but this was for the x86 parts on top of his PCID work which didn't make the 4.13 merge window as expected. His ack is dropped from this version and there will be a follow-on patch on top of PCID that will include his ack. [[email protected]: tweak comments] [[email protected]: fix spello] Link: http://lkml.kernel.org/r/[email protected] Reported-by: Nadav Amit <[email protected]> Signed-off-by: Mel Gorman <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: <[email protected]> [v4.4+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02pid: kill pidhash_size in pidhash_init()Kefeng Wang1-3/+0
After commit 3d375d78593c ("mm: update callers to use HASH_ZERO flag"), drop unused pidhash_size in pidhash_init(). Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Kefeng Wang <[email protected]> Reviewed-by: Pavel Tatashin <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errorsDaniel Jordan1-6/+3
Commit 9a291a7c9428 ("mm/hugetlb: report -EHWPOISON not -EFAULT when FOLL_HWPOISON is specified") causes __get_user_pages to ignore certain errors from follow_hugetlb_page. After such error, __get_user_pages subsequently calls faultin_page on the same VMA and start address that follow_hugetlb_page failed on instead of returning the error immediately as it should. In follow_hugetlb_page, when hugetlb_fault returns a value covered under VM_FAULT_ERROR, follow_hugetlb_page returns it without setting nr_pages to 0 as __get_user_pages expects in this case, which causes the following to happen in __get_user_pages: the "while (nr_pages)" check succeeds, we skip the "if (!vma..." check because we got a VMA the last time around, we find no page with follow_page_mask, and we call faultin_page, which calls hugetlb_fault for the second time. This issue also slightly changes how __get_user_pages works. Before, it only returned error if it had made no progress (i = 0). But now, follow_hugetlb_page can clobber "i" with an error code since its new return path doesn't check for progress. So if "i" is nonzero before a failing call to follow_hugetlb_page, that indication of progress is lost and __get_user_pages can return error even if some pages were successfully pinned. To fix this, change follow_hugetlb_page so that it updates nr_pages, allowing __get_user_pages to fail immediately and restoring the "error only if no progress" behavior to __get_user_pages. Tested that __get_user_pages returns when expected on error from hugetlb_fault in follow_hugetlb_page. Fixes: 9a291a7c9428 ("mm/hugetlb: report -EHWPOISON not -EFAULT when FOLL_HWPOISON is specified") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Daniel Jordan <[email protected]> Acked-by: Punit Agrawal <[email protected]> Cc: Andrea Arcangeli <[email protected]> Cc: "Aneesh Kumar K.V" <[email protected]> Cc: Gerald Schaefer <[email protected]> Cc: James Morse <[email protected]> Cc: "Kirill A. Shutemov" <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Mike Kravetz <[email protected]> Cc: Naoya Horiguchi <[email protected]> Cc: zhong jiang <[email protected]> Cc: <[email protected]> [4.12.x] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-08-02KVM: nVMX: mark vmcs12 pages dirty on L2 exitDavid Matlack1-10/+43
The host physical addresses of L1's Virtual APIC Page and Posted Interrupt descriptor are loaded into the VMCS02. The CPU may write to these pages via their host physical address while L2 is running, bypassing address-translation-based dirty tracking (e.g. EPT write protection). Mark them dirty on every exit from L2 to prevent them from getting out of sync with dirty tracking. Also mark the virtual APIC page and the posted interrupt descriptor dirty when KVM is virtualizing posted interrupt processing. Signed-off-by: David Matlack <[email protected]> Reviewed-by: Paolo Bonzini <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02kvm: nVMX: don't flush VMCS12 during VMXOFF or VCPU teardownDavid Matlack1-5/+11
According to the Intel SDM, software cannot rely on the current VMCS to be coherent after a VMXOFF or shutdown. So this is a valid way to handle VMCS12 flushes. 24.11.1 Software Use of Virtual-Machine Control Structures ... If a logical processor leaves VMX operation, any VMCSs active on that logical processor may be corrupted (see below). To prevent such corruption of a VMCS that may be used either after a return to VMX operation or on another logical processor, software should execute VMCLEAR for that VMCS before executing the VMXOFF instruction or removing power from the processor (e.g., as part of a transition to the S3 and S4 power states). ... This fixes a "suspicious rcu_dereference_check() usage!" warning during kvm_vm_release() because nested_release_vmcs12() calls kvm_vcpu_write_guest_page() without holding kvm->srcu. Signed-off-by: David Matlack <[email protected]> Reviewed-by: Paolo Bonzini <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02KVM: nVMX: do not pin the VMCS12Paolo Bonzini1-17/+7
Since the current implementation of VMCS12 does a memcpy in and out of guest memory, we do not need current_vmcs12 and current_vmcs12_page anymore. current_vmptr is enough to read and write the VMCS12. And David Matlack noted: This patch also fixes dirty tracking (memslot->dirty_bitmap) of the VMCS12 page by using kvm_write_guest. nested_release_page() only marks the struct page dirty. Signed-off-by: Paolo Bonzini <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> [Added David Matlack's note and nested_release_page_clean() fix.] Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02KVM: avoid using rcu_dereference_protectedPaolo Bonzini2-9/+8
During teardown, accesses to memslots and buses are using rcu_dereference_protected with an always-true condition because these accesses are done outside the usual mutexes. This is because the last reference is gone and there cannot be any concurrent modifications, but rcu_dereference_protected is ugly and unobvious. Instead, check the refcount in kvm_get_bus and __kvm_memslots. Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02KVM: X86: init irq->level in kvm_pv_kick_cpu_opLongpeng(Mike)1-0/+1
'lapic_irq' is a local variable and its 'level' field isn't initialized, so 'level' is random, it doesn't matter but makes UBSAN unhappy: UBSAN: Undefined behaviour in .../lapic.c:... load of value 10 is not a valid value for type '_Bool' ... Call Trace: [<ffffffff81f030b6>] dump_stack+0x1e/0x20 [<ffffffff81f03173>] ubsan_epilogue+0x12/0x55 [<ffffffff81f03b96>] __ubsan_handle_load_invalid_value+0x118/0x162 [<ffffffffa1575173>] kvm_apic_set_irq+0xc3/0xf0 [kvm] [<ffffffffa1575b20>] kvm_irq_delivery_to_apic_fast+0x450/0x910 [kvm] [<ffffffffa15858ea>] kvm_irq_delivery_to_apic+0xfa/0x7a0 [kvm] [<ffffffffa1517f4e>] kvm_emulate_hypercall+0x62e/0x760 [kvm] [<ffffffffa113141a>] handle_vmcall+0x1a/0x30 [kvm_intel] [<ffffffffa114e592>] vmx_handle_exit+0x7a2/0x1fa0 [kvm_intel] ... Signed-off-by: Longpeng(Mike) <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02KVM: X86: Fix loss of pending INIT due to raceWanpeng Li1-8/+11
When SMP VM start, AP may lost INIT because of receiving INIT between kvm_vcpu_ioctl_x86_get/set_vcpu_events. vcpu 0 vcpu 1 kvm_vcpu_ioctl_x86_get_vcpu_events events->smi.latched_init = 0 send INIT to vcpu1 set vcpu1's pending_events kvm_vcpu_ioctl_x86_set_vcpu_events if (events->smi.latched_init == 0) clear INIT in pending_events This patch fixes it by just update SMM related flags if we are in SMM. Thanks Peng Hao for the report and original commit message. Reported-by: Peng Hao <[email protected]> Cc: Paolo Bonzini <[email protected]> Cc: Radim Krčmář <[email protected]> Signed-off-by: Wanpeng Li <[email protected]> Reviewed-by: Paolo Bonzini <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-02drm/amdgpu: Use list_del_init in amdgpu_mn_unregisterFelix Kuehling1-1/+1
Otherwise bo->shadow_list (which is aliased by bo->mn_list) will not appear empty in amdgpu_ttm_bo_destroy and cause an oops when freeing former userptr BOs. Signed-off-by: Felix Kuehling <[email protected]> Reviewed-by: Christian König <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2017-08-02drm/amdgpu: Fix undue fallthroughs in golden registers initializationJean Delvare1-0/+2
As I was staring at the si_init_golden_registers code, I noticed that the Pitcairn initialization silently falls through the Cape Verde initialization, and the Oland initialization falls through the Hainan initialization. However there is no comment stating that this is intentional, and the radeon driver doesn't have any such fallthrough, so I suspect this is not supposed to happen. Signed-off-by: Jean Delvare <[email protected]> Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10") Cc: Ken Wang <[email protected]> Cc: Alex Deucher <[email protected]> Cc: "Marek Olšák" <[email protected]> Cc: "Christian König" <[email protected]> Cc: Flora Cui <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
2017-08-02Merge tag 'platform-drivers-x86-v4.13-3' of ↵Linus Torvalds3-8/+11
git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Darren Hart: "Fix two bugs under error or abnormal usage conditions. Correct a config dependency: dell-wmi: - Fix driver interface version query wmi: - Fix error handling in acpi_wmi_init() peaq-wmi: - select INPUT_POLLDEV" * tag 'platform-drivers-x86-v4.13-3' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: dell-wmi: Fix driver interface version query platform/x86: wmi: Fix error handling in acpi_wmi_init() platform/x86: peaq-wmi: select INPUT_POLLDEV
2017-08-02Merge tag 'sunxi-clk-fixes-for-4.13' of ↵Stephen Boyd1-1/+1
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull one Allwinner clock fix from Chen-Yu Tsai: One critical clock fix for sun5i (A10s/A13/R8) which enables propagation of clock rate changes from the "cpu" clock to it's parent PLL clock. This fixes cpufreq related crashes that have been observed on KernelCI with the C.H.I.P. and multi_v7_defconfig. * tag 'sunxi-clk-fixes-for-4.13' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun5i: Add clk_set_rate_parent to the CPU clock
2017-08-02Merge tag 'meson-clk-fixes-for-4.13-rc4-v2' of ↵Stephen Boyd4-0/+18
git://github.com/baylibre/clk-meson into clk-fixes Pull one Meson clock fix from Neil Armstrong * tag 'meson-clk-fixes-for-4.13-rc4-v2' of git://github.com/baylibre/clk-meson: clk: meson: mpll: fix mpll0 fractional part ignored
2017-08-02Merge tag 'scsi-fixes' of ↵Linus Torvalds8-37/+58
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "These seven patches are mostly minor build, Kconfig and error leg fixes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qedi: Fix return code in qedi_ep_connect() scsi: lpfc: fix linking against modular NVMe support scsi: scsi_transport_fc: return -EBUSY for deleted vport scsi: libcxgbi: add check for valid cxgbi_task_data scsi: aic7xxx: fix firmware build with O=path scsi: megaraid_sas: fix memleak in megasas_alloc_cmdlist_fusion scsi: qedi: Add ISCSI_BOOT_SYSFS to Kconfig
2017-08-02Merge tag 'asoc-fix-v4.13-rc3' of ↵Takashi Iwai9965-204586/+795403
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.13 Quite a few fixes here that have been sent since the merge window, the biggest one is the fix from Tony for some confusion with the device property API which was causing issues with the of-graph card. This is fixed with some changes in the graph API itself as it seemed very likely to be error prone.
2017-08-02ARM64: dts: marvell: armada-37xx: Fix the number of GPIO on south bridgeGregory CLEMENT1-1/+1
The number of pins in South Bridge is 30 and not 29. There is a fix for the driver for the pinctrl, but a fix is also need at device tree level for the GPIO. Fixes: afda007feda5 ("ARM64: dts: marvell: Add pinctrl nodes for Armada 3700") Cc: <[email protected]> Signed-off-by: Gregory CLEMENT <[email protected]>
2017-08-02NFSv4: Fix double frees in nfs4_test_session_trunk()Trond Myklebust2-16/+3
rpc_clnt_add_xprt() expects the callback function to be synchronous, and expects to release the transport and switch references itself. Fixes: 04fa2c6bb51b1 ("NFS pnfs data server multipath session trunking") Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2017-08-02ALSA: hda - Fix speaker output from VAIO VPCL14M1RSergei A. Trusov1-0/+1
Sony VAIO VPCL14M1R needs the quirk to make the speaker working properly. Tested-by: Dmitriy <[email protected]> Cc: <[email protected]> Signed-off-by: Sergei A. Trusov <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2017-08-02powerpc/83xx/mpc832x_rdb: fix of_irq_to_resource() error checkSergei Shtylyov1-1/+1
of_irq_to_resource() has recently been fixed to return negative error #'s along with 0 in case of failure, however the Freescale MPC832x RDB board code still only regards 0 as a failure indication -- fix it up. Fixes: 7a4228bbff76 ("of: irq: use of_irq_get() in of_irq_to_resource()") Signed-off-by: Sergei Shtylyov <[email protected]> Acked-by: Scott Wood <[email protected]> Signed-off-by: Michael Ellerman <[email protected]>
2017-08-02gpio: tegra: fix unbalanced chained_irq_enter/exitMichał Mirosław1-3/+3
When more than one GPIO IRQs are triggered simultaneously, tegra_gpio_irq_handler() called chained_irq_exit() multiple times for one chained_irq_enter(). Fixes: 3c92db9ac0ca3eee8e46e2424b6c074e2e394ad9 Signed-off-by: Michał Mirosław <[email protected]> [Also changed the variable to a bool] Signed-off-by: Linus Walleij <[email protected]>
2017-08-01platform/x86: dell-wmi: Fix driver interface version queryAndy Lutomirski1-5/+7
When I converted dell-wmi to the new bus infrastructure, I left the call to dell_wmi_check_descriptor_buffer() in dell_wmi_init(). This could cause two problems: - An error message when loading the driver on a system without dell-wmi. We'd try to read the event descriptor even if the WMI GUID wasn't there. - A possible race if dell-wmi was loaded manually before wmi was fully initialized. Fix it by moving the call to the probe function where it belongs. Fixes: bff589be59c5 ("platform/x86: dell-wmi: Convert to the WMI bus infrastructure") Signed-off-by: Andy Lutomirski <[email protected]> Reviewed-by: Pali Rohár <[email protected]> Signed-off-by: Darren Hart (VMware) <[email protected]>
2017-08-01NFSv4: Fix EXCHANGE_ID corrupt verifier issueTrond Myklebust3-9/+6
The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt the call to rpc_wait_for_completion_task(), we can therefore end up transmitting random stack contents in lieu of the verifier. Fixes: 8d89bd70bc939 ("NFS setup async exchange_id") Cc: [email protected] # v4.9+ Signed-off-by: Trond Myklebust <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2017-08-01KVM: async_pf: make rcu irq exit if not triggered from idle taskWanpeng Li1-2/+4
WARNING: CPU: 5 PID: 1242 at kernel/rcu/tree_plugin.h:323 rcu_note_context_switch+0x207/0x6b0 CPU: 5 PID: 1242 Comm: unity-settings- Not tainted 4.13.0-rc2+ #1 RIP: 0010:rcu_note_context_switch+0x207/0x6b0 Call Trace: __schedule+0xda/0xba0 ? kvm_async_pf_task_wait+0x1b2/0x270 schedule+0x40/0x90 kvm_async_pf_task_wait+0x1cc/0x270 ? prepare_to_swait+0x22/0x70 do_async_page_fault+0x77/0xb0 ? do_async_page_fault+0x77/0xb0 async_page_fault+0x28/0x30 RIP: 0010:__d_lookup_rcu+0x90/0x1e0 I encounter this when trying to stress the async page fault in L1 guest w/ L2 guests running. Commit 9b132fbe5419 (Add rcu user eqs exception hooks for async page fault) adds rcu_irq_enter/exit() to kvm_async_pf_task_wait() to exit cpu idle eqs when needed, to protect the code that needs use rcu. However, we need to call the pair even if the function calls schedule(), as seen from the above backtrace. This patch fixes it by informing the RCU subsystem exit/enter the irq towards/away from idle for both n.halted and !n.halted. Cc: Paolo Bonzini <[email protected]> Cc: Radim Krčmář <[email protected]> Cc: Paul E. McKenney <[email protected]> Cc: [email protected] Signed-off-by: Wanpeng Li <[email protected]> Reviewed-by: Paolo Bonzini <[email protected]> Signed-off-by: Radim Krčmář <[email protected]>
2017-08-01KVM: nVMX: fixes to nested virt interrupt injectionPaolo Bonzini2-25/+72
There are three issues in nested_vmx_check_exception: 1) it is not taking PFEC_MATCH/PFEC_MASK into account, as reported by Wanpeng Li; 2) it should rebuild the interruption info and exit qualification fields from scratch, as reported by Jim Mattson, because the values from the L2->L0 vmexit may be invalid (e.g. if an emulated instruction causes a page fault, the EPT misconfig's exit qualification is incorrect). 3) CR2 and DR6 should not be written for exception intercept vmexits (CR2 only for AMD). This patch fixes the first two and adds a comment about the last, outlining the fix. Cc: Jim Mattson <[email protected]> Cc: Wanpeng Li <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
2017-08-01KVM: nVMX: do not fill vm_exit_intr_error_code in prepare_vmcs12Paolo Bonzini1-18/+34
Do this in the caller of nested_vmx_vmexit instead. nested_vmx_check_exception was doing a vmwrite to the vmcs02's VM_EXIT_INTR_ERROR_CODE field, so that prepare_vmcs12 would move the field to vmcs12->vm_exit_intr_error_code. However that isn't possible on pre-Haswell machines. Moving the vmcs12 write to the callers fixes it. Reported-by: Jim Mattson <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> [Changed nested_vmx_reflect_vmexit() return type to (int)1 from (bool)1, thanks to [email protected]] Signed-off-by: Radim Krčmář <[email protected]>
2017-08-01Merge branch 'parisc-4.13-4' of ↵Linus Torvalds5-8/+10
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parsic fixes from Helge Deller: - Our cache flushing code ran into a BUG in case context is not current. Fix it by flushing the whole cache in such rare situations (by Dave Anglin). - Fix a "sleeping function called from invalid context BUG" in our pdc_stable driver by rearranging our locks (by James Bottomley) - The thread and irq stacks require more than 16 KB since kernel 4.11. Increase both to 32 KB. - Define CONFIG_CPU_BIG_ENDIAN unconditionally on parisc to avoid wrong behaviour in qrwlock functions (by Babu Moger). * 'parisc-4.13-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Define CONFIG_CPU_BIG_ENDIAN parisc: pdc_stable: Fix locking when creating sysfs links parisc: Increase thread and stack size to 32kb parisc: Handle vma's whose context is not current in flush_cache_range
2017-08-01libceph: make RECOVERY_DELETES feature create a new intervalIlya Dryomov5-1/+16
This is needed so that the OSDs can regenerate the missing set at the start of a new interval where support for recovery deletes changed. Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2017-08-01libceph: upmap semantic changesIlya Dryomov1-28/+11
- apply both pg_upmap and pg_upmap_items - allow bidirectional swap of pg-upmap-items Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2017-08-01crush: assume weight_set != null imples weight_set_size > 0Ilya Dryomov2-1/+5
Reflects ceph.git commit 5e8fa3e06b68fae1582c9230a3a8d1abc6146286. Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2017-08-01libceph: fallback for when there isn't a pool-specific choose_argIlya Dryomov2-2/+12
There is now a fallback to a choose_arg index of -1 if there isn't a pool-specific choose_arg set. If you create a per-pool weight-set, that works for that pool. Otherwise we try the compat/default one. If that doesn't exist either, then we use the normal CRUSH weights. Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2017-08-01libceph: don't call ->reencode_message() more than once per messageIlya Dryomov1-3/+3
Reencoding an already reencoded message is a bad idea. This could happen on Policy::stateful_server connections (!CEPH_MSG_CONNECT_LOSSY), such as MDS sessions. This didn't pop up in testing because currently only OSD requests are reencoded and OSD sessions are always lossy. Fixes: 98ad5ebd1505 ("libceph: ceph_connection_operations::reencode_message() method") Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: "Yan, Zheng" <[email protected]>
2017-08-01libceph: make encode_request_*() work with r_mempool requestsIlya Dryomov1-3/+6
Messages allocated out of ceph_msgpool have a fixed front length (pool->front_len). Asserting that the entire front has been filled while encoding is thus wrong. Fixes: 8cb441c0545d ("libceph: MOSDOp v8 encoding (actual spgid + full hash)") Reported-by: "Yan, Zheng" <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: "Yan, Zheng" <[email protected]>
2017-08-01Merge remote-tracking branches 'asoc/fix/rt5663', 'asoc/fix/rt5665', ↵Mark Brown6-18/+20
'asoc/fix/samsung', 'asoc/fix/sgtl5000' and 'asoc/fix/sh' into asoc-linus
2017-08-01Merge remote-tracking branches 'asoc/fix/dpcm', 'asoc/fix/imx', ↵Mark Brown11-73/+57
'asoc/fix/msm8916', 'asoc/fix/multi-pcm', 'asoc/fix/of-graph' and 'asoc/fix/pxa' into asoc-linus
2017-08-01Merge remote-tracking branch 'asoc/fix/intel' into asoc-linusMark Brown3-12/+15
2017-08-01device property: Fix usecount for of_graph_get_port_parent()Tony Lindgren5-18/+34
Fix inconsistent use of of_graph_get_port_parent() where asoc_simple_card_parse_graph_dai() does of_node_get() before calling it while other callers do not. We can fix this by not trashing the node passed to of_graph_get_port_parent(). Let's also make sure the callers have correct refcounts and remove related incorrect of_node_put() calls for of_for_each_phandle as that's done by of_phandle_iterator_next() except when we break out of the loop early. Let's fix both issues with a single patch to avoid kobject refcounts getting messed up more if two patches are merged separately. Otherwise strange issues can happen caused by memory corruption caused by too many kobject_del() calls such as: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:747 ... (___might_sleep) (__mutex_lock) (mutex_lock_nested) (kernfs_remove) (kobject_del) (kobject_put) (of_get_next_parent) (of_graph_get_port_parent) (asoc_simple_card_parse_graph_dai [snd_soc_simple_card_utils]) (asoc_graph_card_probe [snd_soc_audio_graph_card]) Fixes: 0ef472a973eb ("of_graph: add of_graph_get_port_parent()") Fixes: 2692c1c63c29 ("ASoC: add audio-graph-card support") Fixes: 1689333f8311 ("ASoC: simple-card-utils: add asoc_simple_card_parse_graph_dai()") Signed-off-by: Tony Lindgren <[email protected]> Reviewed-by: Rob Herring <[email protected]> Tested-by: Antonio Borneo <[email protected]> Tested-by: Kuninori Morimoto <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2017-08-01timers: Fix overflow in get_next_timer_interruptMatija Glavinic Pecotic1-1/+1
For e.g. HZ=100, timer being 430 jiffies in the future, and 32 bit unsigned int, there is an overflow on unsigned int right-hand side of the expression which results with wrong values being returned. Type cast the multiplier to 64bit to avoid that issue. Fixes: 46c8f0b077a8 ("timers: Fix get_next_timer_interrupt() computation") Signed-off-by: Matija Glavinic Pecotic <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Reviewed-by: Alexander Sverdlin <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected]
2017-08-01clk: meson: mpll: fix mpll0 fractional part ignoredJerome Brunet4-0/+18
mpll0 clock is special compared to the other mplls. It needs another bit (ssen) to be set to activate the fractional part the mpll divider Fixes: 007e6e5c5f01 ("clk: meson: mpll: add rw operation") Signed-off-by: Jerome Brunet <[email protected]> Signed-off-by: Neil Armstrong <[email protected]>
2017-08-01gpiolib: skip unwanted events, don't convert them to opposite edgeBartosz Golaszewski1-5/+4
The previous fix for filtering out of unwatched events was not entirely correct. Instead of skipping the events we don't want, they are now interpreted as events with opposing edge. In order to fix it: always read the GPIO line value on interrupt and only emit the event if it corresponds with the event type we requested. Cc: [email protected] Fixes: ad537b822577 ("gpiolib: fix filtering out unwanted events") Signed-off-by: Bartosz Golaszewski <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2017-08-01gpio: exar: Use correct property prefix and document bindingsJan Kiszka3-3/+8
The device-specific property should be prefixed with the vendor name, not "linux,", as Linus Walleij pointed out. Change this and document the bindings of this platform device. We didn't ship the old binding in a release yet. So we can still change it without breaking an official API. Fixes: 380b1e2f3a2f ("gpio-exar/8250-exar: Make set of exported GPIOs configurable") Signed-off-by: Jan Kiszka <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2017-08-01ASoC: rt5665: fix wrong register for bclk ratio controlBard Liao1-2/+2
The register of setting back ratio should be RT5665_ADDA_CLK_2 instead of RT5665_ADDA_CLK_1. Signed-off-by: Bard Liao <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2017-08-01arm64: Use arch_timer_get_rate when trapping CNTFRQ_EL0Marc Zyngier1-1/+1
In an ideal world, CNTFRQ_EL0 always contains the timer frequency for the kernel to use. Sadly, we get quite a few broken systems where the firmware authors cannot be bothered to program that register on all CPUs, and rely on DT to provide that frequency. So when trapping CNTFRQ_EL0, make sure to return the actual rate (as known by the kernel), and not CNTFRQ_EL0. Acked-by: Mark Rutland <[email protected]> Signed-off-by: Marc Zyngier <[email protected]> Signed-off-by: Will Deacon <[email protected]>
2017-08-01x86/hpet: Cure interface abuse in the resume pathThomas Gleixner1-16/+11
The HPET resume path abuses irq_domain_[de]activate_irq() to restore the MSI message in the HPET chip for the boot CPU on resume and it relies on an implementation detail of the interrupt core code, which magically makes the HPET unmask call invoked via a irq_disable/enable pair. This worked as long as the irq code did unconditionally invoke the unmask() callback. With the recent changes which keep track of the masked state to avoid expensive hardware access, this does not longer work. As a consequence the HPET timer interrupts are not unmasked which breaks resume as the boot CPU waits forever that a timer interrupt arrives. Make the restore of the MSI message explicit and invoke the unmask() function directly. While at it get rid of the pointless affinity setting as nothing can change the affinity of the interrupt and the vector across suspend/resume. The restore of the MSI message reestablishes the previous affinity setting which is the correct one. Fixes: bf22ff45bed6 ("genirq: Avoid unnecessary low level irq function calls") Reported-and-tested-by: Tomi Sarvela <[email protected]> Reported-by: Martin Peres <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Acked-by: "Rafael J. Wysocki" <[email protected]> Cc: [email protected] Cc: Peter Zijlstra <[email protected]> Cc: Marc Zyngier <[email protected]> Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1707312158590.2287@nanos
2017-08-01gpio: gpio-mxc: Fix: higher 16 GPIOs usable as wake sourcePhilipp Rosenberger1-0/+3
In the function gpio_set_wake_irq(), port->irq_high is only checked for zero. As platform_get_irq() returns a value less then zero if no interrupt was found, any gpio >= 16 was handled like an irq_high interrupt was available. On iMX27 for example no high interrupt is available. This lead to the problem that only some gpios (the lower 16) were useable as wake sources. Signed-off-by: Philipp Rosenberger <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
2017-08-01gpio: xgene-sb: select IRQ_DOMAIN_HIERARCHYMasahiro Yamada1-0/+1
This driver calls irq_domain_hierarchy() and irq_chip_*_parent(). They are available only when CONFIG_IRQ_DOMAIN_HIERARCHY is enabled. Signed-off-by: Masahiro Yamada <[email protected]> Signed-off-by: Linus Walleij <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.