1. 07 Dec, 2018 12 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20181207' of git://git.kernel.dk/linux-block · 0b43a299
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Let's try this again...
      
        We're finally happy with the DM livelock issue, and it's also passed
        overnight testing and the corruption regression test. The end result
        is much nicer now too, which is great.
      
        Outside of that fix, there's a pull request for NVMe with two small
        fixes, and a regression fix for BFQ from this merge window. The BFQ
        fix looks bigger than it is, it's 90% comment updates"
      
      * tag 'for-linus-20181207' of git://git.kernel.dk/linux-block:
        blk-mq: punt failed direct issue to dispatch list
        nvmet-rdma: fix response use after free
        nvme: validate controller state before rescheduling keep alive
        block, bfq: fix decrement of num_active_groups
      0b43a299
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 52f842cc
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "A set of driver bugfixes for the I2C subsystem"
      
      * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode
        i2c: uniphier: fix violation of tLOW requirement for Fast-mode
        i2c: uniphier-f: fill TX-FIFO only in IRQ handler for repeated START
        i2c: uniphier-f: fix timeout error after reading 8 bytes
        i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
        i2c: axxia: properly handle master timeout
        i2c: rcar: check bus state before reinitializing
        i2c: nvidia-gpu: limit reads also for combined messages
        i2c: nvidia-gpu: adhere to I2C fault codes
      52f842cc
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.20-rc6' of git://git.infradead.org/users/vkoul/slave-dma · c431b420
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "Another pull request for dmaengine. We got bunch of fixes early this
        week and all are tagged to stable. Hope this is last fix for this
        cycle:
      
         - Fix imx-sdma handling of channel terminations, this involves
           reverting two commits and implement async termination
      
         - Fix cppi dma channel deletion from pending list on stop
      
         - Fix FIFO size for dw controller in Intel Merrifield"
      
      * tag 'dmaengine-fix-4.20-rc6' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: dw: Fix FIFO size for Intel Merrifield
        dmaengine: cppi41: delete channel from pending list when stop channel
        dmaengine: imx-sdma: use GFP_NOWAIT for dma descriptor allocations
        dmaengine: imx-sdma: implement channel termination via worker
        Revert "dmaengine: imx-sdma: alloclate bd memory from dma pool"
        Revert "dmaengine: imx-sdma: Use GFP_NOWAIT for dma allocations"
      c431b420
    • Jens Axboe's avatar
      Merge branch 'nvme-4.20' of git://git.infradead.org/nvme into for-linus · 8b878ee2
      Jens Axboe authored
      Pull NVMe fixes from Christoph.
      
      * 'nvme-4.20' of git://git.infradead.org/nvme:
        nvmet-rdma: fix response use after free
        nvme: validate controller state before rescheduling keep alive
      8b878ee2
    • Jens Axboe's avatar
      blk-mq: punt failed direct issue to dispatch list · c616cbee
      Jens Axboe authored
      After the direct dispatch corruption fix, we permanently disallow direct
      dispatch of non read/write requests. This works fine off the normal IO
      path, as they will be retried like any other failed direct dispatch
      request. But for the blk_insert_cloned_request() that only DM uses to
      bypass the bottom level scheduler, we always first attempt direct
      dispatch. For some types of requests, that's now a permanent failure,
      and no amount of retrying will make that succeed. This results in a
      livelock.
      
      Instead of making special cases for what we can direct issue, and now
      having to deal with DM solving the livelock while still retaining a BUSY
      condition feedback loop, always just add a request that has been through
      ->queue_rq() to the hardware queue dispatch list. These are safe to use
      as no merging can take place there. Additionally, if requests do have
      prepped data from drivers, we aren't dependent on them not sharing space
      in the request structure to safely add them to the IO scheduler lists.
      
      This basically reverts ffe81d45 and is based on a patch from Ming,
      but with the list insert case covered as well.
      
      Fixes: ffe81d45 ("blk-mq: fix corruption with direct issue")
      Cc: stable@vger.kernel.org
      Suggested-by: default avatarMing Lei <ming.lei@redhat.com>
      Reported-by: default avatarBart Van Assche <bvanassche@acm.org>
      Tested-by: default avatarMing Lei <ming.lei@redhat.com>
      Acked-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      c616cbee
    • Israel Rukshin's avatar
      nvmet-rdma: fix response use after free · d7dcdf9d
      Israel Rukshin authored
      nvmet_rdma_release_rsp() may free the response before using it at error
      flow.
      
      Fixes: 8407879c ("nvmet-rdma: fix possible bogus dereference under heavy load")
      Signed-off-by: default avatarIsrael Rukshin <israelr@mellanox.com>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Reviewed-by: default avatarMax Gurtovoy <maxg@mellanox.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      d7dcdf9d
    • James Smart's avatar
      nvme: validate controller state before rescheduling keep alive · 86880d64
      James Smart authored
      Delete operations are seeing NULL pointer references in call_timer_fn.
      Tracking these back, the timer appears to be the keep alive timer.
      
      nvme_keep_alive_work() which is tied to the timer that is cancelled
      by nvme_stop_keep_alive(), simply starts the keep alive io but doesn't
      wait for it's completion. So nvme_stop_keep_alive() only stops a timer
      when it's pending. When a keep alive is in flight, there is no timer
      running and the nvme_stop_keep_alive() will have no affect on the keep
      alive io. Thus, if the io completes successfully, the keep alive timer
      will be rescheduled.   In the failure case, delete is called, the
      controller state is changed, the nvme_stop_keep_alive() is called while
      the io is outstanding, and the delete path continues on. The keep
      alive happens to successfully complete before the delete paths mark it
      as aborted as part of the queue termination, so the timer is restarted.
      The delete paths then tear down the controller, and later on the timer
      code fires and the timer entry is now corrupt.
      
      Fix by validating the controller state before rescheduling the keep
      alive. Testing with the fix has confirmed the condition above was hit.
      Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      86880d64
    • Paolo Valente's avatar
      block, bfq: fix decrement of num_active_groups · ba7aeae5
      Paolo Valente authored
      Since commit '2d29c9f8 ("block, bfq: improve asymmetric scenarios
      detection")', if there are process groups with I/O requests waiting for
      completion, then BFQ tags the scenario as 'asymmetric'. This detection
      is needed for preserving service guarantees (for details, see comments
      on the computation * of the variable asymmetric_scenario in the
      function bfq_better_to_idle).
      
      Unfortunately, commit '2d29c9f8 ("block, bfq: improve asymmetric
      scenarios detection")' contains an error exactly in the updating of
      the number of groups with I/O requests waiting for completion: if a
      group has more than one descendant process, then the above number of
      groups, which is renamed from num_active_groups to a more appropriate
      num_groups_with_pending_reqs by this commit, may happen to be wrongly
      decremented multiple times, namely every time one of the descendant
      processes gets all its pending I/O requests completed.
      
      A correct, complete solution should work as follows. Consider a group
      that is inactive, i.e., that has no descendant process with pending
      I/O inside BFQ queues. Then suppose that num_groups_with_pending_reqs
      is still accounting for this group, because the group still has some
      descendant process with some I/O request still in
      flight. num_groups_with_pending_reqs should be decremented when the
      in-flight request of the last descendant process is finally completed
      (assuming that nothing else has changed for the group in the meantime,
      in terms of composition of the group and active/inactive state of
      child groups and processes). To accomplish this, an additional
      pending-request counter must be added to entities, and must be
      updated correctly.
      
      To avoid this additional field and operations, this commit resorts to
      the following tradeoff between simplicity and accuracy: for an
      inactive group that is still counted in num_groups_with_pending_reqs,
      this commit decrements num_groups_with_pending_reqs when the first
      descendant process of the group remains with no request waiting for
      completion.
      
      This simplified scheme provides a fix to the unbalanced decrements
      introduced by 2d29c9f8. Since this error was also caused by lack
      of comments on this non-trivial issue, this commit also adds related
      comments.
      
      Fixes: 2d29c9f8 ("block, bfq: improve asymmetric scenarios detection")
      Reported-by: default avatarSteven Barrett <steven@liquorix.net>
      Tested-by: default avatarSteven Barrett <steven@liquorix.net>
      Tested-by: default avatarLucjan Lucjanov <lucjan.lucjanov@gmail.com>
      Reviewed-by: default avatarFederico Motta <federico@willer.it>
      Signed-off-by: default avatarPaolo Valente <paolo.valente@linaro.org>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      ba7aeae5
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2018-12-07' of git://anongit.freedesktop.org/drm/drm · d387ac13
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "There's a bit more in here than I'd like, and I'm hoping things calm
        down when I'm out.
      
        msm:
         - a bunch of display fixes for the new DPU
         - a couple of command submission fixes
      
        omap:
         - some DSI fixes
      
        ast:
         - driver unload crash fix
      
        core:
         - fix the lease uevent so userspace can distinguish it
      
        amd:
         - fix a bpc regression
         - fix lru handling regression
         - fixed firmware support for new GPUs
         - power management fixes for vega20"
      
      * tag 'drm-fixes-2018-12-07' of git://anongit.freedesktop.org/drm/drm: (37 commits)
        drm/ast: Fix connector leak during driver unload
        drm/amdgpu/vcn: Update vcn.cur_state during suspend
        drm/amd/display: Fix overflow/truncation from strncpy.
        drm/amd/powerplay: improve OD code robustness
        drm/amdgpu: enlarge maximum waiting time of KIQ
        drm/fb-helper: Fix typo in parameter description
        drm/amd/powerplay: support SoftMin/Max setting for some specific DPM
        drm/amd/powerplay: issue pre-display settings for display change event
        drm/amd/powerplay: support new pptable upload on Vega20
        drm/amdgpu/gmc8: always load MC firmware in the driver
        drm/amdgpu/gmc8: update MC firmware for polaris
        drm/amdgpu: update mc firmware image for polaris12 variants
        drm/msm: Fix error return checking
        drm/msm/dpu: Ignore alpha for XBGR8888 format
        drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data"
        drm/msm/hdmi: Drop pointless static qualifier in msm_hdmi_bind()
        drm/msm: Move fence put to where failure occurs
        drm/msm: dpu: Don't set legacy plane->crtc pointer
        drm/msm/gpu: Don't map command buffers with nr_relocs equal to 0
        drm/msm/hdmi: Enable HPD after HDMI IRQ is set up
        ...
      d387ac13
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.20-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 7f80c732
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "This is mainly fallout from the updates to the SUNRPC code that is
        being triggered from less common combinations of NFS mount options.
      
        Highlights include:
      
        Stable fixes:
         - Fix a page leak when using RPCSEC_GSS/krb5p to encrypt data.
      
        Bugfixes:
         - Fix a regression that causes the RPC receive code to hang
         - Fix call_connect_status() so that it handles tasks that got
           transmitted while queued waiting for the socket lock.
         - Fix a memory leak in call_encode()
         - Fix several other connect races.
         - Fix receive code error handling.
         - Use the discard iterator rather than MSG_TRUNC for compatibility
           with AF_UNIX/AF_LOCAL sockets.
         - nfs: don't dirty kernel pages read by direct-io
         - pnfs/Flexfiles fix to enforce per-mirror stateid only for NFSv4
           data servers"
      
      * tag 'nfs-for-4.20-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Don't force a redundant disconnection in xs_read_stream()
        SUNRPC: Fix up socket polling
        SUNRPC: Use the discard iterator rather than MSG_TRUNC
        SUNRPC: Treat EFAULT as a truncated message in xs_read_stream_request()
        SUNRPC: Fix up handling of the XDRBUF_SPARSE_PAGES flag
        SUNRPC: Fix RPC receive hangs
        SUNRPC: Fix a potential race in xprt_connect()
        SUNRPC: Fix a memory leak in call_encode()
        SUNRPC: Fix leak of krb5p encode pages
        SUNRPC: call_connect_status() must handle tasks that got transmitted
        nfs: don't dirty kernel pages read by direct-io
        flexfiles: enforce per-mirror stateid only for v4 DSes
      7f80c732
    • Linus Torvalds's avatar
      Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm · b72f711a
      Linus Torvalds authored
      Pull ARM spectre fix from Russell King:
       "Exynos folk noticed that CPU hotplug wasn't working with their kernel
        configuration, and have tested this as fixing the problem"
      
      * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: ensure that processor vtables is not lost after boot
      b72f711a
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm · 7e40b56c
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Some small fixes that have been accumulated:
      
         - Chris Cole noticed that in a SMP environment, the DMA cache
           coherence handling can produce undesirable results in a corner
           case
      
         - Propagate that fix for ARMv7M as well
      
         - Fix a false positive with source fortification
      
         - Fix an uninitialised return that Nathan Jones spotted"
      
      * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8816/1: dma-mapping: fix potential uninitialized return
        ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart
        ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
        ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE
      7e40b56c
  2. 06 Dec, 2018 17 commits
  3. 05 Dec, 2018 11 commits