1. 28 Apr, 2019 2 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 14f974d7
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "One core bug fix and a few driver ones
      
         - FRWR memory registration for hfi1/qib didn't work with with some
           iovas causing a NFSoRDMA failure regression due to a fix in the NFS
           side
      
         - A command flow error in mlx5 allowed user space to send a corrupt
           command (and also smash the kernel stack we've since learned)
      
         - Fix a regression and some bugs with device hot unplug that was
           discovered while reviewing Andrea's patches
      
         - hns has a failure if the user asks for certain QP configurations"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/hns: Bugfix for mapping user db
        RDMA/ucontext: Fix regression with disassociate
        RDMA/mlx5: Use rdma_user_map_io for mapping BAR pages
        RDMA/mlx5: Do not allow the user to write to the clock page
        IB/mlx5: Fix scatter to CQE in DCT QP creation
        IB/rdmavt: Fix frwr memory registration
      14f974d7
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.1-rc7' of git://git.infradead.org/users/vkoul/slave-dma · 72a6e35d
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
      
       - fix for wrong register use in mediatek driver
      
       - fix in sh driver for glitch is tx_status and treating 0 a valid
         residue for cyclic
      
       - fix in bcm driver for using right memory allocation flag
      
      * tag 'dmaengine-fix-5.1-rc7' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: mediatek-cqdma: fix wrong register usage in mtk_cqdma_start
        dmaengine: sh: rcar-dmac: Fix glitch in dmaengine_tx_status
        dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
        dmaengine: bcm2835: Avoid GFP_KERNEL in device_prep_slave_sg
      72a6e35d
  2. 27 Apr, 2019 7 commits
  3. 26 Apr, 2019 24 commits
  4. 25 Apr, 2019 7 commits
    • Xie XiuQi's avatar
      sched/numa: Fix a possible divide-by-zero · a860fa7b
      Xie XiuQi authored
      sched_clock_cpu() may not be consistent between CPUs. If a task
      migrates to another CPU, then se.exec_start is set to that CPU's
      rq_clock_task() by update_stats_curr_start(). Specifically, the new
      value might be before the old value due to clock skew.
      
      So then if in numa_get_avg_runtime() the expression:
      
        'now - p->last_task_numa_placement'
      
      ends up as -1, then the divider '*period + 1' in task_numa_placement()
      is 0 and things go bang. Similar to update_curr(), check if time goes
      backwards to avoid this.
      
      [ peterz: Wrote new changelog. ]
      [ mingo: Tweaked the code comment. ]
      Signed-off-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: cj.chengjian@huawei.com
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/20190425080016.GX11158@hirez.programming.kicks-ass.netSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a860fa7b
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-5.1-rc7' of git://github.com/ceph/ceph-client · 8113a85f
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
       "dentry name handling fixes from Jeff and a memory leak fix from Zheng.
      
        Both are old issues, marked for stable"
      
      * tag 'ceph-for-5.1-rc7' of git://github.com/ceph/ceph-client:
        ceph: fix ci->i_head_snapc leak
        ceph: handle the case where a dentry has been renamed on outstanding req
        ceph: ensure d_name stability in ceph_dentry_hash()
        ceph: only use d_name directly when parent is locked
      8113a85f
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · f6f3e747
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes a bug in xts and lrw where they may sleep in an atomic
        context"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: lrw - Fix atomic sleep when walking skcipher
        crypto: xts - Fix atomic sleep when walking skcipher
      f6f3e747
    • Lijun Ou's avatar
      RDMA/hns: Bugfix for mapping user db · 2557fabd
      Lijun Ou authored
      When the maximum send wr delivered by the user is zero, the qp does not
      have a sq.
      
      When allocating the sq db buffer to store the user sq pi pointer and map
      it to the kernel mode, max_send_wr is used as the trigger condition, while
      the kernel does not consider the max_send_wr trigger condition when
      mapmping db. It will cause sq record doorbell map fail and create qp fail.
      
      The failed print information as follows:
      
       hns3 0000:7d:00.1: Send cmd: tail - 418, opcode - 0x8504, flag - 0x0011, retval - 0x0000
       hns3 0000:7d:00.1: Send cmd: 0xe59dc000 0x00000000 0x00000000 0x00000000 0x00000116 0x0000ffff
       hns3 0000:7d:00.1: sq record doorbell map failed!
       hns3 0000:7d:00.1: Create RC QP failed
      
      Fixes: 0425e3e6 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
      Signed-off-by: default avatarLijun Ou <oulijun@huawei.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      2557fabd
    • Nikolay Borisov's avatar
      btrfs: Switch memory allocations in async csum calculation path to kvmalloc · a3d46aea
      Nikolay Borisov authored
      Recent multi-page biovec rework allowed creation of bios that can span
      large regions - up to 128 megabytes in the case of btrfs. OTOH btrfs'
      submission path currently allocates a contiguous array to store the
      checksums for every bio submitted. This means we can request up to
      (128mb / BTRFS_SECTOR_SIZE) * 4 bytes + 32bytes of memory from kmalloc.
      On busy systems with possibly fragmented memory said kmalloc can fail
      which will trigger BUG_ON due to improper error handling IO submission
      context in btrfs.
      
      Until error handling is improved or bios in btrfs limited to a more
      manageable size (e.g. 1m) let's use kvmalloc to fallback to vmalloc for
      such large allocations. There is no hard requirement that the memory
      allocated for checksums during IO submission has to be contiguous, but
      this is a simple fix that does not require several non-contiguous
      allocations.
      
      For small writes this is unlikely to have any visible effect since
      kmalloc will still satisfy allocation requests as usual. For larger
      requests the code will just fallback to vmalloc.
      
      We've performed evaluation on several workload types and there was no
      significant difference kmalloc vs kvmalloc.
      Signed-off-by: default avatarNikolay Borisov <nborisov@suse.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      a3d46aea
    • Jonas Karlman's avatar
      drm/bridge: dw-hdmi: fix SCDC configuration for ddc-i2c-bus · c4cba44e
      Jonas Karlman authored
      When ddc-i2c-bus property is used, a NULL pointer dereference is reported:
      
      [   31.041669] Unable to handle kernel NULL pointer dereference at virtual address 00000008
      [   31.041671] pgd = 4d3c16f6
      [   31.041673] [00000008] *pgd=00000000
      [   31.041678] Internal error: Oops: 5 [#1] SMP ARM
      
      [   31.041711] Hardware name: Rockchip (Device Tree)
      [   31.041718] PC is at i2c_transfer+0x8/0xe4
      [   31.041721] LR is at drm_scdc_read+0x54/0x84
      [   31.041723] pc : [<c073273c>]    lr : [<c05926c4>]    psr: 280f0013
      [   31.041725] sp : edffdad0  ip : 5ccb5511  fp : 00000058
      [   31.041727] r10: 00000780  r9 : edf91608  r8 : c11b0f48
      [   31.041728] r7 : 00000438  r6 : 00000000  r5 : 00000000  r4 : 00000000
      [   31.041730] r3 : edffdae7  r2 : 00000002  r1 : edffdaec  r0 : 00000000
      
      [   31.041908] [<c073273c>] (i2c_transfer) from [<c05926c4>] (drm_scdc_read+0x54/0x84)
      [   31.041913] [<c05926c4>] (drm_scdc_read) from [<c0592858>] (drm_scdc_set_scrambling+0x30/0xbc)
      [   31.041919] [<c0592858>] (drm_scdc_set_scrambling) from [<c05cc0f4>] (dw_hdmi_update_power+0x1440/0x1610)
      [   31.041926] [<c05cc0f4>] (dw_hdmi_update_power) from [<c05cc574>] (dw_hdmi_bridge_enable+0x2c/0x70)
      [   31.041932] [<c05cc574>] (dw_hdmi_bridge_enable) from [<c05aed48>] (drm_bridge_enable+0x24/0x34)
      [   31.041938] [<c05aed48>] (drm_bridge_enable) from [<c0591060>] (drm_atomic_helper_commit_modeset_enables+0x114/0x220)
      [   31.041943] [<c0591060>] (drm_atomic_helper_commit_modeset_enables) from [<c05c3fe0>] (rockchip_atomic_helper_commit_tail_rpm+0x28/0x64)
      
      hdmi->i2c may not be set when ddc-i2c-bus property is used in device tree.
      Fix this by using hdmi->ddc as the i2c adapter when calling drm_scdc_*().
      Also report that SCDC is not supported when there is no DDC bus.
      
      Fixes: 264fce6c ("drm/bridge: dw-hdmi: Add SCDC and TMDS Scrambling support")
      Signed-off-by: default avatarJonas Karlman <jonas@kwiboo.se>
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarNeil Armstrong <narmstrong@baylibre.com>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/VE1PR03MB59031814B5BCAB2152923BDAAC210@VE1PR03MB5903.eurprd03.prod.outlook.com
      c4cba44e
    • Geert Uytterhoeven's avatar
      gpio: Fix gpiochip_add_data_with_key() error path · 35779890
      Geert Uytterhoeven authored
      The err_remove_chip block is too coarse, and may perform cleanup that
      must not be done.  E.g. if of_gpiochip_add() fails, of_gpiochip_remove()
      is still called, causing:
      
          OF: ERROR: Bad of_node_put() on /soc/gpio@e6050000
          CPU: 1 PID: 20 Comm: kworker/1:1 Not tainted 5.1.0-rc2-koelsch+ #407
          Hardware name: Generic R-Car Gen2 (Flattened Device Tree)
          Workqueue: events deferred_probe_work_func
          [<c020ec74>] (unwind_backtrace) from [<c020ae58>] (show_stack+0x10/0x14)
          [<c020ae58>] (show_stack) from [<c07c1224>] (dump_stack+0x7c/0x9c)
          [<c07c1224>] (dump_stack) from [<c07c5a80>] (kobject_put+0x94/0xbc)
          [<c07c5a80>] (kobject_put) from [<c0470420>] (gpiochip_add_data_with_key+0x8d8/0xa3c)
          [<c0470420>] (gpiochip_add_data_with_key) from [<c0473738>] (gpio_rcar_probe+0x1d4/0x314)
          [<c0473738>] (gpio_rcar_probe) from [<c052fca8>] (platform_drv_probe+0x48/0x94)
      
      and later, if a GPIO consumer tries to use a GPIO from a failed
      controller:
      
          WARNING: CPU: 0 PID: 1 at lib/refcount.c:156 kobject_get+0x38/0x4c
          refcount_t: increment on 0; use-after-free.
          Modules linked in:
          CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.1.0-rc2-koelsch+ #407
          Hardware name: Generic R-Car Gen2 (Flattened Device Tree)
          [<c020ec74>] (unwind_backtrace) from [<c020ae58>] (show_stack+0x10/0x14)
          [<c020ae58>] (show_stack) from [<c07c1224>] (dump_stack+0x7c/0x9c)
          [<c07c1224>] (dump_stack) from [<c0221580>] (__warn+0xd0/0xec)
          [<c0221580>] (__warn) from [<c02215e0>] (warn_slowpath_fmt+0x44/0x6c)
          [<c02215e0>] (warn_slowpath_fmt) from [<c07c58fc>] (kobject_get+0x38/0x4c)
          [<c07c58fc>] (kobject_get) from [<c068b3ec>] (of_node_get+0x14/0x1c)
          [<c068b3ec>] (of_node_get) from [<c0686f24>] (of_find_node_by_phandle+0xc0/0xf0)
          [<c0686f24>] (of_find_node_by_phandle) from [<c0686fbc>] (of_phandle_iterator_next+0x68/0x154)
          [<c0686fbc>] (of_phandle_iterator_next) from [<c0687fe4>] (__of_parse_phandle_with_args+0x40/0xd0)
          [<c0687fe4>] (__of_parse_phandle_with_args) from [<c0688204>] (of_parse_phandle_with_args_map+0x100/0x3ac)
          [<c0688204>] (of_parse_phandle_with_args_map) from [<c0471240>] (of_get_named_gpiod_flags+0x38/0x380)
          [<c0471240>] (of_get_named_gpiod_flags) from [<c046f864>] (gpiod_get_from_of_node+0x24/0xd8)
          [<c046f864>] (gpiod_get_from_of_node) from [<c0470aa4>] (devm_fwnode_get_index_gpiod_from_child+0xa0/0x144)
          [<c0470aa4>] (devm_fwnode_get_index_gpiod_from_child) from [<c05f425c>] (gpio_keys_probe+0x418/0x7bc)
          [<c05f425c>] (gpio_keys_probe) from [<c052fca8>] (platform_drv_probe+0x48/0x94)
      
      Fix this by splitting the cleanup block, and adding a missing call to
      gpiochip_irqchip_remove().
      
      Fixes: 28355f81 ("gpio: defer probe if pinctrl cannot be found")
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: default avatarMukesh Ojha <mojha@codeaurora.org>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      35779890