1. 26 Jul, 2019 40 commits
    • Yunsheng Lin's avatar
      net: hns3: fix for dereferencing before null checking · 2da60b8e
      Yunsheng Lin authored
      [ Upstream commit 75718800 ]
      
      The netdev is dereferenced before null checking in the function
      hns3_setup_tc.
      
      This patch moves the dereferencing after the null checking.
      
      Fixes: 76ad4f0e ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2da60b8e
    • Michal Kalderon's avatar
      qed: iWARP - Fix tc for MPA ll2 connection · 38d13b38
      Michal Kalderon authored
      [ Upstream commit cb94d52b ]
      
      The driver needs to assign a lossless traffic class for the MPA ll2
      connection to ensure no packets are dropped when returning from the
      driver as they will never be re-transmitted by the peer.
      
      Fixes: ae3488ff ("qed: Add ll2 connection for processing unaligned MPA packets")
      Signed-off-by: default avatarAriel Elior <ariel.elior@marvell.com>
      Signed-off-by: default avatarMichal Kalderon <michal.kalderon@marvell.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      38d13b38
    • Aaron Lewis's avatar
      x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS · eb3e01b6
      Aaron Lewis authored
      [ Upstream commit cbb99c0f ]
      
      Add the CPUID enumeration for Intel's de-feature bits to accommodate
      passing these de-features through to kvm guests.
      
      These de-features are (from SDM vol 1, section 8.1.8):
       - X86_FEATURE_FDP_EXCPTN_ONLY: If CPUID.(EAX=07H,ECX=0H):EBX[bit 6] = 1, the
         data pointer (FDP) is updated only for the x87 non-control instructions that
         incur unmasked x87 exceptions.
       - X86_FEATURE_ZERO_FCS_FDS: If CPUID.(EAX=07H,ECX=0H):EBX[bit 13] = 1, the
         processor deprecates FCS and FDS; it saves each as 0000H.
      Signed-off-by: default avatarAaron Lewis <aaronlewis@google.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Reviewed-by: default avatarJim Mattson <jmattson@google.com>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: Frederic Weisbecker <frederic@kernel.org>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: marcorr@google.com
      Cc: Peter Feiner <pfeiner@google.com>
      Cc: pshier@google.com
      Cc: Robert Hoo <robert.hu@linux.intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
      Cc: x86-ml <x86@kernel.org>
      Link: https://lkml.kernel.org/r/20190605220252.103406-1-aaronlewis@google.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      eb3e01b6
    • Waiman Long's avatar
      rcu: Force inlining of rcu_read_lock() · 32d7d88f
      Waiman Long authored
      [ Upstream commit 6da9f775 ]
      
      When debugging options are turned on, the rcu_read_lock() function
      might not be inlined. This results in lockdep's print_lock() function
      printing "rcu_read_lock+0x0/0x70" instead of rcu_read_lock()'s caller.
      For example:
      
      [   10.579995] =============================
      [   10.584033] WARNING: suspicious RCU usage
      [   10.588074] 4.18.0.memcg_v2+ #1 Not tainted
      [   10.593162] -----------------------------
      [   10.597203] include/linux/rcupdate.h:281 Illegal context switch in
      RCU read-side critical section!
      [   10.606220]
      [   10.606220] other info that might help us debug this:
      [   10.606220]
      [   10.614280]
      [   10.614280] rcu_scheduler_active = 2, debug_locks = 1
      [   10.620853] 3 locks held by systemd/1:
      [   10.624632]  #0: (____ptrval____) (&type->i_mutex_dir_key#5){.+.+}, at: lookup_slow+0x42/0x70
      [   10.633232]  #1: (____ptrval____) (rcu_read_lock){....}, at: rcu_read_lock+0x0/0x70
      [   10.640954]  #2: (____ptrval____) (rcu_read_lock){....}, at: rcu_read_lock+0x0/0x70
      
      These "rcu_read_lock+0x0/0x70" strings are not providing any useful
      information.  This commit therefore forces inlining of the rcu_read_lock()
      function so that rcu_read_lock()'s caller is instead shown.
      Signed-off-by: default avatarWaiman Long <longman@redhat.com>
      Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.ibm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      32d7d88f
    • Jerome Brunet's avatar
      ASoC: meson: axg-tdm: fix sample clock inversion · 031cf89b
      Jerome Brunet authored
      [ Upstream commit cb36ff78 ]
      
      The content of SND_SOC_DAIFMT_FORMAT_MASK is a number, not a bitfield,
      so the test to check if the format is i2s is wrong. Because of this the
      clock setting may be wrong. For example, the sample clock gets inverted
      in DSP B mode, when it should not.
      
      Fix the lrclk invert helper function
      
      Fixes: 1a11d88f ("ASoC: meson: add tdm formatter base driver")
      Signed-off-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      031cf89b
    • Rajneesh Bhardwaj's avatar
      x86/cpu: Add Ice Lake NNPI to Intel family · c3ee70b8
      Rajneesh Bhardwaj authored
      [ Upstream commit e32d045c ]
      
      Add the CPUID model number of Ice Lake Neural Network Processor for Deep
      Learning Inference (ICL-NNPI) to the Intel family list. Ice Lake NNPI uses
      model number 0x9D and this will be documented in a future version of Intel
      Software Development Manual.
      Signed-off-by: default avatarRajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: bp@suse.de
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: platform-driver-x86@vger.kernel.org
      Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
      Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
      Cc: Len Brown <lenb@kernel.org>
      Cc: Linux PM <linux-pm@vger.kernel.org>
      Link: https://lkml.kernel.org/r/20190606012419.13250-1-rajneesh.bhardwaj@linux.intel.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      c3ee70b8
    • Eric Biggers's avatar
      crypto: testmgr - add some more preemption points · c3fa410e
      Eric Biggers authored
      [ Upstream commit e63e1b0d ]
      
      Call cond_resched() after each fuzz test iteration.  This avoids stall
      warnings if fuzz_iterations is set very high for testing purposes.
      
      While we're at it, also call cond_resched() after finishing testing each
      test vector.
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Acked-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c3fa410e
    • Ondrej Mosnacek's avatar
      selinux: fix empty write to keycreate file · 005fa17c
      Ondrej Mosnacek authored
      [ Upstream commit 464c258a ]
      
      When sid == 0 (we are resetting keycreate_sid to the default value), we
      should skip the KEY__CREATE check.
      
      Before this patch, doing a zero-sized write to /proc/self/keycreate
      would check if the current task can create unlabeled keys (which would
      usually fail with -EACCESS and generate an AVC). Now it skips the check
      and correctly sets the task's keycreate_sid to 0.
      
      Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1719067
      
      Tested using the reproducer from the report above.
      
      Fixes: 4eb582cf ("[PATCH] keys: add a way to store the appropriate context for newly-created keys")
      Reported-by: default avatarKir Kolyshkin <kir@sacred.ru>
      Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      005fa17c
    • Marek Szyprowski's avatar
      media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7 · 1e1b3544
      Marek Szyprowski authored
      [ Upstream commit be22203a ]
      
      MFC v6 and v7 has no register to read min scratch buffer size, so it has
      to be read conditionally only if hardware supports it. This fixes following
      NULL pointer exception on SoCs with MFC v6/v7:
      
      8<--- cut here ---
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      pgd = f25837f9
      [00000000] *pgd=bd93d835
      Internal error: Oops: 17 [#1] PREEMPT SMP ARM
      Modules linked in: btmrvl_sdio btmrvl bluetooth mwifiex_sdio mwifiex ecdh_generic ecc
      Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
      PC is at s5p_mfc_get_min_scratch_buf_size+0x30/0x3c
      LR is at s5p_mfc_get_min_scratch_buf_size+0x28/0x3c
      ...
      [<c074f998>] (s5p_mfc_get_min_scratch_buf_size) from [<c0745bc0>] (s5p_mfc_irq+0x814/0xa5c)
      [<c0745bc0>] (s5p_mfc_irq) from [<c019a218>] (__handle_irq_event_percpu+0x64/0x3f8)
      [<c019a218>] (__handle_irq_event_percpu) from [<c019a5d8>] (handle_irq_event_percpu+0x2c/0x7c)
      [<c019a5d8>] (handle_irq_event_percpu) from [<c019a660>] (handle_irq_event+0x38/0x5c)
      [<c019a660>] (handle_irq_event) from [<c019ebc4>] (handle_fasteoi_irq+0xc4/0x180)
      [<c019ebc4>] (handle_fasteoi_irq) from [<c0199270>] (generic_handle_irq+0x24/0x34)
      [<c0199270>] (generic_handle_irq) from [<c0199888>] (__handle_domain_irq+0x7c/0xec)
      [<c0199888>] (__handle_domain_irq) from [<c04ac298>] (gic_handle_irq+0x58/0x9c)
      [<c04ac298>] (gic_handle_irq) from [<c0101ab0>] (__irq_svc+0x70/0xb0)
      Exception stack(0xe73ddc60 to 0xe73ddca8)
      ...
      [<c0101ab0>] (__irq_svc) from [<c01967d8>] (console_unlock+0x5a8/0x6a8)
      [<c01967d8>] (console_unlock) from [<c01981d0>] (vprintk_emit+0x118/0x2d8)
      [<c01981d0>] (vprintk_emit) from [<c01983b0>] (vprintk_default+0x20/0x28)
      [<c01983b0>] (vprintk_default) from [<c01989b4>] (printk+0x30/0x54)
      [<c01989b4>] (printk) from [<c07500b8>] (s5p_mfc_init_decode_v6+0x1d4/0x284)
      [<c07500b8>] (s5p_mfc_init_decode_v6) from [<c07230d0>] (vb2_start_streaming+0x24/0x150)
      [<c07230d0>] (vb2_start_streaming) from [<c0724e4c>] (vb2_core_streamon+0x11c/0x15c)
      [<c0724e4c>] (vb2_core_streamon) from [<c07478b8>] (vidioc_streamon+0x64/0xa0)
      [<c07478b8>] (vidioc_streamon) from [<c0709640>] (__video_do_ioctl+0x28c/0x45c)
      [<c0709640>] (__video_do_ioctl) from [<c0709bc8>] (video_usercopy+0x260/0x8a4)
      [<c0709bc8>] (video_usercopy) from [<c02b3820>] (do_vfs_ioctl+0xb0/0x9fc)
      [<c02b3820>] (do_vfs_ioctl) from [<c02b41a0>] (ksys_ioctl+0x34/0x58)
      [<c02b41a0>] (ksys_ioctl) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
      Exception stack(0xe73ddfa8 to 0xe73ddff0)
      ...
      ---[ end trace 376cf5ba6e0bee93 ]---
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      1e1b3544
    • Valdis Klētnieks's avatar
      bpf: silence warning messages in core · b4f85b13
      Valdis Klētnieks authored
      [ Upstream commit aee450cb ]
      
      Compiling kernel/bpf/core.c with W=1 causes a flood of warnings:
      
      kernel/bpf/core.c:1198:65: warning: initialized field overwritten [-Woverride-init]
       1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
            |                                                                 ^~~~
      kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
       1087 |  INSN_3(ALU, ADD,  X),   \
            |  ^~~~~~
      kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
       1202 |   BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
            |   ^~~~~~~~~~~~
      kernel/bpf/core.c:1198:65: note: (near initialization for 'public_insntable[12]')
       1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
            |                                                                 ^~~~
      kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
       1087 |  INSN_3(ALU, ADD,  X),   \
            |  ^~~~~~
      kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
       1202 |   BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
            |   ^~~~~~~~~~~~
      
      98 copies of the above.
      
      The attached patch silences the warnings, because we *know* we're overwriting
      the default initializer. That leaves bpf/core.c with only 6 other warnings,
      which become more visible in comparison.
      Signed-off-by: default avatarValdis Kletnieks <valdis.kletnieks@vt.edu>
      Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      b4f85b13
    • Young Xiao's avatar
      media: davinci: vpif_capture: fix memory leak in vpif_probe() · 472a0124
      Young Xiao authored
      [ Upstream commit 64f883cd ]
      
      If vpif_probe() fails on v4l2_device_register() and vpif_probe_complete(),
      then memory allocated at initialize_vpif() for global vpif_obj.dev[i]
      become unreleased.
      
      The patch adds deallocation of vpif_obj.dev[i] on the error path.
      Signed-off-by: default avatarYoung Xiao <92siuyang@gmail.com>
      Acked-by: default avatarLad, Prabhakar <prabhakar.csengg@gmail.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      472a0124
    • Tony Lindgren's avatar
      gpio: omap: Fix lost edge wake-up interrupts · a2e7dcfd
      Tony Lindgren authored
      [ Upstream commit a522f1d0 ]
      
      If an edge interrupt triggers while entering idle just before we save
      GPIO datain register to saved_datain, the triggered GPIO will not be
      noticed on wake-up. This is because the saved_datain and GPIO datain
      are the same on wake-up in omap_gpio_unidle(). Let's fix this by
      ignoring any pending edge interrupts for saved_datain.
      
      This issue affects only idle states where the GPIO module internal
      wake-up path is operational. For deeper idle states where the GPIO
      module gets powered off, Linux generic wakeirqs must be used for
      the padconf wake-up events with pinctrl-single driver. For examples,
      please see "interrupts-extended" dts usage in many drivers.
      
      This issue can be somewhat easily reproduced by pinging an idle system
      with smsc911x Ethernet interface configured IRQ_TYPE_EDGE_FALLING. At
      some point the smsc911x interrupts will just stop triggering. Also if
      WLCORE WLAN is used with EDGE interrupt like it's documentation specifies,
      we can see lost interrupts without this patch.
      
      Note that in the long run we may be able to cancel entering idle by
      returning an error in gpio_omap_cpu_notifier() on pending interrupts.
      But let's fix the bug first.
      
      Also note that because of the recent clean-up efforts this patch does
      not apply directly to older kernels. This does fix a long term issue
      though, and can be backported as needed.
      
      Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
      Cc: Grygorii Strashko <grygorii.strashko@ti.com>
      Cc: Keerthy <j-keerthy@ti.com>
      Cc: Ladislav Michl <ladis@linux-mips.org>
      Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
      Cc: Russell King <rmk+kernel@armlinux.org.uk>
      Cc: Tero Kristo <t-kristo@ti.com>
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a2e7dcfd
    • Srinivas Kandagatla's avatar
      regmap: fix bulk writes on paged registers · 5c4906f7
      Srinivas Kandagatla authored
      [ Upstream commit db057679 ]
      
      On buses like SlimBus and SoundWire which does not support
      gather_writes yet in regmap, A bulk write on paged register
      would be silently ignored after programming page.
      This is because local variable 'ret' value in regmap_raw_write_impl()
      gets reset to 0 once page register is written successfully and the
      code below checks for 'ret' value to be -ENOTSUPP before linearising
      the write buffer to send to bus->write().
      
      Fix this by resetting the 'ret' value to -ENOTSUPP in cases where
      gather_writes() is not supported or single register write is
      not possible.
      Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5c4906f7
    • Russell King's avatar
      gpio: omap: ensure irq is enabled before wakeup · fd40385f
      Russell King authored
      [ Upstream commit c859e0d4 ]
      
      Documentation states:
      
        NOTE: There must be a correlation between the wake-up enable and
        interrupt-enable registers. If a GPIO pin has a wake-up configured
        on it, it must also have the corresponding interrupt enabled (on
        one of the two interrupt lines).
      
      Ensure that this condition is always satisfied by enabling the detection
      events after enabling the interrupt, and disabling the detection before
      disabling the interrupt.  This ensures interrupt/wakeup events can not
      happen until both the wakeup and interrupt enables correlate.
      
      If we do any clearing, clear between the interrupt enable/disable and
      trigger setting.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      fd40385f
    • Russell King's avatar
      gpio: omap: fix lack of irqstatus_raw0 for OMAP4 · e1a324cc
      Russell King authored
      [ Upstream commit 64ea3e90 ]
      
      Commit 384ebe1c ("gpio/omap: Add DT support to GPIO driver") added
      the register definition tables to the gpio-omap driver. Subsequently to
      that commit, commit 4e962e89 ("gpio/omap: remove cpu_is_omapxxxx()
      checks from *_runtime_resume()") added definitions for irqstatus_raw*
      registers to the legacy OMAP4 definitions, but missed the DT
      definitions.
      
      This causes an unintentional change of behaviour for the 1.101 errata
      workaround on OMAP4 platforms. Fix this oversight.
      
      Fixes: 4e962e89 ("gpio/omap: remove cpu_is_omapxxxx() checks from *_runtime_resume()")
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e1a324cc
    • Eric Auger's avatar
      iommu: Fix a leak in iommu_insert_resv_region · 47b6814f
      Eric Auger authored
      [ Upstream commit ad0834de ]
      
      In case we expand an existing region, we unlink
      this latter and insert the larger one. In
      that case we should free the original region after
      the insertion. Also we can immediately return.
      
      Fixes: 6c65fb31 ("iommu: iommu_get_group_resv_regions")
      Signed-off-by: default avatarEric Auger <eric.auger@redhat.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      47b6814f
    • Kieran Bingham's avatar
      media: fdp1: Support M3N and E3 platforms · f7604fc3
      Kieran Bingham authored
      [ Upstream commit 4e8c120d ]
      
      New Gen3 R-Car platforms incorporate the FDP1 with an updated version
      register. No code change is required to support these targets, but they
      will currently report an error stating that the device can not be
      identified.
      
      Update the driver to match against the new device types.
      Signed-off-by: default avatarKieran Bingham <kieran.bingham+renesas@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f7604fc3
    • Oliver Neukum's avatar
      media: uvcvideo: Fix access to uninitialized fields on probe error · 22b193c0
      Oliver Neukum authored
      [ Upstream commit 11a087f4 ]
      
      We need to check whether this work we are canceling actually is
      initialized.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Reported-by: syzbot+2e1ef9188251d9cc7944@syzkaller.appspotmail.com
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      22b193c0
    • Xingyu Chen's avatar
      irqchip/meson-gpio: Add support for Meson-G12A SoC · d47f5d15
      Xingyu Chen authored
      [ Upstream commit c64a9e80 ]
      
      The Meson-G12A SoC uses the same GPIO interrupt controller IP block as the
      other Meson SoCs, A totle of 100 pins can be spied on, which is the sum of:
      
      - 223:100 undefined (no interrupt)
      - 99:97   3 pins on bank GPIOE
      - 96:77   20 pins on bank GPIOX
      - 76:61   16 pins on bank GPIOA
      - 60:53   8 pins on bank GPIOC
      - 52:37   16 pins on bank BOOT
      - 36:28   9 pins on bank GPIOH
      - 27:12   16 pins on bank GPIOZ
      - 11:0    12 pins in the AO domain
      Signed-off-by: default avatarXingyu Chen <xingyu.chen@amlogic.com>
      Signed-off-by: default avatarJianxin Pan <jianxin.pan@amlogic.com>
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d47f5d15
    • Thomas Richter's avatar
      perf report: Fix OOM error in TUI mode on s390 · e8fb963c
      Thomas Richter authored
      [ Upstream commit 8a07aa4e ]
      
      Debugging a OOM error using the TUI interface revealed this issue
      on s390:
      
      [tmricht@m83lp54 perf]$ cat /proc/kallsyms |sort
      ....
      00000001119b7158 B radix_tree_node_cachep
      00000001119b8000 B __bss_stop
      00000001119b8000 B _end
      000003ff80002850 t autofs_mount	[autofs4]
      000003ff80002868 t autofs_show_options	[autofs4]
      000003ff80002a98 t autofs_evict_inode	[autofs4]
      ....
      
      There is a huge gap between the last kernel symbol
      __bss_stop/_end and the first kernel module symbol
      autofs_mount (from autofs4 module).
      
      After reading the kernel symbol table via functions:
      
       dso__load()
       +--> dso__load_kernel_sym()
            +--> dso__load_kallsyms()
      	   +--> __dso_load_kallsyms()
      	        +--> symbols__fixup_end()
      
      the symbol __bss_stop has a start address of 1119b8000 and
      an end address of 3ff80002850, as can be seen by this debug statement:
      
        symbols__fixup_end __bss_stop start:0x1119b8000 end:0x3ff80002850
      
      The size of symbol __bss_stop is 0x3fe6e64a850 bytes!
      It is the last kernel symbol and fills up the space until
      the first kernel module symbol.
      
      This size kills the TUI interface when executing the following
      code:
      
        process_sample_event()
          hist_entry_iter__add()
            hist_iter__report_callback()
              hist_entry__inc_addr_samples()
                symbol__inc_addr_samples(symbol = __bss_stop)
                  symbol__cycles_hist()
                     annotated_source__alloc_histograms(...,
      				                symbol__size(sym),
      		                                ...)
      
      This function allocates memory to save sample histograms.
      The symbol_size() marco is defined as sym->end - sym->start, which
      results in above value of 0x3fe6e64a850 bytes and
      the call to calloc() in annotated_source__alloc_histograms() fails.
      
      The histgram memory allocation might fail, make this failure
      no-fatal and continue processing.
      
      Output before:
      [tmricht@m83lp54 perf]$ ./perf --debug stderr=1 report -vvvvv \
      					      -i ~/slow.data 2>/tmp/2
      [tmricht@m83lp54 perf]$ tail -5 /tmp/2
        __symbol__inc_addr_samples(875): ENOMEM! sym->name=__bss_stop,
      		start=0x1119b8000, addr=0x2aa0005eb08, end=0x3ff80002850,
      		func: 0
      problem adding hist entry, skipping event
      0x938b8 [0x8]: failed to process type: 68 [Cannot allocate memory]
      [tmricht@m83lp54 perf]$
      
      Output after:
      [tmricht@m83lp54 perf]$ ./perf --debug stderr=1 report -vvvvv \
      					      -i ~/slow.data 2>/tmp/2
      [tmricht@m83lp54 perf]$ tail -5 /tmp/2
         symbol__inc_addr_samples map:0x1597830 start:0x110730000 end:0x3ff80002850
         symbol__hists notes->src:0x2aa2a70 nr_hists:1
         symbol__inc_addr_samples sym:unlink_anon_vmas src:0x2aa2a70
         __symbol__inc_addr_samples: addr=0x11094c69e
         0x11094c670 unlink_anon_vmas: period++ [addr: 0x11094c69e, 0x2e, evidx=0]
         	=> nr_samples: 1, period: 526008
      [tmricht@m83lp54 perf]$
      
      There is no error about failed memory allocation and the TUI interface
      shows all entries.
      Signed-off-by: default avatarThomas Richter <tmricht@linux.ibm.com>
      Reviewed-by: default avatarHendrik Brueckner <brueckner@linux.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Link: http://lkml.kernel.org/r/90cb5607-3e12-5167-682d-978eba7dafa8@linux.ibm.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e8fb963c
    • Thomas Richter's avatar
      perf test 6: Fix missing kvm module load for s390 · 629bb02f
      Thomas Richter authored
      [ Upstream commit 53fe307d ]
      
      Command
      
         # perf test -Fv 6
      
      fails with error
      
         running test 100 'kvm-s390:kvm_s390_create_vm' failed to parse
          event 'kvm-s390:kvm_s390_create_vm', err -1, str 'unknown tracepoint'
          event syntax error: 'kvm-s390:kvm_s390_create_vm'
                               \___ unknown tracepoint
      
      when the kvm module is not loaded or not built in.
      
      Fix this by adding a valid function which tests if the module
      is loaded. Loaded modules (or builtin KVM support) have a
      directory named
        /sys/kernel/debug/tracing/events/kvm-s390
      for this tracepoint.
      
      Check for existence of this directory.
      Signed-off-by: default avatarThomas Richter <tmricht@linux.ibm.com>
      Reviewed-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Link: http://lkml.kernel.org/r/20190604053504.43073-1-tmricht@linux.ibm.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      629bb02f
    • Mathieu Poirier's avatar
      perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode · f511db18
      Mathieu Poirier authored
      [ Upstream commit e45c48a9 ]
      
      This patch adds the necessary intelligence to properly compute the value
      of 'old' and 'head' when operating in snapshot mode.  That way we can
      get the latest information in the AUX buffer and be compatible with the
      generic AUX ring buffer mechanic.
      
      Tester notes:
      
      > Leo, have you had the chance to test/review this one? Suzuki?
      
      Sure.  I applied this patch on the perf/core branch (with latest
      commit 3e4fbf36c1e3 'perf augmented_raw_syscalls: Move reading
      filename to the loop') and passed testing with below steps:
      
        # perf record -e cs_etm/@tmc_etr0/ -S -m,64 --per-thread ./sort &
        [1] 19097
        Bubble sorting array of 30000 elements
      
        # kill -USR2 19097
        # kill -USR2 19097
        # kill -USR2 19097
        [ perf record: Woken up 4 times to write data ]
        [ perf record: Captured and wrote 0.753 MB perf.data ]
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Tested-by: default avatarLeo Yan <leo.yan@linaro.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
      Cc: linux-arm-kernel@lists.infradead.org
      Link: http://lkml.kernel.org/r/20190605161633.12245-1-mathieu.poirier@linaro.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f511db18
    • Stefano Brivio's avatar
      ipset: Fix memory accounting for hash types on resize · 3711cf11
      Stefano Brivio authored
      [ Upstream commit 11921796 ]
      
      If a fresh array block is allocated during resize, the current in-memory
      set size should be increased by the size of the block, not replaced by it.
      
      Before the fix, adding entries to a hash set type, leading to a table
      resize, caused an inconsistent memory size to be reported. This becomes
      more obvious when swapping sets with similar sizes:
      
        # cat hash_ip_size.sh
        #!/bin/sh
        FAIL_RETRIES=10
      
        tries=0
        while [ ${tries} -lt ${FAIL_RETRIES} ]; do
        	ipset create t1 hash:ip
        	for i in `seq 1 4345`; do
        		ipset add t1 1.2.$((i / 255)).$((i % 255))
        	done
        	t1_init="$(ipset list t1|sed -n 's/Size in memory: \(.*\)/\1/p')"
      
        	ipset create t2 hash:ip
        	for i in `seq 1 4360`; do
        		ipset add t2 1.2.$((i / 255)).$((i % 255))
        	done
        	t2_init="$(ipset list t2|sed -n 's/Size in memory: \(.*\)/\1/p')"
      
        	ipset swap t1 t2
        	t1_swap="$(ipset list t1|sed -n 's/Size in memory: \(.*\)/\1/p')"
        	t2_swap="$(ipset list t2|sed -n 's/Size in memory: \(.*\)/\1/p')"
      
        	ipset destroy t1
        	ipset destroy t2
        	tries=$((tries + 1))
      
        	if [ ${t1_init} -lt 10000 ] || [ ${t2_init} -lt 10000 ]; then
        		echo "FAIL after ${tries} tries:"
        		echo "T1 size ${t1_init}, after swap ${t1_swap}"
        		echo "T2 size ${t2_init}, after swap ${t2_swap}"
        		exit 1
        	fi
        done
        echo "PASS"
        # echo -n 'func hash_ip4_resize +p' > /sys/kernel/debug/dynamic_debug/control
        # ./hash_ip_size.sh
        [ 2035.018673] attempt to resize set t1 from 10 to 11, t 00000000fe6551fa
        [ 2035.078583] set t1 resized from 10 (00000000fe6551fa) to 11 (00000000172a0163)
        [ 2035.080353] Table destroy by resize 00000000fe6551fa
        FAIL after 4 tries:
        T1 size 9064, after swap 71128
        T2 size 71128, after swap 9064
      Reported-by: default avatarNOYB <JunkYardMail1@Frontier.com>
      Fixes: 9e41f26a ("netfilter: ipset: Count non-static extension memory for userspace")
      Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
      Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3711cf11
    • Robert Hancock's avatar
      net: sfp: add mutex to prevent concurrent state checks · b892e3cf
      Robert Hancock authored
      [ Upstream commit 2158e856 ]
      
      sfp_check_state can potentially be called by both a threaded IRQ handler
      and delayed work. If it is concurrently called, it could result in
      incorrect state management. Add a st_mutex to protect the state - this
      lock gets taken outside of code that checks and handle state changes, and
      the existing sm_mutex nests inside of it.
      Suggested-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarRobert Hancock <hancock@sedsystems.ca>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      b892e3cf
    • Borislav Petkov's avatar
      RAS/CEC: Fix pfn insertion · 5b27bd98
      Borislav Petkov authored
      [ Upstream commit 6d8e294b ]
      
      When inserting random PFNs for debugging the CEC through
      (debugfs)/ras/cec/pfn, depending on the return value of pfn_set(),
      multiple values get inserted per a single write.
      
      That is because simple_attr_write() interprets a retval of 0 as
      success and claims the whole input. However, pfn_set() returns the
      cec_add_elem() value, which, if > 0 and smaller than the whole input
      length, makes glibc continue issuing the write syscall until there's
      input left:
      
        pfn_set
        simple_attr_write
        debugfs_attr_write
        full_proxy_write
        vfs_write
        ksys_write
        do_syscall_64
        entry_SYSCALL_64_after_hwframe
      
      leading to those repeated calls.
      
      Return 0 to fix that.
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: linux-edac <linux-edac@vger.kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5b27bd98
    • Julian Wiedmann's avatar
      s390/qdio: handle PENDING state for QEBSM devices · df2c88a7
      Julian Wiedmann authored
      [ Upstream commit 04310324 ]
      
      When a CQ-enabled device uses QEBSM for SBAL state inspection,
      get_buf_states() can return the PENDING state for an Output Queue.
      get_outbound_buffer_frontier() isn't prepared for this, and any PENDING
      buffer will permanently stall all further completion processing on this
      Queue.
      
      This isn't a concern for non-QEBSM devices, as get_buf_states() for such
      devices will manually turn PENDING buffers into EMPTY ones.
      
      Fixes: 104ea556 ("qdio: support asynchronous delivery of storage blocks")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      df2c88a7
    • Robert Hancock's avatar
      net: axienet: Fix race condition causing TX hang · 5b0c0598
      Robert Hancock authored
      [ Upstream commit 7de44285 ]
      
      It is possible that the interrupt handler fires and frees up space in
      the TX ring in between checking for sufficient TX ring space and
      stopping the TX queue in axienet_start_xmit. If this happens, the
      queue wake from the interrupt handler will occur before the queue is
      stopped, causing a lost wakeup and the adapter's transmit hanging.
      
      To avoid this, after stopping the queue, check again whether there is
      sufficient space in the TX ring. If so, wake up the queue again.
      Signed-off-by: default avatarRobert Hancock <hancock@sedsystems.ca>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5b0c0598
    • Fabio Estevam's avatar
      net: fec: Do not use netdev messages too early · a32d4cf2
      Fabio Estevam authored
      [ Upstream commit a19a0582 ]
      
      When a valid MAC address is not found the current messages
      are shown:
      
      fec 2188000.ethernet (unnamed net_device) (uninitialized): Invalid MAC address: 00:00:00:00:00:00
      fec 2188000.ethernet (unnamed net_device) (uninitialized): Using random MAC address: aa:9f:25:eb:7e:aa
      
      Since the network device has not been registered at this point, it is better
      to use dev_err()/dev_info() instead, which will provide cleaner log
      messages like these:
      
      fec 2188000.ethernet: Invalid MAC address: 00:00:00:00:00:00
      fec 2188000.ethernet: Using random MAC address: aa:9f:25:eb:7e:aa
      
      Tested on a imx6dl-pico-pi board.
      Signed-off-by: default avatarFabio Estevam <festevam@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a32d4cf2
    • Antoine Tenart's avatar
      crypto: inside-secure - do not rely on the hardware last bit for result descriptors · c9fd5afc
      Antoine Tenart authored
      [ Upstream commit 89332590 ]
      
      When performing a transformation the hardware is given result
      descriptors to save the result data. Those result descriptors are
      batched using a 'first' and a 'last' bit. There are cases were more
      descriptors than needed are given to the engine, leading to the engine
      only using some of them, and not setting the last bit on the last
      descriptor we gave. This causes issues were the driver and the hardware
      aren't in sync anymore about the number of result descriptors given (as
      the driver do not give a pool of descriptor to use for any
      transformation, but a pool of descriptors to use *per* transformation).
      
      This patch fixes it by attaching the number of given result descriptors
      to the requests, and by using this number instead of the 'last' bit
      found on the descriptors to process them.
      Signed-off-by: default avatarAntoine Tenart <antoine.tenart@bootlin.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c9fd5afc
    • Biao Huang's avatar
      net: stmmac: modify default value of tx-frames · bfaada52
      Biao Huang authored
      [ Upstream commit d2facb4b ]
      
      the default value of tx-frames is 25, it's too late when
      passing tstamp to stack, then the ptp4l will fail:
      
      ptp4l -i eth0 -f gPTP.cfg -m
      ptp4l: selected /dev/ptp0 as PTP clock
      ptp4l: port 1: INITIALIZING to LISTENING on INITIALIZE
      ptp4l: port 0: INITIALIZING to LISTENING on INITIALIZE
      ptp4l: port 1: link up
      ptp4l: timed out while polling for tx timestamp
      ptp4l: increasing tx_timestamp_timeout may correct this issue,
             but it is likely caused by a driver bug
      ptp4l: port 1: send peer delay response failed
      ptp4l: port 1: LISTENING to FAULTY on FAULT_DETECTED (FT_UNSPECIFIED)
      
      ptp4l tests pass when changing the tx-frames from 25 to 1 with
      ethtool -C option.
      It should be fine to set tx-frames default value to 1, so ptp4l will pass
      by default.
      Signed-off-by: default avatarBiao Huang <biao.huang@mediatek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      bfaada52
    • Biao Huang's avatar
      net: stmmac: dwmac4: fix flow control issue · ef5f55ea
      Biao Huang authored
      [ Upstream commit ee326fd0 ]
      
      Current dwmac4_flow_ctrl will not clear
      GMAC_RX_FLOW_CTRL_RFE/GMAC_RX_FLOW_CTRL_RFE bits,
      so MAC hw will keep flow control on although expecting
      flow control off by ethtool. Add codes to fix it.
      
      Fixes: 477286b5 ("stmmac: add GMAC4 core support")
      Signed-off-by: default avatarBiao Huang <biao.huang@mediatek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      ef5f55ea
    • Jae Hyun Yoo's avatar
      media: aspeed: change irq to threaded irq · 467d4560
      Jae Hyun Yoo authored
      [ Upstream commit 12ae1c1b ]
      
      Differently from other Aspeed drivers, this driver calls clock
      control APIs in interrupt context. Since ECLK is coupled with a
      reset bit in clk-aspeed module, aspeed_clk_enable will make 10ms of
      busy waiting delay for triggering the reset and it will eventually
      disturb other drivers' interrupt handling. To fix this issue, this
      commit changes this driver's irq to threaded irq so that the delay
      can be happened in a thread context.
      Signed-off-by: default avatarJae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
      Reviewed-by: default avatarEddie James <eajames@linux.ibm.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      467d4560
    • Jiri Olsa's avatar
      perf jvmti: Address gcc string overflow warning for strncpy() · 94140c6f
      Jiri Olsa authored
      [ Upstream commit 279ab04d ]
      
      We are getting false positive gcc warning when we compile with gcc9 (9.1.1):
      
           CC       jvmti/libjvmti.o
         In file included from /usr/include/string.h:494,
                          from jvmti/libjvmti.c:5:
         In function ‘strncpy’,
             inlined from ‘copy_class_filename.constprop’ at jvmti/libjvmti.c:166:3:
         /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
           106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
               |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         jvmti/libjvmti.c: In function ‘copy_class_filename.constprop’:
         jvmti/libjvmti.c:165:26: note: length computed here
           165 |   size_t file_name_len = strlen(file_name);
               |                          ^~~~~~~~~~~~~~~~~
         cc1: all warnings being treated as errors
      
      As per Arnaldo's suggestion use strlcpy(), which does the same thing and keeps
      gcc silent.
      Suggested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Ben Gainey <ben.gainey@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Link: http://lkml.kernel.org/r/20190531131321.GB1281@kravaSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      94140c6f
    • Fabio Estevam's avatar
      media: imx7-mipi-csis: Propagate the error if clock enabling fails · 5b41a2ed
      Fabio Estevam authored
      [ Upstream commit 2b393f91 ]
      
      Currently the return value from clk_bulk_prepare_enable() is checked,
      but it is not propagate it in the case of failure.
      
      Fix it and also move the error message to the caller of
      mipi_csis_clk_enable().
      Signed-off-by: default avatarFabio Estevam <festevam@gmail.com>
      Reviewed-by: default avatarRui Miguel Silva <rmfrfs@gmail.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5b41a2ed
    • Miles Chen's avatar
      arm64: mm: make CONFIG_ZONE_DMA32 configurable · 37243454
      Miles Chen authored
      [ Upstream commit 0c1f14ed ]
      
      This change makes CONFIG_ZONE_DMA32 defuly y and allows users
      to overwrite it only when CONFIG_EXPERT=y.
      
      For the SoCs that do not need CONFIG_ZONE_DMA32, this is the
      first step to manage all available memory by a single
      zone(normal zone) to reduce the overhead of multiple zones.
      
      The change also fixes a build error when CONFIG_NUMA=y and
      CONFIG_ZONE_DMA32=n.
      
      arch/arm64/mm/init.c:195:17: error: use of undeclared identifier 'ZONE_DMA32'
                      max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
      
      Change since v1:
      1. only expose CONFIG_ZONE_DMA32 when CONFIG_EXPERT=y
      2. remove redundant IS_ENABLED(CONFIG_ZONE_DMA32)
      
      Cc: Robin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarMiles Chen <miles.chen@mediatek.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      37243454
    • Abhishek Goel's avatar
      cpupower : frequency-set -r option misses the last cpu in related cpu list · 6aed94de
      Abhishek Goel authored
      [ Upstream commit 04507c0a ]
      
      To set frequency on specific cpus using cpupower, following syntax can
      be used :
      cpupower -c #i frequency-set -f #f -r
      
      While setting frequency using cpupower frequency-set command, if we use
      '-r' option, it is expected to set frequency for all cpus related to
      cpu #i. But it is observed to be missing the last cpu in related cpu
      list. This patch fixes the problem.
      Signed-off-by: default avatarAbhishek Goel <huntbag@linux.vnet.ibm.com>
      Reviewed-by: default avatarThomas Renninger <trenn@suse.de>
      Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      6aed94de
    • Weihang Li's avatar
      net: hns3: set ops to null when unregister ad_dev · 28a7d7a6
      Weihang Li authored
      [ Upstream commit 594a81b3 ]
      
      The hclge/hclgevf and hns3 module can be unloaded independently,
      when hclge/hclgevf unloaded firstly, the ops of ae_dev should
      be set to NULL, otherwise it will cause an use-after-free problem.
      
      Fixes: 38caee9d ("net: hns3: Add support of the HNAE3 framework")
      Signed-off-by: default avatarWeihang Li <liweihang@hisilicon.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      28a7d7a6
    • Weihang Li's avatar
      net: hns3: add a check to pointer in error_detected and slot_reset · bd87e2a1
      Weihang Li authored
      [ Upstream commit 661262bc ]
      
      If we add a VF without loading hclgevf.ko and then there is a RAS error
      occurs, PCIe AER will call error_detected and slot_reset of all functions,
      and will get a NULL pointer when we check ad_dev->ops->handle_hw_ras_error.
      This will cause a call trace and failures on handling of follow-up RAS
      errors.
      
      This patch check ae_dev and ad_dev->ops at first to solve above issues.
      Signed-off-by: default avatarWeihang Li <liweihang@hisilicon.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      bd87e2a1
    • Kefeng Wang's avatar
      media: wl128x: Fix some error handling in fm_v4l2_init_video_device() · b46ef18c
      Kefeng Wang authored
      [ Upstream commit 69fbb3f4 ]
      
      X-Originating-IP: [10.175.113.25]
      X-CFilter-Loop: Reflected
      The fm_v4l2_init_video_device() forget to unregister v4l2/video device
      in the error path, it could lead to UAF issue, eg,
      
        BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
        BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
        BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
        Read of size 8 at addr ffff8881e84a7c70 by task v4l_id/3659
      
        CPU: 1 PID: 3659 Comm: v4l_id Not tainted 5.1.0 #8
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
        Call Trace:
         __dump_stack lib/dump_stack.c:77 [inline]
         dump_stack+0xa9/0x10e lib/dump_stack.c:113
         print_address_description+0x65/0x270 mm/kasan/report.c:187
         kasan_report+0x149/0x18d mm/kasan/report.c:317
         atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
         atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
         __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
         fm_v4l2_fops_open+0xac/0x120 [fm_drv]
         v4l2_open+0x191/0x390 [videodev]
         chrdev_open+0x20d/0x570 fs/char_dev.c:417
         do_dentry_open+0x700/0xf30 fs/open.c:777
         do_last fs/namei.c:3416 [inline]
         path_openat+0x7c4/0x2a90 fs/namei.c:3532
         do_filp_open+0x1a5/0x2b0 fs/namei.c:3563
         do_sys_open+0x302/0x490 fs/open.c:1069
         do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
         entry_SYSCALL_64_after_hwframe+0x49/0xbe
        RIP: 0033:0x7f8180c17c8e
        ...
        Allocated by task 3642:
         set_track mm/kasan/common.c:87 [inline]
         __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:497
         fm_drv_init+0x13/0x1000 [fm_drv]
         do_one_initcall+0xbc/0x47d init/main.c:901
         do_init_module+0x1b5/0x547 kernel/module.c:3456
         load_module+0x6405/0x8c10 kernel/module.c:3804
         __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
         do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
         entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
        Freed by task 3642:
         set_track mm/kasan/common.c:87 [inline]
         __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
         slab_free_hook mm/slub.c:1429 [inline]
         slab_free_freelist_hook mm/slub.c:1456 [inline]
         slab_free mm/slub.c:3003 [inline]
         kfree+0xe1/0x270 mm/slub.c:3958
         fm_drv_init+0x1e6/0x1000 [fm_drv]
         do_one_initcall+0xbc/0x47d init/main.c:901
         do_init_module+0x1b5/0x547 kernel/module.c:3456
         load_module+0x6405/0x8c10 kernel/module.c:3804
         __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
         do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
         entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Add relevant unregister functions to fix it.
      
      Cc: Hans Verkuil <hans.verkuil@cisco.com>
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      b46ef18c
    • Imre Deak's avatar
      locking/lockdep: Fix merging of hlocks with non-zero references · 3e6d03e7
      Imre Deak authored
      [ Upstream commit d9349850 ]
      
      The sequence
      
      	static DEFINE_WW_CLASS(test_ww_class);
      
      	struct ww_acquire_ctx ww_ctx;
      	struct ww_mutex ww_lock_a;
      	struct ww_mutex ww_lock_b;
      	struct ww_mutex ww_lock_c;
      	struct mutex lock_c;
      
      	ww_acquire_init(&ww_ctx, &test_ww_class);
      
      	ww_mutex_init(&ww_lock_a, &test_ww_class);
      	ww_mutex_init(&ww_lock_b, &test_ww_class);
      	ww_mutex_init(&ww_lock_c, &test_ww_class);
      
      	mutex_init(&lock_c);
      
      	ww_mutex_lock(&ww_lock_a, &ww_ctx);
      
      	mutex_lock(&lock_c);
      
      	ww_mutex_lock(&ww_lock_b, &ww_ctx);
      	ww_mutex_lock(&ww_lock_c, &ww_ctx);
      
      	mutex_unlock(&lock_c);	(*)
      
      	ww_mutex_unlock(&ww_lock_c);
      	ww_mutex_unlock(&ww_lock_b);
      	ww_mutex_unlock(&ww_lock_a);
      
      	ww_acquire_fini(&ww_ctx); (**)
      
      will trigger the following error in __lock_release() when calling
      mutex_release() at **:
      
      	DEBUG_LOCKS_WARN_ON(depth <= 0)
      
      The problem is that the hlock merging happening at * updates the
      references for test_ww_class incorrectly to 3 whereas it should've
      updated it to 4 (representing all the instances for ww_ctx and
      ww_lock_[abc]).
      
      Fix this by updating the references during merging correctly taking into
      account that we can have non-zero references (both for the hlock that we
      merge into another hlock or for the hlock we are merging into).
      Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Will Deacon <will.deacon@arm.com>
      Link: https://lkml.kernel.org/r/20190524201509.9199-2-imre.deak@intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3e6d03e7