This removes the need to manually free the kpad object and cleans up some
exit/error paths.  The error path cleanup should reduce the risk of any
memory leaks with this object.
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20201112074308.71351-2-alexandru.ardelean@analog.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This adds the code for the Atmel touchscreens such as mXT224 to obtain
power regulators for the supply voltages AVDD and VDD. On mobile phones
such as Samsung GT-I8190 (Golden) this is needed to explicitly bring power
online.

We just enable the regulators at probe() and disable them at remove()
or in the error path for now.

As regulators are naturally stubbed if not available, this should have no
impact on existing systems.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20201104153032.1387747-3-linus.walleij@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This converts the Armel MXT touchscreen bindings to YAML format and
extends them with the following two properties:

- vdda-supply: the optional analog supply voltage
- vdd-supply: the optional digital supply voltage

Tested the schema with all in-tree users and they verify fine.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20201104153032.1387747-2-linus.walleij@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This driver uses GPIO descriptors to drive the touchscreen RESET line. In
the existing device trees this has in conflict with intution been flagged
as GPIO_ACTIVE_HIGH and the driver then applies the reverse action by
driving the line low (setting to 0) to enter reset state and driving the
line high (setting to 1) to get out of reset state.

The correct way to handle active low GPIO lines is to provide the
GPIO_ACTIVE_LOW in the device tree (thus properly describing the hardware)
and letting the GPIO framework invert the assertion (driving high) to a
low level and vice versa.

This is considered a bug since the device trees are incorrectly
mis-specifying the line as active high.

Fix the driver and all device trees specifying a reset line.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Philippe Schenker <philippe.schenker@toradex.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201104153032.1387747-1-linus.walleij@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Sync up with mainline to bring in the latest DTS files.

The same clause as its use.

Fixes the following W=1 kernel build warning(s):

 include/linux/input/elan-i2c-ids.h:26:36: warning: ‘elan_acpi_id’ defined but not used [-Wunused-const-variable=]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201112104420.GG1997862@dellSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This is essentially a revert of:

	3ac8bf07 ("[PATCH] ads7846: sparc32 warning fix")

By now enable_irq() and disable_irq() are properly defined in
linux/interrupt.h and we do not need to pull in architecture-specific
bits.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.

Fixes: 3eac5c7e ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.deSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Starting with 3eac5c7e ("Input: ads7846 - extend the driver for ads7845
controller support"), the ads7845 was partially converted to full duplex
mode.

Since it is not touchscreen controller specific, it is better to extend
this conversion to cover entire driver. This will reduce CPU load and make
driver more readable.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201110085041.16303-2-o.rempel@pengutronix.deSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.

Fixes: f5a28a7d ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.deSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/imx6ul_tsc.c: In function ‘adc_irq_fn’:
 drivers/input/touchscreen/imx6ul_tsc.c:307:6: warning: variable ‘value’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
Link: https://lore.kernel.org/r/20201112110204.2083435-6-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/keyboard/samsung-keypad.c: In function ‘samsung_keypad_irq’:
 drivers/input/keyboard/samsung-keypad.c:149:15: warning: variable ‘val’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201112110204.2083435-3-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Hard-coding resolution for st1633 device was wrong. Some of LCDs like
YTS700TLBC-02-100C has assembled Sitronix st1633 touchcontroller too. But
the resolution is not 320x480 as was hard-coded.
Add new function which reads correct resolution directly from register.
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Link: https://lore.kernel.org/r/20201103073949.12198-1-andrej.valek@siemens.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the kerneldoc warnings from building the driver with W=1.
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-2-lee.jones@linaro.org
[dtor: folded together several Lee's patches; added more descriptions]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

In file included from drivers/input/touchscreen/cyttsp_i2c_common.c:24:
 drivers/input/touchscreen/cyttsp4_core.h:236:27: warning: ‘cyttsp4_tch_abs_string’ defined but not used [-Wunused-const-variable=]
 236 | static const char  const cyttsp4_tch_abs_string[] = {
 | ^~~~~~~~~~~~~~~~~~~~~~
 In file included from drivers/input/touchscreen/cyttsp4_i2c.c:17:
 drivers/input/touchscreen/cyttsp4_core.h:236:27: warning: ‘cyttsp4_tch_abs_string’ defined but not used [-Wunused-const-variable=]
 236 | static const char * const cyttsp4_tch_abs_string[] = {
 | ^~~~~~~~~~~~~~~~~~~~~~
 In file included from drivers/input/touchscreen/cyttsp4_spi.c:17:
 drivers/input/touchscreen/cyttsp4_core.h:236:27: warning: ‘cyttsp4_tch_abs_string’ defined but not used [-Wunused-const-variable=]
 236 | static const char * const cyttsp4_tch_abs_string[] = {
 | ^~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-16-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/resistive-adc-touch.c:34: warning: cannot understand function prototype: 'struct grts_state '
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-10-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The location of the minus sign and the error code are
linked together for better human view.
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201027135020.66632-1-zhangqilong3@huawei.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/mouse/cyapa_gen5.c:392: warning: Function parameter or member 'cyapa' not described in 'cyapa_i2c_pip_write'
 drivers/input/mouse/cyapa_gen5.c:392: warning: Function parameter or member 'buf' not described in 'cyapa_i2c_pip_write'
 drivers/input/mouse/cyapa_gen5.c:392: warning: Function parameter or member 'size' not described in 'cyapa_i2c_pip_write'
 drivers/input/mouse/cyapa_gen5.c:444: warning: Function parameter or member 'cyapa' not described in 'cyapa_empty_pip_output_data'
 drivers/input/mouse/cyapa_gen5.c:444: warning: Function parameter or member 'buf' not described in 'cyapa_empty_pip_output_data'
 drivers/input/mouse/cyapa_gen5.c:444: warning: Function parameter or member 'len' not described in 'cyapa_empty_pip_output_data'
 drivers/input/mouse/cyapa_gen5.c:444: warning: Function parameter or member 'func' not described in 'cyapa_empty_pip_output_data'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-4-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/mouse/cyapa.c:130: warning: Function parameter or member 'reg' not described in 'cyapa_i2c_write'
 drivers/input/mouse/cyapa.c:130: warning: Excess function parameter 'ret' description in 'cyapa_i2c_write'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-3-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/misc/ab8500-ponkey.c:32: warning: Function parameter or member 'idev' not described in 'ab8500_ponkey'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-5-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/keyboard/cros_ec_keyb.c:72: warning: cannot understand function prototype: 'struct cros_ec_bs_map '
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-8-lee.jones@linaro.org
[dtor: fixed up docbook comments for cros_ec_keyb structure as well]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/keyboard/gpio_keys.c:119: warning: Function parameter or member 'dev' not described in 'get_bm_events_by_type'
 drivers/input/keyboard/gpio_keys.c:119: warning: Excess function parameter 'input' description in 'get_bm_events_by_type'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-12-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/mouse/elantech.c:1837: warning: Function parameter or member 'psmouse' not described in 'elantech_setup_smbus'
 drivers/input/mouse/elantech.c:1837: warning: Function parameter or member 'info' not described in 'elantech_setup_smbus'
 drivers/input/mouse/elantech.c:1837: warning: Function parameter or member 'leave_breadcrumbs' not described in 'elantech_setup_smbus'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-13-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'num_rows' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'num_cols' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'input' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'regmap' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'key_sense_irq' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'key_stuck_irq' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'keycodes' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'dev' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'keystate' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'stuckstate' not described in 'pmic8xxx_kp'
 drivers/input/keyboard/pmic8xxx-keypad.c:106: warning: Function parameter or member 'ctrl_reg' not described in 'pmic8xxx_kp'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-21-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/keyboard/nomadik-ske-keypad.c:71: warning: Function parameter or member 'pclk' not described in 'ske_keypad'
 drivers/input/keyboard/nomadik-ske-keypad.c:71: warning: Function parameter or member 'ske_keypad_lock' not described in 'ske_keypad'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-20-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'input_dev' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'client' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'regmap' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'work' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'regulator' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'page' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'magnitude' not described in 'drv2667_data'
 drivers/input/misc/drv2667.c:109: warning: Function parameter or member 'frequency' not described in 'drv2667_data'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-19-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/misc/drv2665.c:59: warning: Function parameter or member 'input_dev' not described in 'drv2665_data'
 drivers/input/misc/drv2665.c:59: warning: Function parameter or member 'client' not described in 'drv2665_data'
 drivers/input/misc/drv2665.c:59: warning: Function parameter or member 'regmap' not described in 'drv2665_data'
 drivers/input/misc/drv2665.c:59: warning: Function parameter or member 'work' not described in 'drv2665_data'
 drivers/input/misc/drv2665.c:59: warning: Function parameter or member 'regulator' not described in 'drv2665_data'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-18-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'input_dev' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'client' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'regmap' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'work' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'enable_gpio' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'regulator' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'magnitude' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'mode' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'library' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'rated_voltage' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:194: warning: Function parameter or member 'overdrive_voltage' not described in 'drv260x_data'
 drivers/input/misc/drv260x.c:244: warning: Function parameter or member 'voltage' not described in 'drv260x_calculate_voltage'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201104162427.2984742-17-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Use kobj_to_dev() instead of container_of().
Signed-off-by: Wang Qing <wangqing@vivo.com>
Link: https://lore.kernel.org/r/1604893436-20206-1-git-send-email-wangqing@vivo.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The eKTF2132 is a touchscreen controller found, for example, in the Kobo
Aura ebook reader. It is similar to the ektf2127, but it uses a different
packet type to report touch events.
Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Link: https://lore.kernel.org/r/20201106112412.390724-3-j.neuschaefer@gmx.netSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The eKTF2132 is a touchscreen controller found, for example, in the Kobo
Aura ebook reader. It is similar to the ektf2127, but it uses a different
packet type to report touch events.
Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Link: https://lore.kernel.org/r/20201106112412.390724-2-j.neuschaefer@gmx.netSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Merge misc fixes from Andrew Morton:
 "Five fixes.

  Subsystems affected by this patch series: MAINTAINERS, mm/pagemap,
  mm/swap, and mm/hugetlb"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged
  mm: validate inode in mapping_set_error()
  mm: mmap: Fix general protection fault in unlink_file_vma()
  MAINTAINERS: Antoine Tenart's email address
  MAINTAINERS: change hardening mailing list

Pull vfs fix from Al Viro:
 "Fixes an obvious bug (memory leak introduced in 5.8)"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  pipe: Fix memory leaks in create_pipe_files()

Pull x86 fixes from Ingo Molnar:
 "Two fixes:

   - Fix a (hopefully final) IRQ state tracking bug vs MCE handling

   - Fix a documentation link"

* tag 'x86-urgent-2020-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Documentation/x86: Fix incorrect references to zero-page.txt
  x86/mce: Use idtentry_nmi_enter/exit()

Pull perf fix from Ingo Molnar:
 "Fix an error handling bug that can cause a lockup if a CPU is offline
  (doh ...)"

* tag 'perf-urgent-2020-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix task_function_call() error handling

When memory is hotplug added or removed the min_free_kbytes should be
recalculated based on what is expected by khugepaged.  Currently after
hotplug, min_free_kbytes will be set to a lower default and higher
default set when THP enabled is lost.

This change restores min_free_kbytes as expected for THP consumers.

[vijayb@linux.microsoft.com: v5]
  Link: https://lkml.kernel.org/r/1601398153-5517-1-git-send-email-vijayb@linux.microsoft.com

Fixes: f000565a ("thp: set recommended min free kbytes")
Signed-off-by: Vijay Balakrishna <vijayb@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Pavel Tatashin <pasha.tatashin@soleen.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Allen Pais <apais@microsoft.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/1600305709-2319-2-git-send-email-vijayb@linux.microsoft.com
Link: https://lkml.kernel.org/r/1600204258-13683-1-git-send-email-vijayb@linux.microsoft.comSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The swap address_space doesn't have host. Thus, it makes kernel crash once
swap write meets error. Fix it.

Fixes: 735e4ae5 ("vfs: track per-sb writeback errors and report them to syncfs")
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Jeff Layton <jlayton@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Andres Freund <andres@anarazel.de>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Howells <dhowells@redhat.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201010000650.750063-1-minchan@kernel.orgSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The syzbot reported the below general protection fault:

  general protection fault, probably for non-canonical address
  0xe00eeaee0000003b: 0000 [#1] PREEMPT SMP KASAN
  KASAN: maybe wild-memory-access in range [0x00777770000001d8-0x00777770000001df]
  CPU: 1 PID: 10488 Comm: syz-executor721 Not tainted 5.9.0-rc3-syzkaller #0
  RIP: 0010:unlink_file_vma+0x57/0xb0 mm/mmap.c:164
  Call Trace:
     free_pgtables+0x1b3/0x2f0 mm/memory.c:415
     exit_mmap+0x2c0/0x530 mm/mmap.c:3184
     __mmput+0x122/0x470 kernel/fork.c:1076
     mmput+0x53/0x60 kernel/fork.c:1097
     exit_mm kernel/exit.c:483 [inline]
     do_exit+0xa8b/0x29f0 kernel/exit.c:793
     do_group_exit+0x125/0x310 kernel/exit.c:903
     get_signal+0x428/0x1f00 kernel/signal.c:2757
     arch_do_signal+0x82/0x2520 arch/x86/kernel/signal.c:811
     exit_to_user_mode_loop kernel/entry/common.c:136 [inline]
     exit_to_user_mode_prepare+0x1ae/0x200 kernel/entry/common.c:167
     syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:242
     entry_SYSCALL_64_after_hwframe+0x44/0xa9

It's because the ->mmap() callback can change vma->vm_file and fput the
original file.  But the commit d70cec89 ("mm: mmap: merge vma after
call_mmap() if possible") failed to catch this case and always fput()
the original file, hence add an extra fput().

[ Thanks Hillf for pointing this extra fput() out. ]

Fixes: d70cec89 ("mm: mmap: merge vma after call_mmap() if possible")
Reported-by: syzbot+c5d5a51dcbb558ca0cb5@syzkaller.appspotmail.com
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Cc: Hongxiang Lou <louhongxiang@huawei.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Link: https://lkml.kernel.org/r/20200916090733.31427-1-linmiaohe@huawei.comSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>