1. 24 Feb, 2020 10 commits
    • Esben Haabendal's avatar
      net: ll_temac: Fix RX buffer descriptor handling on GFP_ATOMIC pressure · 770d9c67
      Esben Haabendal authored
      Failures caused by GFP_ATOMIC memory pressure have been observed, and
      due to the missing error handling, results in kernel crash such as
      
      [1876998.350133] kernel BUG at mm/slub.c:3952!
      [1876998.350141] invalid opcode: 0000 [#1] PREEMPT SMP PTI
      [1876998.350147] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.3.0-scnxt #1
      [1876998.350150] Hardware name: N/A N/A/COMe-bIP2, BIOS CCR2R920 03/01/2017
      [1876998.350160] RIP: 0010:kfree+0x1ca/0x220
      [1876998.350164] Code: 85 db 74 49 48 8b 95 68 01 00 00 48 31 c2 48 89 10 e9 d7 fe ff ff 49 8b 04 24 a9 00 00 01 00 75 0b 49 8b 44 24 08 a8 01 75 02 <0f> 0b 49 8b 04 24 31 f6 a9 00 00 01 00 74 06 41 0f b6 74 24
       5b
      [1876998.350172] RSP: 0018:ffffc900000f0df0 EFLAGS: 00010246
      [1876998.350177] RAX: ffffea00027f0708 RBX: ffff888008d78000 RCX: 0000000000391372
      [1876998.350181] RDX: 0000000000000000 RSI: ffffe8ffffd01400 RDI: ffff888008d78000
      [1876998.350185] RBP: ffff8881185a5d00 R08: ffffc90000087dd8 R09: 000000000000280a
      [1876998.350189] R10: 0000000000000002 R11: 0000000000000000 R12: ffffea0000235e00
      [1876998.350193] R13: ffff8881185438a0 R14: 0000000000000000 R15: ffff888118543870
      [1876998.350198] FS:  0000000000000000(0000) GS:ffff88811f300000(0000) knlGS:0000000000000000
      [1876998.350203] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      s#1 Part1
      [1876998.350206] CR2: 00007f8dac7b09f0 CR3: 000000011e20a006 CR4: 00000000001606e0
      [1876998.350210] Call Trace:
      [1876998.350215]  <IRQ>
      [1876998.350224]  ? __netif_receive_skb_core+0x70a/0x920
      [1876998.350229]  kfree_skb+0x32/0xb0
      [1876998.350234]  __netif_receive_skb_core+0x70a/0x920
      [1876998.350240]  __netif_receive_skb_one_core+0x36/0x80
      [1876998.350245]  process_backlog+0x8b/0x150
      [1876998.350250]  net_rx_action+0xf7/0x340
      [1876998.350255]  __do_softirq+0x10f/0x353
      [1876998.350262]  irq_exit+0xb2/0xc0
      [1876998.350265]  do_IRQ+0x77/0xd0
      [1876998.350271]  common_interrupt+0xf/0xf
      [1876998.350274]  </IRQ>
      
      In order to handle such failures more graceful, this change splits the
      receive loop into one for consuming the received buffers, and one for
      allocating new buffers.
      
      When GFP_ATOMIC allocations fail, the receive will continue with the
      buffers that is still there, and with the expectation that the allocations
      will succeed in a later call to receive.
      
      Fixes: 92744989 ("net: add Xilinx ll_temac device driver")
      Signed-off-by: default avatarEsben Haabendal <esben@geanix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      770d9c67
    • Esben Haabendal's avatar
      net: ll_temac: Add more error handling of dma_map_single() calls · d07c849c
      Esben Haabendal authored
      This adds error handling to the remaining dma_map_single() calls, so that
      behavior is well defined if/when we run out of DMA memory.
      
      Fixes: 92744989 ("net: add Xilinx ll_temac device driver")
      Signed-off-by: default avatarEsben Haabendal <esben@geanix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d07c849c
    • Esben Haabendal's avatar
      net: ll_temac: Fix race condition causing TX hang · 84823ff8
      Esben Haabendal authored
      It is possible that the interrupt handler fires and frees up space in
      the TX ring in between checking for sufficient TX ring space and
      stopping the TX queue in temac_start_xmit. If this happens, the
      queue wake from the interrupt handler will occur before the queue is
      stopped, causing a lost wakeup and the adapter's transmit hanging.
      
      To avoid this, after stopping the queue, check again whether there is
      sufficient space in the TX ring. If so, wake up the queue again.
      
      This is a port of the similar fix in axienet driver,
      commit 7de44285 ("net: axienet: Fix race condition causing TX hang").
      
      Fixes: 23ecc4bd ("net: ll_temac: fix checksum offload logic")
      Signed-off-by: default avatarEsben Haabendal <esben@geanix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84823ff8
    • Madhuparna Bhowmik's avatar
      net: core: devlink.c: Hold devlink->lock from the beginning of devlink_dpipe_table_register() · 6132c1d9
      Madhuparna Bhowmik authored
      devlink_dpipe_table_find() should be called under either
      rcu_read_lock() or devlink->lock. devlink_dpipe_table_register()
      calls devlink_dpipe_table_find() without holding the lock
      and acquires it later. Therefore hold the devlink->lock
      from the beginning of devlink_dpipe_table_register().
      Suggested-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarMadhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6132c1d9
    • Florian Fainelli's avatar
      net: phy: Avoid multiple suspends · 503ba7c6
      Florian Fainelli authored
      It is currently possible for a PHY device to be suspended as part of a
      network device driver's suspend call while it is still being attached to
      that net_device, either via phy_suspend() or implicitly via phy_stop().
      
      Later on, when the MDIO bus controller get suspended, we would attempt
      to suspend again the PHY because it is still attached to a network
      device.
      
      This is both a waste of time and creates an opportunity for improper
      clock/power management bugs to creep in.
      
      Fixes: 803dd9c7 ("net: phy: avoid suspending twice a PHY")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      503ba7c6
    • Marek Vasut's avatar
      net: ks8851-ml: Fix IRQ handling and locking · 44343418
      Marek Vasut authored
      The KS8851 requires that packet RX and TX are mutually exclusive.
      Currently, the driver hopes to achieve this by disabling interrupt
      from the card by writing the card registers and by disabling the
      interrupt on the interrupt controller. This however is racy on SMP.
      
      Replace this approach by expanding the spinlock used around the
      ks_start_xmit() TX path to ks_irq() RX path to assure true mutual
      exclusion and remove the interrupt enabling/disabling, which is
      now not needed anymore. Furthermore, disable interrupts also in
      ks_net_stop(), which was missing before.
      
      Note that a massive improvement here would be to re-use the KS8851
      driver approach, which is to move the TX path into a worker thread,
      interrupt handling to threaded interrupt, and synchronize everything
      with mutexes, but that would be a much bigger rework, for a separate
      patch.
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Petr Stetiar <ynezz@true.cz>
      Cc: YueHaibing <yuehaibing@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      44343418
    • Jonathan Neuschäfer's avatar
      docs: networking: phy: Rephrase paragraph for clarity · 52df1e56
      Jonathan Neuschäfer authored
      Let's make it a little easier to read.
      Signed-off-by: default avatarJonathan Neuschäfer <j.neuschaefer@gmx.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      52df1e56
    • Neal Cardwell's avatar
      tcp: fix TFO SYNACK undo to avoid double-timestamp-undo · dad8cea7
      Neal Cardwell authored
      In a rare corner case the new logic for undo of SYNACK RTO could
      result in triggering the warning in tcp_fastretrans_alert() that says:
              WARN_ON(tp->retrans_out != 0);
      
      The warning looked like:
      
      WARNING: CPU: 1 PID: 1 at net/ipv4/tcp_input.c:2818 tcp_ack+0x13e0/0x3270
      
      The sequence that tickles this bug is:
       - Fast Open server receives TFO SYN with data, sends SYNACK
       - (client receives SYNACK and sends ACK, but ACK is lost)
       - server app sends some data packets
       - (N of the first data packets are lost)
       - server receives client ACK that has a TS ECR matching first SYNACK,
         and also SACKs suggesting the first N data packets were lost
          - server performs TS undo of SYNACK RTO, then immediately
            enters recovery
          - buggy behavior then performed a *second* undo that caused
            the connection to be in CA_Open with retrans_out != 0
      
      Basically, the incoming ACK packet with SACK blocks causes us to first
      undo the cwnd reduction from the SYNACK RTO, but then immediately
      enters fast recovery, which then makes us eligible for undo again. And
      then tcp_rcv_synrecv_state_fastopen() accidentally performs an undo
      using a "mash-up" of state from two different loss recovery phases: it
      uses the timestamp info from the ACK of the original SYNACK, and the
      undo_marker from the fast recovery.
      
      This fix refines the logic to only invoke the tcp_try_undo_loss()
      inside tcp_rcv_synrecv_state_fastopen() if the connection is still in
      CA_Loss.  If peer SACKs triggered fast recovery, then
      tcp_rcv_synrecv_state_fastopen() can't safely undo.
      
      Fixes: 794200d6 ("tcp: undo cwnd on Fast Open spurious SYNACK retransmit")
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dad8cea7
    • Haiyang Zhang's avatar
      hv_netvsc: Fix unwanted wakeup in netvsc_attach() · f6f13c12
      Haiyang Zhang authored
      When netvsc_attach() is called by operations like changing MTU, etc.,
      an extra wakeup may happen while netvsc_attach() calling
      rndis_filter_device_add() which sends rndis messages when queue is
      stopped in netvsc_detach(). The completion message will wake up queue 0.
      
      We can reproduce the issue by changing MTU etc., then the wake_queue
      counter from "ethtool -S" will increase beyond stop_queue counter:
           stop_queue: 0
           wake_queue: 1
      The issue causes queue wake up, and counter increment, no other ill
      effects in current code. So we didn't see any network problem for now.
      
      To fix this, initialize tx_disable to true, and set it to false when
      the NIC is ready to be attached or registered.
      
      Fixes: 7b2ee50c ("hv_netvsc: common detach logic")
      Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f6f13c12
    • Daniele Palmas's avatar
      net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch · eae7172f
      Daniele Palmas authored
      usbnet creates network interfaces with min_mtu = 0 and
      max_mtu = ETH_MAX_MTU.
      
      These values are not modified by qmi_wwan when the network interface
      is created initially, allowing, for example, to set mtu greater than 1500.
      
      When a raw_ip switch is done (raw_ip set to 'Y', then set to 'N') the mtu
      values for the network interface are set through ether_setup, with
      min_mtu = ETH_MIN_MTU and max_mtu = ETH_DATA_LEN, not allowing anymore to
      set mtu greater than 1500 (error: mtu greater than device maximum).
      
      The patch restores the original min/max mtu values set by usbnet after a
      raw_ip switch.
      Signed-off-by: default avatarDaniele Palmas <dnlplm@gmail.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eae7172f
  2. 23 Feb, 2020 3 commits
  3. 21 Feb, 2020 27 commits
    • Linus Torvalds's avatar
      Merge tag 'linux-watchdog-5.6-rc3' of git://www.linux-watchdog.org/linux-watchdog · 0c0ddd6a
      Linus Torvalds authored
      Pull watchdog fixes from Wim Van Sebroeck:
      
       - mtk_wdt needs RESET_CONTROLLER to build
      
       - da9062 driver fixes:
           - fix power management ops
           - do not ping the hw during stop()
           - add dependency on I2C
      
      * tag 'linux-watchdog-5.6-rc3' of git://www.linux-watchdog.org/linux-watchdog:
        watchdog: da9062: Add dependency on I2C
        watchdog: da9062: fix power management ops
        watchdog: da9062: do not ping the hw during stop()
        watchdog: fix mtk_wdt.c RESET_CONTROLLER build error
      0c0ddd6a
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · bb65619e
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char/misc driver fixes for 5.6-rc3.
      
        Also included in here are some updates for some documentation files
        that I seem to be maintaining these days.
      
        The driver fixes are:
         - small fixes for the habanalabs driver
         - fsi driver bugfix
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'char-misc-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        Documentation/process: Swap out the ambassador for Canonical
        habanalabs: patched cb equals user cb in device memset
        habanalabs: do not halt CoreSight during hard reset
        habanalabs: halt the engines before hard-reset
        MAINTAINERS: remove unnecessary ':' characters
        fsi: aspeed: add unspecified HAS_IOMEM dependency
        COPYING: state that all contributions really are covered by this file
        Documentation/process: Change Microsoft contact for embargoed hardware issues
        embargoed-hardware-issues: drop Amazon contact as the email address now bounces
        Documentation/process: Add Arm contact for embargoed HW issues
      bb65619e
    • Linus Torvalds's avatar
      Merge tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · e5553ac7
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some small staging driver fixes for 5.6-rc3, along with the
        removal of an unused/unneeded driver as well.
      
        The android vsoc driver is not needed anymore by anyone, so it was
        removed.
      
        The other driver fixes are:
         - ashmem bugfixes
         - greybus audio driver bugfix
         - wireless driver bugfixes and tiny cleanups to error paths
      
        All of these have been in linux-next for a while now with no reported
        issues"
      
      * tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: rtl8723bs: Remove unneeded goto statements
        staging: rtl8188eu: Remove some unneeded goto statements
        staging: rtl8723bs: Fix potential overuse of kernel memory
        staging: rtl8188eu: Fix potential overuse of kernel memory
        staging: rtl8723bs: Fix potential security hole
        staging: rtl8188eu: Fix potential security hole
        staging: greybus: use after free in gb_audio_manager_remove_all()
        staging: android: Delete the 'vsoc' driver
        staging: rtl8723bs: fix copy of overlapping memory
        staging: android: ashmem: Disallow ashmem memory from being remapped
        staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
      e5553ac7
    • Linus Torvalds's avatar
      Merge tag 'tty-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · ef11f1b7
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are a number of small tty and serial driver fixes for 5.6-rc3
        that resolve a bunch of reported issues.
      
        They are:
         - vt selection and ioctl fixes
         - serdev bugfix
         - atmel serial driver fixes
         - qcom serial driver fixes
         - other minor serial driver fixes
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        vt: selection, close sel_buffer race
        vt: selection, handle pending signals in paste_selection
        serial: cpm_uart: call cpm_muram_init before registering console
        tty: serial: qcom_geni_serial: Fix RX cancel command failure
        serial: 8250: Check UPF_IRQ_SHARED in advance
        tty: serial: imx: setup the correct sg entry for tx dma
        vt: vt_ioctl: fix race in VT_RESIZEX
        vt: fix scrollback flushing on background consoles
        tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started
        tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode
        serdev: ttyport: restore client ops on deregistration
        serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
      ef11f1b7
    • Linus Torvalds's avatar
      Merge tag 'usb-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · cee853e8
      Linus Torvalds authored
      Pull USB/Thunderbolt fixes from Greg KH:
       "Here are a number of small USB driver fixes for 5.6-rc3.
      
        Included in here are:
        - MAINTAINER file updates
        - USB gadget driver fixes
        - usb core quirk additions and fixes for regressions
        - xhci driver fixes
        - usb serial driver id additions and fixes
        - thunderbolt bugfix
      
        Thunderbolt patches come in through here now that USB4 is really
        thunderbolt.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (34 commits)
        USB: misc: iowarrior: add support for the 100 device
        thunderbolt: Prevent crash if non-active NVMem file is read
        usb: gadget: udc-xilinx: Fix xudc_stop() kernel-doc format
        USB: misc: iowarrior: add support for the 28 and 28L devices
        USB: misc: iowarrior: add support for 2 OEMed devices
        USB: Fix novation SourceControl XL after suspend
        xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2
        Revert "xhci: Fix memory leak when caching protocol extended capability PSI tables"
        MAINTAINERS: Sort entries in database for THUNDERBOLT
        usb: dwc3: debug: fix string position formatting mixup with ret and len
        usb: gadget: serial: fix Tx stall after buffer overflow
        usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
        usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows
        usb: dwc2: Fix in ISOC request length checking
        usb: gadget: composite: Support more than 500mA MaxPower
        usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus
        usb: gadget: u_audio: Fix high-speed max packet size
        usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields
        USB: core: clean up endpoint-descriptor parsing
        USB: quirks: blacklist duplicate ep on Sound Devices USBPre2
        ...
      cee853e8
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-02-21' of git://anongit.freedesktop.org/drm/drm · 88f8bbfa
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Varied fixes for rc3.
      
        i915 is the largest, they are seeing some ACPI problems with their CI
        which hopefully get solved soon [1].
      
        msm has a bunch of fixes for new hw added in the merge, a bunch of
        amdgpu fixes, and nouveau adds support for some new firmwares for
        turing tu11x GPUs that were just released into linux-firmware by
        nvidia, they operate the same as the ones we already have for tu10x so
        should be fine to hook up.
      
        Otherwise it's just misc fixes for panfrost and sun4i.
      
        core:
         - Allow only one rotation argument, and allow zero rotation in video
           cmdline.
      
        i915:
         - Workaround missing Display Stream Compression (DSC) state readout
           by forcing modeset when its enabled at probe
         - Fix EHL port clock voltage level requirements
         - Fix queuing retire workers on the virtual engine
         - Fix use of partially initialized waiters
         - Stop using drm_pci_alloc/drm_pci/free
         - Fix rewind of RING_TAIL by forcing a context reload
         - Fix locking on resetting ring->head
         - Propagate our bug filing URL change to stable kernels
      
        panfrost:
         - Small compiler warning fix for panfrost.
         - Fix when using performance counters in panfrost when using per fd
           address space.
      
        sun4xi:
         - Fix dt binding
      
        nouveau:
         - tu11x modesetting fix
         - ACR/GR firmware support for tu11x (fw is public now)
      
        msm:
         - fix UBWC on GPU and display side for sc7180
         - fix DSI suspend/resume issue encountered on sc7180
         - fix some breakage on so called "linux-android" devices
            (fallout from sc7180/a618 support, not seen earlier due to
             bootloader/firmware differences)
         - couple other misc fixes
      
        amdgpu:
         - HDCP fixes
         - xclk fix for raven
         - GFXOFF fixes"
      
      [1] The Intel suspend testing should now be fixed by commit 63fb9623
          ("ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake()")
      
      * tag 'drm-fixes-2020-02-21' of git://anongit.freedesktop.org/drm/drm: (39 commits)
        drm/amdgpu/display: clean up hdcp workqueue handling
        drm/amdgpu: add is_raven_kicker judgement for raven1
        drm/i915/gt: Avoid resetting ring->head outside of its timeline mutex
        drm/i915/execlists: Always force a context reload when rewinding RING_TAIL
        drm/i915: Wean off drm_pci_alloc/drm_pci_free
        drm/i915/gt: Protect defer_request() from new waiters
        drm/i915/gt: Prevent queuing retire workers on the virtual engine
        drm/i915/dsc: force full modeset whenever DSC is enabled at probe
        drm/i915/ehl: Update port clock voltage level requirements
        drm/i915: Update drm/i915 bug filing URL
        MAINTAINERS: Update drm/i915 bug filing URL
        drm/i915: Initialise basic fence before acquiring seqno
        drm/i915/gem: Require per-engine reset support for non-persistent contexts
        drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets
        drm/nouveau/gr/tu11x: initial support
        drm/nouveau/acr/tu11x: initial support
        drm/amdgpu/gfx10: disable gfxoff when reading rlc clock
        drm/amdgpu/gfx9: disable gfxoff when reading rlc clock
        drm/amdgpu/soc15: fix xclk for raven
        drm/amd/powerplay: always refetch the enabled features status on dpm enablement
        ...
      88f8bbfa
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 3dc55dba
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Limit xt_hashlimit hash table size to avoid OOM or hung tasks, from
          Cong Wang.
      
       2) Fix deadlock in xsk by publishing global consumer pointers when NAPI
          is finished, from Magnus Karlsson.
      
       3) Set table field properly to RT_TABLE_COMPAT when necessary, from
          Jethro Beekman.
      
       4) NLA_STRING attributes are not necessary NULL terminated, deal wiht
          that in IFLA_ALT_IFNAME. From Eric Dumazet.
      
       5) Fix checksum handling in atlantic driver, from Dmitry Bezrukov.
      
       6) Handle mtu==0 devices properly in wireguard, from Jason A.
          Donenfeld.
      
       7) Fix several lockdep warnings in bonding, from Taehee Yoo.
      
       8) Fix cls_flower port blocking, from Jason Baron.
      
       9) Sanitize internal map names in libbpf, from Toke Høiland-Jørgensen.
      
      10) Fix RDMA race in qede driver, from Michal Kalderon.
      
      11) Fix several false lockdep warnings by adding conditions to
          list_for_each_entry_rcu(), from Madhuparna Bhowmik.
      
      12) Fix sleep in atomic in mlx5 driver, from Huy Nguyen.
      
      13) Fix potential deadlock in bpf_map_do_batch(), from Yonghong Song.
      
      14) Hey, variables declared in switch statement before any case
          statements are not initialized. I learn something every day. Get
          rids of this stuff in several parts of the networking, from Kees
          Cook.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (99 commits)
        bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs.
        bnxt_en: Improve device shutdown method.
        net: netlink: cap max groups which will be considered in netlink_bind()
        net: thunderx: workaround BGX TX Underflow issue
        ionic: fix fw_status read
        net: disable BRIDGE_NETFILTER by default
        net: macb: Properly handle phylink on at91rm9200
        s390/qeth: fix off-by-one in RX copybreak check
        s390/qeth: don't warn for napi with 0 budget
        s390/qeth: vnicc Fix EOPNOTSUPP precedence
        openvswitch: Distribute switch variables for initialization
        net: ip6_gre: Distribute switch variables for initialization
        net: core: Distribute switch variables for initialization
        udp: rehash on disconnect
        net/tls: Fix to avoid gettig invalid tls record
        bpf: Fix a potential deadlock with bpf_map_do_batch
        bpf: Do not grab the bucket spinlock by default on htab batch ops
        ice: Wait for VF to be reset/ready before configuration
        ice: Don't tell the OS that link is going down
        ice: Don't reject odd values of usecs set by user
        ...
      3dc55dba
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · b0dd1eb2
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
      
       - A few y2038 fixes which missed the merge window while dependencies
         in NFS were being sorted out.
      
       - A bunch of fixes. Some minor, some not.
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        MAINTAINERS: use tabs for SAFESETID
        lib/stackdepot.c: fix global out-of-bounds in stack_slabs
        mm/sparsemem: pfn_to_page is not valid yet on SPARSEMEM
        mm/vmscan.c: don't round up scan size for online memory cgroup
        lib/string.c: update match_string() doc-strings with correct behavior
        mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps()
        mm/swapfile.c: fix a comment in sys_swapon()
        scripts/get_maintainer.pl: deprioritize old Fixes: addresses
        get_maintainer: remove uses of P: for maintainer name
        selftests/vm: add missed tests in run_vmtests
        include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
        Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
        y2038: hide timeval/timespec/itimerval/itimerspec types
        y2038: remove unused time32 interfaces
        y2038: remove ktime to/from timespec/timeval conversion
      b0dd1eb2
    • Randy Dunlap's avatar
      MAINTAINERS: use tabs for SAFESETID · bb8d00ff
      Randy Dunlap authored
      Use tabs for indentation instead of spaces for SAFESETID.  All (!) other
      entries in MAINTAINERS use tabs (according to my simple grepping).
      
      Link: http://lkml.kernel.org/r/2bb2e52a-2694-816d-57b4-6cabfadd6c1a@infradead.orgSigned-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Micah Morton <mortonm@chromium.org>
      Cc: James Morris <jmorris@namei.org>
      Cc: "Serge E. Hallyn" <serge@hallyn.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bb8d00ff
    • Alexander Potapenko's avatar
      lib/stackdepot.c: fix global out-of-bounds in stack_slabs · 305e519c
      Alexander Potapenko authored
      Walter Wu has reported a potential case in which init_stack_slab() is
      called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
      initialized.  In that case init_stack_slab() will overwrite
      stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
      corruption.
      
      Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
      Fixes: cd11016e ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
      Signed-off-by: default avatarAlexander Potapenko <glider@google.com>
      Reported-by: default avatarWalter Wu <walter-zh.wu@mediatek.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Matthias Brugger <matthias.bgg@gmail.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Kate Stewart <kstewart@linuxfoundation.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      305e519c
    • Wei Yang's avatar
      mm/sparsemem: pfn_to_page is not valid yet on SPARSEMEM · 18e19f19
      Wei Yang authored
      When we use SPARSEMEM instead of SPARSEMEM_VMEMMAP, pfn_to_page()
      doesn't work before sparse_init_one_section() is called.
      
      This leads to a crash when hotplug memory:
      
          BUG: unable to handle page fault for address: 0000000006400000
          #PF: supervisor write access in kernel mode
          #PF: error_code(0x0002) - not-present page
          PGD 0 P4D 0
          Oops: 0002 [#1] SMP PTI
          CPU: 3 PID: 221 Comm: kworker/u16:1 Tainted: G        W         5.5.0-next-20200205+ #343
          Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
          Workqueue: kacpi_hotplug acpi_hotplug_work_fn
          RIP: 0010:__memset+0x24/0x30
          Code: cc cc cc cc cc cc 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3
          RSP: 0018:ffffb43ac0373c80 EFLAGS: 00010a87
          RAX: ffffffffffffffff RBX: ffff8a1518800000 RCX: 0000000000050000
          RDX: 0000000000000000 RSI: 00000000000000ff RDI: 0000000006400000
          RBP: 0000000000140000 R08: 0000000000100000 R09: 0000000006400000
          R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
          R13: 0000000000000028 R14: 0000000000000000 R15: ffff8a153ffd9280
          FS:  0000000000000000(0000) GS:ffff8a153ab00000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 0000000006400000 CR3: 0000000136fca000 CR4: 00000000000006e0
          DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
          DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
          Call Trace:
           sparse_add_section+0x1c9/0x26a
           __add_pages+0xbf/0x150
           add_pages+0x12/0x60
           add_memory_resource+0xc8/0x210
           __add_memory+0x62/0xb0
           acpi_memory_device_add+0x13f/0x300
           acpi_bus_attach+0xf6/0x200
           acpi_bus_scan+0x43/0x90
           acpi_device_hotplug+0x275/0x3d0
           acpi_hotplug_work_fn+0x1a/0x30
           process_one_work+0x1a7/0x370
           worker_thread+0x30/0x380
           kthread+0x112/0x130
           ret_from_fork+0x35/0x40
      
      We should use memmap as it did.
      
      On x86 the impact is limited to x86_32 builds, or x86_64 configurations
      that override the default setting for SPARSEMEM_VMEMMAP.
      
      Other memory hotplug archs (arm64, ia64, and ppc) also default to
      SPARSEMEM_VMEMMAP=y.
      
      [dan.j.williams@intel.com: changelog update]
      {rppt@linux.ibm.com: changelog update]
      Link: http://lkml.kernel.org/r/20200219030454.4844-1-bhe@redhat.com
      Fixes: ba72b4c8 ("mm/sparsemem: support sub-section hotplug")
      Signed-off-by: default avatarWei Yang <richardw.yang@linux.intel.com>
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
      Reviewed-by: default avatarBaoquan He <bhe@redhat.com>
      Reviewed-by: default avatarDan Williams <dan.j.williams@intel.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Cc: Oscar Salvador <osalvador@suse.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      18e19f19
    • Gavin Shan's avatar
      mm/vmscan.c: don't round up scan size for online memory cgroup · 76073c64
      Gavin Shan authored
      Commit 68600f62 ("mm: don't miss the last page because of round-off
      error") makes the scan size round up to @denominator regardless of the
      memory cgroup's state, online or offline.  This affects the overall
      reclaiming behavior: the corresponding LRU list is eligible for
      reclaiming only when its size logically right shifted by @sc->priority
      is bigger than zero in the former formula.
      
      For example, the inactive anonymous LRU list should have at least 0x4000
      pages to be eligible for reclaiming when we have 60/12 for
      swappiness/priority and without taking scan/rotation ratio into account.
      
      After the roundup is applied, the inactive anonymous LRU list becomes
      eligible for reclaiming when its size is bigger than or equal to 0x1000
      in the same condition.
      
          (0x4000 >> 12) * 60 / (60 + 140 + 1) = 1
          ((0x1000 >> 12) * 60) + 200) / (60 + 140 + 1) = 1
      
      aarch64 has 512MB huge page size when the base page size is 64KB.  The
      memory cgroup that has a huge page is always eligible for reclaiming in
      that case.
      
      The reclaiming is likely to stop after the huge page is reclaimed,
      meaing the further iteration on @sc->priority and the silbing and child
      memory cgroups will be skipped.  The overall behaviour has been changed.
      This fixes the issue by applying the roundup to offlined memory cgroups
      only, to give more preference to reclaim memory from offlined memory
      cgroup.  It sounds reasonable as those memory is unlikedly to be used by
      anyone.
      
      The issue was found by starting up 8 VMs on a Ampere Mustang machine,
      which has 8 CPUs and 16 GB memory.  Each VM is given with 2 vCPUs and
      2GB memory.  It took 264 seconds for all VMs to be completely up and
      784MB swap is consumed after that.  With this patch applied, it took 236
      seconds and 60MB swap to do same thing.  So there is 10% performance
      improvement for my case.  Note that KSM is disable while THP is enabled
      in the testing.
      
               total     used    free   shared  buff/cache   available
         Mem:  16196    10065    2049       16        4081        3749
         Swap:  8175      784    7391
               total     used    free   shared  buff/cache   available
         Mem:  16196    11324    3656       24        1215        2936
         Swap:  8175       60    8115
      
      Link: http://lkml.kernel.org/r/20200211024514.8730-1-gshan@redhat.com
      Fixes: 68600f62 ("mm: don't miss the last page because of round-off error")
      Signed-off-by: default avatarGavin Shan <gshan@redhat.com>
      Acked-by: default avatarRoman Gushchin <guro@fb.com>
      Cc: <stable@vger.kernel.org>	[4.20+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      76073c64
    • Alexandru Ardelean's avatar
      lib/string.c: update match_string() doc-strings with correct behavior · c11d3fa0
      Alexandru Ardelean authored
      There were a few attempts at changing behavior of the match_string()
      helpers (i.e.  'match_string()' & 'sysfs_match_string()'), to change &
      extend the behavior according to the doc-string.
      
      But the simplest approach is to just fix the doc-strings.  The current
      behavior is fine as-is, and some bugs were introduced trying to fix it.
      
      As for extending the behavior, new helpers can always be introduced if
      needed.
      
      The match_string() helpers behave more like 'strncmp()' in the sense
      that they go up to n elements or until the first NULL element in the
      array of strings.
      
      This change updates the doc-strings with this info.
      
      Link: http://lkml.kernel.org/r/20200213072722.8249-1-alexandru.ardelean@analog.comSigned-off-by: default avatarAlexandru Ardelean <alexandru.ardelean@analog.com>
      Acked-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: "Tobin C . Harding" <tobin@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c11d3fa0
    • Vasily Averin's avatar
      mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps() · 75866af6
      Vasily Averin authored
      for_each_mem_cgroup() increases css reference counter for memory cgroup
      and requires to use mem_cgroup_iter_break() if the walk is cancelled.
      
      Link: http://lkml.kernel.org/r/c98414fb-7e1f-da0f-867a-9340ec4bd30b@virtuozzo.com
      Fixes: 0a4465d3 ("mm, memcg: assign memcg-aware shrinkers bitmap to memcg")
      Signed-off-by: default avatarVasily Averin <vvs@virtuozzo.com>
      Acked-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Reviewed-by: default avatarRoman Gushchin <guro@fb.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      75866af6
    • Christoph Hellwig's avatar
    • Douglas Anderson's avatar
      scripts/get_maintainer.pl: deprioritize old Fixes: addresses · 0ef82fce
      Douglas Anderson authored
      Recently, I found that get_maintainer was causing me to send emails to
      the old addresses for maintainers.  Since I usually just trust the
      output of get_maintainer to know the right email address, I didn't even
      look carefully and fired off two patch series that went to the wrong
      place.  Oops.
      
      The problem was introduced recently when trying to add signatures from
      Fixes.  The problem was that these email addresses were added too early
      in the process of compiling our list of places to send.  Things added to
      the list earlier are considered more canonical and when we later added
      maintainer entries we ended up deduplicating to the old address.
      
      Here are two examples using mainline commits (to make it easier to
      replicate) for the two maintainers that I messed up recently:
      
        $ git format-patch d8549bcd~..d8549bcd
        $ ./scripts/get_maintainer.pl 0001-clk-Add-clk_hw*.patch | grep Boyd
        Stephen Boyd <sboyd@codeaurora.org>...
      
        $ git format-patch 6d1238aa~..6d1238aa
        $ ./scripts/get_maintainer.pl 0001-arm64-dts-qcom-qcs404*.patch | grep Andy
        Andy Gross <andy.gross@linaro.org>
      
      Let's move the adding of addresses from Fixes: to the end since the
      email addresses from these are much more likely to be older.
      
      After this patch the above examples get the right addresses for the two
      examples.
      
      Link: http://lkml.kernel.org/r/20200127095001.1.I41fba9f33590bfd92cd01960161d8384268c6569@changeid
      Fixes: 2f5bd343 ("scripts/get_maintainer.pl: add signatures from Fixes: <badcommit> lines in commit message")
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarJoe Perches <joe@perches.com>
      Cc: Stephen Boyd <sboyd@kernel.org>
      Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
      Cc: Andy Gross <agross@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0ef82fce
    • Joe Perches's avatar
      get_maintainer: remove uses of P: for maintainer name · ef0c0819
      Joe Perches authored
      Commit 1ca84ed6 ("MAINTAINERS: Reclaim the P: tag for Maintainer
      Entry Profile") changed the use of the "P:" tag from "Person" to
      "Profile (ie: special subsystem coding styles and characteristics)"
      
      Change how get_maintainer.pl parses the "P:" tag to match.
      
      Link: http://lkml.kernel.org/r/ca53823fc5d25c0be32ad937d0207a0589c08643.camel@perches.comSigned-off-by: default avatarJoe Perches <joe@perches.com>
      Acked-by: default avatarDan Williams <dan.j.william@intel.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ef0c0819
    • SeongJae Park's avatar
      selftests/vm: add missed tests in run_vmtests · 9e69fa46
      SeongJae Park authored
      The commits introducing 'mlock-random-test'[1], 'map_fiex_noreplace'[2],
      and 'thuge-gen'[3] have not added those in the 'run_vmtests' script and
      thus the 'run_tests' command of kselftests doesn't run those.  This
      commit adds those in the script.
      
      'gup_benchmark' and 'transhuge-stress' are also not included in the
      'run_vmtests', but this commit does not add those because those are for
      performance measurement rather than pass/fail tests.
      
      [1] commit 26b4224d ("selftests: expanding more mlock selftest")
      [2] commit 91cbacc3 ("tools/testing/selftests/vm/map_fixed_noreplace.c: add test for MAP_FIXED_NOREPLACE")
      [3] commit fcc1f2d5 ("selftests: add a test program for variable huge page sizes in mmap/shmget")
      
      Link: http://lkml.kernel.org/r/20200206085144.29126-1-sj38.park@gmail.comSigned-off-by: default avatarSeongJae Park <sjpark@amazon.de>
      Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Shuah Khan <shuah@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9e69fa46
    • Christian Borntraeger's avatar
      include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap · 467d12f5
      Christian Borntraeger authored
      QEMU has a funny new build error message when I use the upstream kernel
      headers:
      
            CC      block/file-posix.o
          In file included from /home/cborntra/REPOS/qemu/include/qemu/timer.h:4,
                           from /home/cborntra/REPOS/qemu/include/qemu/timed-average.h:29,
                           from /home/cborntra/REPOS/qemu/include/block/accounting.h:28,
                           from /home/cborntra/REPOS/qemu/include/block/block_int.h:27,
                           from /home/cborntra/REPOS/qemu/block/file-posix.c:30:
          /usr/include/linux/swab.h: In function `__swab':
          /home/cborntra/REPOS/qemu/include/qemu/bitops.h:20:34: error: "sizeof" is not defined, evaluates to 0 [-Werror=undef]
             20 | #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
                |                                  ^~~~~~
          /home/cborntra/REPOS/qemu/include/qemu/bitops.h:20:41: error: missing binary operator before token "("
             20 | #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
                |                                         ^
          cc1: all warnings being treated as errors
          make: *** [/home/cborntra/REPOS/qemu/rules.mak:69: block/file-posix.o] Error 1
          rm tests/qemu-iotests/socket_scm_helper.o
      
      This was triggered by commit d5767057 ("uapi: rename ext2_swab() to
      swab() and share globally in swab.h").  That patch is doing
      
        #include <asm/bitsperlong.h>
      
      but it uses BITS_PER_LONG.
      
      The kernel file asm/bitsperlong.h provide only __BITS_PER_LONG.
      
      Let us use the __ variant in swap.h
      
      Link: http://lkml.kernel.org/r/20200213142147.17604-1-borntraeger@de.ibm.com
      Fixes: d5767057 ("uapi: rename ext2_swab() to swab() and share globally in swab.h")
      Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Cc: Yury Norov <yury.norov@gmail.com>
      Cc: Allison Randal <allison@lohutok.net>
      Cc: Joe Perches <joe@perches.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: William Breathitt Gray <vilhelm.gray@gmail.com>
      Cc: Torsten Hilbrich <torsten.hilbrich@secunet.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      467d12f5
    • Ioanna Alifieraki's avatar
      Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" · edf28f40
      Ioanna Alifieraki authored
      This reverts commit a9795584.
      
      Commit a9795584 ("ipc,sem: remove uneeded sem_undo_list lock usage
      in exit_sem()") removes a lock that is needed.  This leads to a process
      looping infinitely in exit_sem() and can also lead to a crash.  There is
      a reproducer available in [1] and with the commit reverted the issue
      does not reproduce anymore.
      
      Using the reproducer found in [1] is fairly easy to reach a point where
      one of the child processes is looping infinitely in exit_sem between
      for(;;) and if (semid == -1) block, while it's trying to free its last
      sem_undo structure which has already been freed by freeary().
      
      Each sem_undo struct is on two lists: one per semaphore set (list_id)
      and one per process (list_proc).  The list_id list tracks undos by
      semaphore set, and the list_proc by process.
      
      Undo structures are removed either by freeary() or by exit_sem().  The
      freeary function is invoked when the user invokes a syscall to remove a
      semaphore set.  During this operation freeary() traverses the list_id
      associated with the semaphore set and removes the undo structures from
      both the list_id and list_proc lists.
      
      For this case, exit_sem() is called at process exit.  Each process
      contains a struct sem_undo_list (referred to as "ulp") which contains
      the head for the list_proc list.  When the process exits, exit_sem()
      traverses this list to remove each sem_undo struct.  As in freeary(),
      whenever a sem_undo struct is removed from list_proc, it is also removed
      from the list_id list.
      
      Removing elements from list_id is safe for both exit_sem() and freeary()
      due to sem_lock().  Removing elements from list_proc is not safe;
      freeary() locks &un->ulp->lock when it performs
      list_del_rcu(&un->list_proc) but exit_sem() does not (locking was
      removed by commit a9795584 ("ipc,sem: remove uneeded sem_undo_list
      lock usage in exit_sem()").
      
      This can result in the following situation while executing the
      reproducer [1] : Consider a child process in exit_sem() and the parent
      in freeary() (because of semctl(sid[i], NSEM, IPC_RMID)).
      
       - The list_proc for the child contains the last two undo structs A and
         B (the rest have been removed either by exit_sem() or freeary()).
      
       - The semid for A is 1 and semid for B is 2.
      
       - exit_sem() removes A and at the same time freeary() removes B.
      
       - Since A and B have different semid sem_lock() will acquire different
         locks for each process and both can proceed.
      
      The bug is that they remove A and B from the same list_proc at the same
      time because only freeary() acquires the ulp lock. When exit_sem()
      removes A it makes ulp->list_proc.next to point at B and at the same
      time freeary() removes B setting B->semid=-1.
      
      At the next iteration of for(;;) loop exit_sem() will try to remove B.
      
      The only way to break from for(;;) is for (&un->list_proc ==
      &ulp->list_proc) to be true which is not. Then exit_sem() will check if
      B->semid=-1 which is and will continue looping in for(;;) until the
      memory for B is reallocated and the value at B->semid is changed.
      
      At that point, exit_sem() will crash attempting to unlink B from the
      lists (this can be easily triggered by running the reproducer [1] a
      second time).
      
      To prove this scenario instrumentation was added to keep information
      about each sem_undo (un) struct that is removed per process and per
      semaphore set (sma).
      
                CPU0                                CPU1
        [caller holds sem_lock(sma for A)]      ...
        freeary()                               exit_sem()
        ...                                     ...
        ...                                     sem_lock(sma for B)
        spin_lock(A->ulp->lock)                 ...
        list_del_rcu(un_A->list_proc)           list_del_rcu(un_B->list_proc)
      
      Undo structures A and B have different semid and sem_lock() operations
      proceed.  However they belong to the same list_proc list and they are
      removed at the same time.  This results into ulp->list_proc.next
      pointing to the address of B which is already removed.
      
      After reverting commit a9795584 ("ipc,sem: remove uneeded
      sem_undo_list lock usage in exit_sem()") the issue was no longer
      reproducible.
      
      [1] https://bugzilla.redhat.com/show_bug.cgi?id=1694779
      
      Link: http://lkml.kernel.org/r/20191211191318.11860-1-ioanna-maria.alifieraki@canonical.com
      Fixes: a9795584 ("ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()")
      Signed-off-by: default avatarIoanna Alifieraki <ioanna-maria.alifieraki@canonical.com>
      Acked-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Acked-by: default avatarHerton R. Krzesinski <herton@redhat.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: <malat@debian.org>
      Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: Jay Vosburgh <jay.vosburgh@canonical.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      edf28f40
    • Arnd Bergmann's avatar
      y2038: hide timeval/timespec/itimerval/itimerspec types · c766d147
      Arnd Bergmann authored
      There are no in-kernel users remaining, but there may still be users that
      include linux/time.h instead of sys/time.h from user space, so leave the
      types available to user space while hiding them from kernel space.
      
      Only the __kernel_old_* versions of these types remain now.
      
      Link: http://lkml.kernel.org/r/20200110154232.4104492-4-arnd@arndb.deSigned-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Deepa Dinamani <deepa.kernel@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c766d147
    • Arnd Bergmann's avatar
      y2038: remove unused time32 interfaces · 412c53a6
      Arnd Bergmann authored
      No users remain, so kill these off before we grow new ones.
      
      Link: http://lkml.kernel.org/r/20200110154232.4104492-3-arnd@arndb.deSigned-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Deepa Dinamani <deepa.kernel@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      412c53a6
    • Arnd Bergmann's avatar
      y2038: remove ktime to/from timespec/timeval conversion · 595abbaf
      Arnd Bergmann authored
      A couple of helpers are now obsolete and can be removed, so drivers can no
      longer start using them and instead use y2038-safe interfaces.
      
      Link: http://lkml.kernel.org/r/20200110154232.4104492-2-arnd@arndb.deSigned-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Deepa Dinamani <deepa.kernel@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      595abbaf
    • Rafael J. Wysocki's avatar
      ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake() · 63fb9623
      Rafael J. Wysocki authored
      Commit fdde0ff8 ("ACPI: PM: s2idle: Prevent spurious SCIs from
      waking up the system") overlooked the fact that fixed events can wake
      up the system too and broke RTC wakeup from suspend-to-idle as a
      result.
      
      Fix this issue by checking the fixed events in acpi_s2idle_wake() in
      addition to checking wakeup GPEs and break out of the suspend-to-idle
      loop if the status bits of any enabled fixed events are set then.
      
      Fixes: fdde0ff8 ("ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system")
      Reported-and-tested-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      63fb9623
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2020-02-20' of... · 97d9a4e9
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2020-02-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.6-rc3:
      - Workaround missing Display Stream Compression (DSC) state readout by
        forcing modeset when its enabled at probe
      - Fix EHL port clock voltage level requirements
      - Fix queuing retire workers on the virtual engine
      - Fix use of partially initialized waiters
      - Stop using drm_pci_alloc/drm_pci/free
      - Fix rewind of RING_TAIL by forcing a context reload
      - Fix locking on resetting ring->head
      - Propagate our bug filing URL change to stable kernels
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87y2sxtsrd.fsf@intel.com
      97d9a4e9
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2020-02-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · c1368b34
      Dave Airlie authored
      drm-misc-fixes for v5.6-rc3:
      - Fix dt binding for sunxi.
      - Allow only 1 rotation argument, and allow 0 rotation in video cmdline.
      - Small compiler warning fix for panfrost.
      - Fix when using performance counters in panfrost when using per fd address space.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/f5a6370d-9898-6c72-43e4-5bb56a99b6f2@linux.intel.com
      c1368b34
    • David S. Miller's avatar
      Merge branch 'bnxt_en-shutdown-and-kexec-kdump-related-fixes' · 36a44bcd
      David S. Miller authored
      Michael Chan says:
      
      ====================
      bnxt_en: shutdown and kexec/kdump related fixes.
      
      2 small patches to fix kexec shutdown and kdump kernel driver init issues.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      36a44bcd