1. 01 Oct, 2020 40 commits
    • Anthony Iliopoulos's avatar
      nvme: explicitly update mpath disk capacity on revalidation · 906c9129
      Anthony Iliopoulos authored
      [ Upstream commit 05b29021 ]
      
      Commit 3b4b1972 ("nvme: fix possible deadlock when I/O is
      blocked") reverted multipath head disk revalidation due to deadlocks
      caused by holding the bd_mutex during revalidate.
      
      Updating the multipath disk blockdev size is still required though for
      userspace to be able to observe any resizing while the device is
      mounted. Directly update the bdev inode size to avoid unnecessarily
      holding the bdev->bd_mutex.
      
      Fixes: 3b4b1972 ("nvme: fix possible deadlock when I/O is
      blocked")
      Signed-off-by: default avatarAnthony Iliopoulos <ailiop@suse.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      906c9129
    • Tonghao Zhang's avatar
      net: openvswitch: use div_u64() for 64-by-32 divisions · 1e6a4232
      Tonghao Zhang authored
      [ Upstream commit 659d4587 ]
      
      Compile the kernel for arm 32 platform, the build warning found.
      To fix that, should use div_u64() for divisions.
      | net/openvswitch/meter.c:396: undefined reference to `__udivdi3'
      
      [add more commit msg, change reported tag, and use div_u64 instead
      of do_div by Tonghao]
      
      Fixes: e5735887 ("net: openvswitch: use u64 for meter bucket")
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Signed-off-by: default avatarTonghao Zhang <xiangxia.m.yue@gmail.com>
      Tested-by: default avatarTonghao Zhang <xiangxia.m.yue@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      1e6a4232
    • Jin Yao's avatar
      perf parse-events: Use strcmp() to compare the PMU name · 31c5c447
      Jin Yao authored
      [ Upstream commit 8510895b ]
      
      A big uncore event group is split into multiple small groups which only
      include the uncore events from the same PMU. This has been supported in
      the commit 3cdc5c2c ("perf parse-events: Handle uncore event
      aliases in small groups properly").
      
      If the event's PMU name starts to repeat, it must be a new event.
      That can be used to distinguish the leader from other members.
      But now it only compares the pointer of pmu_name
      (leader->pmu_name == evsel->pmu_name).
      
      If we use "perf stat -M LLC_MISSES.PCIE_WRITE -a" on cascadelakex,
      the event list is:
      
        evsel->name					evsel->pmu_name
        ---------------------------------------------------------------
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_4 (as leader)
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_2
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_0
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_5
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_3
        unc_iio_data_req_of_cpu.mem_write.part0		uncore_iio_1
        unc_iio_data_req_of_cpu.mem_write.part1		uncore_iio_4
        ......
      
      For the event "unc_iio_data_req_of_cpu.mem_write.part1" with
      "uncore_iio_4", it should be the event from PMU "uncore_iio_4".
      It's not a new leader for this PMU.
      
      But if we use "(leader->pmu_name == evsel->pmu_name)", the check
      would be failed and the event is stored to leaders[] as a new
      PMU leader.
      
      So this patch uses strcmp to compare the PMU name between events.
      
      Fixes: d4953f7e ("perf parse-events: Fix 3 use after frees found with clang ASAN")
      Signed-off-by: default avatarJin Yao <yao.jin@linux.intel.com>
      Acked-by: default avatarJiri Olsa <jolsa@redhat.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Jin Yao <yao.jin@intel.com>
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lore.kernel.org/lkml/20200430003618.17002-1-yao.jin@linux.intel.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      31c5c447
    • Hou Tao's avatar
      ubi: fastmap: Free unused fastmap anchor peb during detach · 7d3d6fc1
      Hou Tao authored
      [ Upstream commit c16f39d1 ]
      
      When CONFIG_MTD_UBI_FASTMAP is enabled, fm_anchor will be assigned
      a free PEB during ubi_wl_init() or ubi_update_fastmap(). However
      if fastmap is not used or disabled on the MTD device, ubi_wl_entry
      related with the PEB will not be freed during detach.
      
      So Fix it by freeing the unused fastmap anchor during detach.
      
      Fixes: f9c34bb5 ("ubi: Fix producing anchor PEBs")
      Reported-by: syzbot+f317896aae32eb281a58@syzkaller.appspotmail.com
      Reviewed-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarHou Tao <houtao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      7d3d6fc1
    • Qu Wenruo's avatar
      btrfs: qgroup: fix data leak caused by race between writeback and truncate · 803b2f2f
      Qu Wenruo authored
      [ Upstream commit fa91e4aa ]
      
      [BUG]
      When running tests like generic/013 on test device with btrfs quota
      enabled, it can normally lead to data leak, detected at unmount time:
      
        BTRFS warning (device dm-3): qgroup 0/5 has unreleased space, type 0 rsv 4096
        ------------[ cut here ]------------
        WARNING: CPU: 11 PID: 16386 at fs/btrfs/disk-io.c:4142 close_ctree+0x1dc/0x323 [btrfs]
        RIP: 0010:close_ctree+0x1dc/0x323 [btrfs]
        Call Trace:
         btrfs_put_super+0x15/0x17 [btrfs]
         generic_shutdown_super+0x72/0x110
         kill_anon_super+0x18/0x30
         btrfs_kill_super+0x17/0x30 [btrfs]
         deactivate_locked_super+0x3b/0xa0
         deactivate_super+0x40/0x50
         cleanup_mnt+0x135/0x190
         __cleanup_mnt+0x12/0x20
         task_work_run+0x64/0xb0
         __prepare_exit_to_usermode+0x1bc/0x1c0
         __syscall_return_slowpath+0x47/0x230
         do_syscall_64+0x64/0xb0
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        ---[ end trace caf08beafeca2392 ]---
        BTRFS error (device dm-3): qgroup reserved space leaked
      
      [CAUSE]
      In the offending case, the offending operations are:
      2/6: writev f2X[269 1 0 0 0 0] [1006997,67,288] 0
      2/7: truncate f2X[269 1 0 0 48 1026293] 18388 0
      
      The following sequence of events could happen after the writev():
      	CPU1 (writeback)		|		CPU2 (truncate)
      -----------------------------------------------------------------
      btrfs_writepages()			|
      |- extent_write_cache_pages()		|
         |- Got page for 1003520		|
         |  1003520 is Dirty, no writeback	|
         |  So (!clear_page_dirty_for_io())   |
         |  gets called for it		|
         |- Now page 1003520 is Clean.	|
         |					| btrfs_setattr()
         |					| |- btrfs_setsize()
         |					|    |- truncate_setsize()
         |					|       New i_size is 18388
         |- __extent_writepage()		|
         |  |- page_offset() > i_size		|
            |- btrfs_invalidatepage()		|
      	 |- Page is clean, so no qgroup |
      	    callback executed
      
      This means, the qgroup reserved data space is not properly released in
      btrfs_invalidatepage() as the page is Clean.
      
      [FIX]
      Instead of checking the dirty bit of a page, call
      btrfs_qgroup_free_data() unconditionally in btrfs_invalidatepage().
      
      As qgroup rsv are completely bound to the QGROUP_RESERVED bit of
      io_tree, not bound to page status, thus we won't cause double freeing
      anyway.
      
      Fixes: 0b34c261 ("btrfs: qgroup: Prevent qgroup->reserved from going subzero")
      CC: stable@vger.kernel.org # 4.14+
      Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Signed-off-by: default avatarQu Wenruo <wqu@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      803b2f2f
    • Zeng Tao's avatar
      vfio/pci: fix racy on error and request eventfd ctx · 0d1682ca
      Zeng Tao authored
      [ Upstream commit b872d064 ]
      
      The vfio_pci_release call will free and clear the error and request
      eventfd ctx while these ctx could be in use at the same time in the
      function like vfio_pci_request, and it's expected to protect them under
      the vdev->igate mutex, which is missing in vfio_pci_release.
      
      This issue is introduced since commit 1518ac27 ("vfio/pci: fix memory
      leaks of eventfd ctx"),and since commit 5c5866c5 ("vfio/pci: Clear
      error and request eventfd ctx after releasing"), it's very easily to
      trigger the kernel panic like this:
      
      [ 9513.904346] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
      [ 9513.913091] Mem abort info:
      [ 9513.915871]   ESR = 0x96000006
      [ 9513.918912]   EC = 0x25: DABT (current EL), IL = 32 bits
      [ 9513.924198]   SET = 0, FnV = 0
      [ 9513.927238]   EA = 0, S1PTW = 0
      [ 9513.930364] Data abort info:
      [ 9513.933231]   ISV = 0, ISS = 0x00000006
      [ 9513.937048]   CM = 0, WnR = 0
      [ 9513.940003] user pgtable: 4k pages, 48-bit VAs, pgdp=0000007ec7d12000
      [ 9513.946414] [0000000000000008] pgd=0000007ec7d13003, p4d=0000007ec7d13003, pud=0000007ec728c003, pmd=0000000000000000
      [ 9513.956975] Internal error: Oops: 96000006 [#1] PREEMPT SMP
      [ 9513.962521] Modules linked in: vfio_pci vfio_virqfd vfio_iommu_type1 vfio hclge hns3 hnae3 [last unloaded: vfio_pci]
      [ 9513.972998] CPU: 4 PID: 1327 Comm: bash Tainted: G        W         5.8.0-rc4+ #3
      [ 9513.980443] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B270.01 05/08/2020
      [ 9513.989274] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
      [ 9513.994827] pc : _raw_spin_lock_irqsave+0x48/0x88
      [ 9513.999515] lr : eventfd_signal+0x6c/0x1b0
      [ 9514.003591] sp : ffff800038a0b960
      [ 9514.006889] x29: ffff800038a0b960 x28: ffff007ef7f4da10
      [ 9514.012175] x27: ffff207eefbbfc80 x26: ffffbb7903457000
      [ 9514.017462] x25: ffffbb7912191000 x24: ffff007ef7f4d400
      [ 9514.022747] x23: ffff20be6e0e4c00 x22: 0000000000000008
      [ 9514.028033] x21: 0000000000000000 x20: 0000000000000000
      [ 9514.033321] x19: 0000000000000008 x18: 0000000000000000
      [ 9514.038606] x17: 0000000000000000 x16: ffffbb7910029328
      [ 9514.043893] x15: 0000000000000000 x14: 0000000000000001
      [ 9514.049179] x13: 0000000000000000 x12: 0000000000000002
      [ 9514.054466] x11: 0000000000000000 x10: 0000000000000a00
      [ 9514.059752] x9 : ffff800038a0b840 x8 : ffff007ef7f4de60
      [ 9514.065038] x7 : ffff007fffc96690 x6 : fffffe01faffb748
      [ 9514.070324] x5 : 0000000000000000 x4 : 0000000000000000
      [ 9514.075609] x3 : 0000000000000000 x2 : 0000000000000001
      [ 9514.080895] x1 : ffff007ef7f4d400 x0 : 0000000000000000
      [ 9514.086181] Call trace:
      [ 9514.088618]  _raw_spin_lock_irqsave+0x48/0x88
      [ 9514.092954]  eventfd_signal+0x6c/0x1b0
      [ 9514.096691]  vfio_pci_request+0x84/0xd0 [vfio_pci]
      [ 9514.101464]  vfio_del_group_dev+0x150/0x290 [vfio]
      [ 9514.106234]  vfio_pci_remove+0x30/0x128 [vfio_pci]
      [ 9514.111007]  pci_device_remove+0x48/0x108
      [ 9514.115001]  device_release_driver_internal+0x100/0x1b8
      [ 9514.120200]  device_release_driver+0x28/0x38
      [ 9514.124452]  pci_stop_bus_device+0x68/0xa8
      [ 9514.128528]  pci_stop_and_remove_bus_device+0x20/0x38
      [ 9514.133557]  pci_iov_remove_virtfn+0xb4/0x128
      [ 9514.137893]  sriov_disable+0x3c/0x108
      [ 9514.141538]  pci_disable_sriov+0x28/0x38
      [ 9514.145445]  hns3_pci_sriov_configure+0x48/0xb8 [hns3]
      [ 9514.150558]  sriov_numvfs_store+0x110/0x198
      [ 9514.154724]  dev_attr_store+0x44/0x60
      [ 9514.158373]  sysfs_kf_write+0x5c/0x78
      [ 9514.162018]  kernfs_fop_write+0x104/0x210
      [ 9514.166010]  __vfs_write+0x48/0x90
      [ 9514.169395]  vfs_write+0xbc/0x1c0
      [ 9514.172694]  ksys_write+0x74/0x100
      [ 9514.176079]  __arm64_sys_write+0x24/0x30
      [ 9514.179987]  el0_svc_common.constprop.4+0x110/0x200
      [ 9514.184842]  do_el0_svc+0x34/0x98
      [ 9514.188144]  el0_svc+0x14/0x40
      [ 9514.191185]  el0_sync_handler+0xb0/0x2d0
      [ 9514.195088]  el0_sync+0x140/0x180
      [ 9514.198389] Code: b9001020 d2800000 52800022 f9800271 (885ffe61)
      [ 9514.204455] ---[ end trace 648de00c8406465f ]---
      [ 9514.212308] note: bash[1327] exited with preempt_count 1
      
      Cc: Qian Cai <cai@lca.pw>
      Cc: Alex Williamson <alex.williamson@redhat.com>
      Fixes: 1518ac27 ("vfio/pci: fix memory leaks of eventfd ctx")
      Signed-off-by: default avatarZeng Tao <prime.zeng@hisilicon.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      0d1682ca
    • Andy Lutomirski's avatar
      selftests/x86/syscall_nt: Clear weird flags after each test · 511a287c
      Andy Lutomirski authored
      [ Upstream commit a61fa279 ]
      
      Clear the weird flags before logging to improve strace output --
      logging results while, say, TF is set does no one any favors.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Link: https://lkml.kernel.org/r/907bfa5a42d4475b8245e18b67a04b13ca51ffdb.1593191971.git.luto@kernel.orgSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      511a287c
    • Javed Hasan's avatar
      scsi: libfc: Skip additional kref updating work event · 4575845e
      Javed Hasan authored
      [ Upstream commit 823a6540 ]
      
      When an rport event (RPORT_EV_READY) is updated without work being queued,
      avoid taking an additional reference.
      
      This issue was leading to memory leak. Trace from KMEMLEAK tool:
      
        unreferenced object 0xffff8888259e8780 (size 512):
        comm "kworker/2:1", jiffies 4433237386 (age 113021.971s)
          hex dump (first 32 bytes):
      	58 0a ec cf 83 88 ff ff 00 00 00 00 00 00 00 00
      	01 00 00 00 08 00 00 00 13 7d f0 1e 0e 00 00 10
        backtrace:
        [<000000006b25760f>] fc_rport_recv_req+0x3c6/0x18f0 [libfc]
        [<00000000f208d994>] fc_lport_recv_els_req+0x120/0x8a0 [libfc]
        [<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
        [<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
        [<00000000ad5be37b>] qedf_ll2_process_skb+0x73d/0xad0 [qedf]
        [<00000000e0eb6893>] process_one_work+0x382/0x6c0
        [<000000002dfd9e21>] worker_thread+0x57/0x5c0
        [<00000000b648204f>] kthread+0x1a0/0x1c0
        [<0000000072f5ab20>] ret_from_fork+0x35/0x40
        [<000000001d5c05d8>] 0xffffffffffffffff
      
      Below is the log sequence which leads to memory leak.  Here we get the
      RPORT_EV_READY and RPORT_EV_STOP back to back, which lead to overwrite the
      event RPORT_EV_READY by event RPORT_EV_STOP.  Because of this, kref_count
      gets incremented by 1.
      
        kernel: host0: rport fffce5: Received PLOGI request
        kernel: host0: rport fffce5: Received PLOGI in INIT state
        kernel: host0: rport fffce5: Port is Ready
        kernel: host0: rport fffce5: Received PRLI request while in state Ready
        kernel: host0: rport fffce5: PRLI rspp type 8 active 1 passive 0
        kernel: host0: rport fffce5: Received LOGO request while in state Ready
        kernel: host0: rport fffce5: Delete port
        kernel: host0: rport fffce5: Received PLOGI request
        kernel: host0: rport fffce5: Received PLOGI in state Delete - send busy
        kernel: host0: rport fffce5: work event 3
        kernel: host0: rport fffce5: lld callback ev 3
        kernel: host0: rport fffce5: work delete
      
      Link: https://lore.kernel.org/r/20200626094959.32151-1-jhasan@marvell.comReviewed-by: default avatarGirish Basrur <gbasrur@marvell.com>
      Reviewed-by: default avatarSaurav Kashyap <skashyap@marvell.com>
      Reviewed-by: default avatarShyam Sundar <ssundar@marvell.com>
      Signed-off-by: default avatarJaved Hasan <jhasan@marvell.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      4575845e
    • Javed Hasan's avatar
      scsi: libfc: Handling of extra kref · 694ec54b
      Javed Hasan authored
      [ Upstream commit 71f2bf85 ]
      
      Handling of extra kref which is done by lookup table in case rdata is
      already present in list.
      
      This issue was leading to memory leak. Trace from KMEMLEAK tool:
      
        unreferenced object 0xffff8888259e8780 (size 512):
          comm "kworker/2:1", pid 182614, jiffies 4433237386 (age 113021.971s)
          hex dump (first 32 bytes):
          58 0a ec cf 83 88 ff ff 00 00 00 00 00 00 00 00
          01 00 00 00 08 00 00 00 13 7d f0 1e 0e 00 00 10
        backtrace:
      	[<000000006b25760f>] fc_rport_recv_req+0x3c6/0x18f0 [libfc]
      	[<00000000f208d994>] fc_lport_recv_els_req+0x120/0x8a0 [libfc]
      	[<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
      	[<00000000ad5be37b>] qedf_ll2_process_skb+0x73d/0xad0 [qedf]
      	[<00000000e0eb6893>] process_one_work+0x382/0x6c0
      	[<000000002dfd9e21>] worker_thread+0x57/0x5c0
      	[<00000000b648204f>] kthread+0x1a0/0x1c0
      	[<0000000072f5ab20>] ret_from_fork+0x35/0x40
      	[<000000001d5c05d8>] 0xffffffffffffffff
      
      Below is the log sequence which leads to memory leak. Here we get the
      nested "Received PLOGI request" for same port and this request leads to
      call the fc_rport_create() twice for the same rport.
      
      	kernel: host1: rport fffce5: Received PLOGI request
      	kernel: host1: rport fffce5: Received PLOGI in INIT state
      	kernel: host1: rport fffce5: Port is Ready
      	kernel: host1: rport fffce5: Received PRLI request while in state Ready
      	kernel: host1: rport fffce5: PRLI rspp type 8 active 1 passive 0
      	kernel: host1: rport fffce5: Received LOGO request while in state Ready
      	kernel: host1: rport fffce5: Delete port
      	kernel: host1: rport fffce5: Received PLOGI request
      	kernel: host1: rport fffce5: Received PLOGI in state Delete - send busy
      
      Link: https://lore.kernel.org/r/20200622101212.3922-2-jhasan@marvell.comReviewed-by: default avatarGirish Basrur <gbasrur@marvell.com>
      Reviewed-by: default avatarSaurav Kashyap <skashyap@marvell.com>
      Reviewed-by: default avatarShyam Sundar <ssundar@marvell.com>
      Signed-off-by: default avatarJaved Hasan <jhasan@marvell.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      694ec54b
    • Sagi Grimberg's avatar
      nvme: fix possible deadlock when I/O is blocked · 03dfb191
      Sagi Grimberg authored
      [ Upstream commit 3b4b1972 ]
      
      Revert fab7772b ("nvme-multipath: revalidate nvme_ns_head gendisk
      in nvme_validate_ns")
      
      When adding a new namespace to the head disk (via nvme_mpath_set_live)
      we will see partition scan which triggers I/O on the mpath device node.
      This process will usually be triggered from the scan_work which holds
      the scan_lock. If I/O blocks (if we got ana change currently have only
      available paths but none are accessible) this can deadlock on the head
      disk bd_mutex as both partition scan I/O takes it, and head disk revalidation
      takes it to check for resize (also triggered from scan_work on a different
      path). See trace [1].
      
      The mpath disk revalidation was originally added to detect online disk
      size change, but this is no longer needed since commit cb224c3a
      ("nvme: Convert to use set_capacity_revalidate_and_notify") which already
      updates resize info without unnecessarily revalidating the disk (the
      mpath disk doesn't even implement .revalidate_disk fop).
      
      [1]:
      --
      kernel: INFO: task kworker/u65:9:494 blocked for more than 241 seconds.
      kernel:       Tainted: G           OE     5.3.5-050305-generic #201910071830
      kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      kernel: kworker/u65:9   D    0   494      2 0x80004000
      kernel: Workqueue: nvme-wq nvme_scan_work [nvme_core]
      kernel: Call Trace:
      kernel:  __schedule+0x2b9/0x6c0
      kernel:  schedule+0x42/0xb0
      kernel:  schedule_preempt_disabled+0xe/0x10
      kernel:  __mutex_lock.isra.0+0x182/0x4f0
      kernel:  __mutex_lock_slowpath+0x13/0x20
      kernel:  mutex_lock+0x2e/0x40
      kernel:  revalidate_disk+0x63/0xa0
      kernel:  __nvme_revalidate_disk+0xfe/0x110 [nvme_core]
      kernel:  nvme_revalidate_disk+0xa4/0x160 [nvme_core]
      kernel:  ? evict+0x14c/0x1b0
      kernel:  revalidate_disk+0x2b/0xa0
      kernel:  nvme_validate_ns+0x49/0x940 [nvme_core]
      kernel:  ? blk_mq_free_request+0xd2/0x100
      kernel:  ? __nvme_submit_sync_cmd+0xbe/0x1e0 [nvme_core]
      kernel:  nvme_scan_work+0x24f/0x380 [nvme_core]
      kernel:  process_one_work+0x1db/0x380
      kernel:  worker_thread+0x249/0x400
      kernel:  kthread+0x104/0x140
      kernel:  ? process_one_work+0x380/0x380
      kernel:  ? kthread_park+0x80/0x80
      kernel:  ret_from_fork+0x1f/0x40
      ...
      kernel: INFO: task kworker/u65:1:2630 blocked for more than 241 seconds.
      kernel:       Tainted: G           OE     5.3.5-050305-generic #201910071830
      kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      kernel: kworker/u65:1   D    0  2630      2 0x80004000
      kernel: Workqueue: nvme-wq nvme_scan_work [nvme_core]
      kernel: Call Trace:
      kernel:  __schedule+0x2b9/0x6c0
      kernel:  schedule+0x42/0xb0
      kernel:  io_schedule+0x16/0x40
      kernel:  do_read_cache_page+0x438/0x830
      kernel:  ? __switch_to_asm+0x34/0x70
      kernel:  ? file_fdatawait_range+0x30/0x30
      kernel:  read_cache_page+0x12/0x20
      kernel:  read_dev_sector+0x27/0xc0
      kernel:  read_lba+0xc1/0x220
      kernel:  ? kmem_cache_alloc_trace+0x19c/0x230
      kernel:  efi_partition+0x1e6/0x708
      kernel:  ? vsnprintf+0x39e/0x4e0
      kernel:  ? snprintf+0x49/0x60
      kernel:  check_partition+0x154/0x244
      kernel:  rescan_partitions+0xae/0x280
      kernel:  __blkdev_get+0x40f/0x560
      kernel:  blkdev_get+0x3d/0x140
      kernel:  __device_add_disk+0x388/0x480
      kernel:  device_add_disk+0x13/0x20
      kernel:  nvme_mpath_set_live+0x119/0x140 [nvme_core]
      kernel:  nvme_update_ns_ana_state+0x5c/0x60 [nvme_core]
      kernel:  nvme_set_ns_ana_state+0x1e/0x30 [nvme_core]
      kernel:  nvme_parse_ana_log+0xa1/0x180 [nvme_core]
      kernel:  ? nvme_update_ns_ana_state+0x60/0x60 [nvme_core]
      kernel:  nvme_mpath_add_disk+0x47/0x90 [nvme_core]
      kernel:  nvme_validate_ns+0x396/0x940 [nvme_core]
      kernel:  ? blk_mq_free_request+0xd2/0x100
      kernel:  nvme_scan_work+0x24f/0x380 [nvme_core]
      kernel:  process_one_work+0x1db/0x380
      kernel:  worker_thread+0x249/0x400
      kernel:  kthread+0x104/0x140
      kernel:  ? process_one_work+0x380/0x380
      kernel:  ? kthread_park+0x80/0x80
      kernel:  ret_from_fork+0x1f/0x40
      --
      
      Fixes: fab7772b ("nvme-multipath: revalidate nvme_ns_head gendisk
      in nvme_validate_ns")
      Signed-off-by: default avatarAnton Eidelman <anton@lightbitslabs.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      03dfb191
    • Zhang Xiaoxu's avatar
      cifs: Fix double add page to memcg when cifs_readpages · 5f7ca306
      Zhang Xiaoxu authored
      [ Upstream commit 95a3d8f3 ]
      
      When xfstests generic/451, there is an BUG at mm/memcontrol.c:
        page:ffffea000560f2c0 refcount:2 mapcount:0 mapping:000000008544e0ea
             index:0xf
        mapping->aops:cifs_addr_ops dentry name:"tst-aio-dio-cycle-write.451"
        flags: 0x2fffff80000001(locked)
        raw: 002fffff80000001 ffffc90002023c50 ffffea0005280088 ffff88815cda0210
        raw: 000000000000000f 0000000000000000 00000002ffffffff ffff88817287d000
        page dumped because: VM_BUG_ON_PAGE(page->mem_cgroup)
        page->mem_cgroup:ffff88817287d000
        ------------[ cut here ]------------
        kernel BUG at mm/memcontrol.c:2659!
        invalid opcode: 0000 [#1] SMP
        CPU: 2 PID: 2038 Comm: xfs_io Not tainted 5.8.0-rc1 #44
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_
          073836-buildvm-ppc64le-16.ppc.4
        RIP: 0010:commit_charge+0x35/0x50
        Code: 0d 48 83 05 54 b2 02 05 01 48 89 77 38 c3 48 c7
              c6 78 4a ea ba 48 83 05 38 b2 02 05 01 e8 63 0d9
        RSP: 0018:ffffc90002023a50 EFLAGS: 00010202
        RAX: 0000000000000000 RBX: ffff88817287d000 RCX: 0000000000000000
        RDX: 0000000000000000 RSI: ffff88817ac97ea0 RDI: ffff88817ac97ea0
        RBP: ffffea000560f2c0 R08: 0000000000000203 R09: 0000000000000005
        R10: 0000000000000030 R11: ffffc900020237a8 R12: 0000000000000000
        R13: 0000000000000001 R14: 0000000000000001 R15: ffff88815a1272c0
        FS:  00007f5071ab0800(0000) GS:ffff88817ac80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 000055efcd5ca000 CR3: 000000015d312000 CR4: 00000000000006e0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
        Call Trace:
         mem_cgroup_charge+0x166/0x4f0
         __add_to_page_cache_locked+0x4a9/0x710
         add_to_page_cache_locked+0x15/0x20
         cifs_readpages+0x217/0x1270
         read_pages+0x29a/0x670
         page_cache_readahead_unbounded+0x24f/0x390
         __do_page_cache_readahead+0x3f/0x60
         ondemand_readahead+0x1f1/0x470
         page_cache_async_readahead+0x14c/0x170
         generic_file_buffered_read+0x5df/0x1100
         generic_file_read_iter+0x10c/0x1d0
         cifs_strict_readv+0x139/0x170
         new_sync_read+0x164/0x250
         __vfs_read+0x39/0x60
         vfs_read+0xb5/0x1e0
         ksys_pread64+0x85/0xf0
         __x64_sys_pread64+0x22/0x30
         do_syscall_64+0x69/0x150
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        RIP: 0033:0x7f5071fcb1af
        Code: Bad RIP value.
        RSP: 002b:00007ffde2cdb8e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000011
        RAX: ffffffffffffffda RBX: 00007ffde2cdb990 RCX: 00007f5071fcb1af
        RDX: 0000000000001000 RSI: 000055efcd5ca000 RDI: 0000000000000003
        RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
        R10: 0000000000001000 R11: 0000000000000293 R12: 0000000000000001
        R13: 000000000009f000 R14: 0000000000000000 R15: 0000000000001000
        Modules linked in:
        ---[ end trace 725fa14a3e1af65c ]---
      
      Since commit 3fea5a49 ("mm: memcontrol: convert page cache to a new
      mem_cgroup_charge() API") not cancel the page charge, the pages maybe
      double add to pagecache:
      thread1                       | thread2
      cifs_readpages
      readpages_get_pages
       add_to_page_cache_locked(head,index=n)=0
                                    | readpages_get_pages
                                    | add_to_page_cache_locked(head,index=n+1)=0
       add_to_page_cache_locked(head, index=n+1)=-EEXIST
       then, will next loop with list head page's
       index=n+1 and the page->mapping not NULL
      readpages_get_pages
      add_to_page_cache_locked(head, index=n+1)
       commit_charge
        VM_BUG_ON_PAGE
      
      So, we should not do the next loop when any page add to page cache
      failed.
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      Acked-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5f7ca306
    • Alex Williamson's avatar
      vfio/pci: Clear error and request eventfd ctx after releasing · 41a77298
      Alex Williamson authored
      [ Upstream commit 5c5866c5 ]
      
      The next use of the device will generate an underflow from the
      stale reference.
      
      Cc: Qian Cai <cai@lca.pw>
      Fixes: 1518ac27 ("vfio/pci: fix memory leaks of eventfd ctx")
      Reported-by: default avatarDaniel Wagner <dwagner@suse.de>
      Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
      Tested-by: default avatarDaniel Wagner <dwagner@suse.de>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      41a77298
    • Thomas Gleixner's avatar
      x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline · f0e13175
      Thomas Gleixner authored
      [ Upstream commit a7ef9ba9 ]
      
      Prevent the compiler from uninlining and creating traceable/probable
      functions as this is invoked _after_ context tracking switched to
      CONTEXT_USER and rcu idle.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarAlexandre Chartre <alexandre.chartre@oracle.com>
      Acked-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Link: https://lkml.kernel.org/r/20200505134340.902709267@linutronix.deSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      f0e13175
    • Boris Brezillon's avatar
      mtd: parser: cmdline: Support MTD names containing one or more colons · 9a59dfdd
      Boris Brezillon authored
      [ Upstream commit eb13fa02 ]
      
      Looks like some drivers define MTD names with a colon in it, thus
      making mtdpart= parsing impossible. Let's fix the parser to gracefully
      handle that case: the last ':' in a partition definition sequence is
      considered instead of the first one.
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@collabora.com>
      Signed-off-by: default avatarRon Minnich <rminnich@google.com>
      Tested-by: default avatarRon Minnich <rminnich@google.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9a59dfdd
    • Madhuparna Bhowmik's avatar
      rapidio: avoid data race between file operation callbacks and mport_cdev_add(). · a44cb303
      Madhuparna Bhowmik authored
      [ Upstream commit e1c3cdb2 ]
      
      Fields of md(mport_dev) are set after cdev_device_add().  However, the
      file operation callbacks can be called after cdev_device_add() and
      therefore accesses to fields of md in the callbacks can race with the rest
      of the mport_cdev_add() function.
      
      One such example is INIT_LIST_HEAD(&md->portwrites) in mport_cdev_add(),
      the list is initialised after cdev_device_add().  This can race with
      list_add_tail(&pw_filter->md_node,&md->portwrites) in
      rio_mport_add_pw_filter() which is called by unlocked_ioctl.
      
      To avoid such data races use cdev_device_add() after initializing md.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarMadhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarAlexandre Bounine <alex.bou9@gmail.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Mike Marshall <hubcap@omnibond.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ira Weiny <ira.weiny@intel.com>
      Cc: Allison Randal <allison@lohutok.net>
      Cc: Pavel Andrianov <andrianov@ispras.ru>
      Link: http://lkml.kernel.org/r/20200426112950.1803-1-madhuparnabhowmik10@gmail.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a44cb303
    • Qian Cai's avatar
      mm/swap_state: fix a data race in swapin_nr_pages · 8cc3afd5
      Qian Cai authored
      [ Upstream commit d6c1f098 ]
      
      "prev_offset" is a static variable in swapin_nr_pages() that can be
      accessed concurrently with only mmap_sem held in read mode as noticed by
      KCSAN,
      
       BUG: KCSAN: data-race in swap_cluster_readahead / swap_cluster_readahead
      
       write to 0xffffffff92763830 of 8 bytes by task 14795 on cpu 17:
        swap_cluster_readahead+0x2a6/0x5e0
        swapin_readahead+0x92/0x8dc
        do_swap_page+0x49b/0xf20
        __handle_mm_fault+0xcfb/0xd70
        handle_mm_fault+0xfc/0x2f0
        do_page_fault+0x263/0x715
        page_fault+0x34/0x40
      
       1 lock held by (dnf)/14795:
        #0: ffff897bd2e98858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715
        do_user_addr_fault at arch/x86/mm/fault.c:1405
        (inlined by) do_page_fault at arch/x86/mm/fault.c:1535
       irq event stamp: 83493
       count_memcg_event_mm+0x1a6/0x270
       count_memcg_event_mm+0x119/0x270
       __do_softirq+0x365/0x589
       irq_exit+0xa2/0xc0
      
       read to 0xffffffff92763830 of 8 bytes by task 1 on cpu 22:
        swap_cluster_readahead+0xfd/0x5e0
        swapin_readahead+0x92/0x8dc
        do_swap_page+0x49b/0xf20
        __handle_mm_fault+0xcfb/0xd70
        handle_mm_fault+0xfc/0x2f0
        do_page_fault+0x263/0x715
        page_fault+0x34/0x40
      
       1 lock held by systemd/1:
        #0: ffff897c38f14858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715
       irq event stamp: 43530289
       count_memcg_event_mm+0x1a6/0x270
       count_memcg_event_mm+0x119/0x270
       __do_softirq+0x365/0x589
       irq_exit+0xa2/0xc0
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Marco Elver <elver@google.com>
      Cc: Hugh Dickins <hughd@google.com>
      Link: http://lkml.kernel.org/r/20200402213748.2237-1-cai@lca.pwSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      8cc3afd5
    • Jeff Layton's avatar
      ceph: fix potential race in ceph_check_caps · c42c61e9
      Jeff Layton authored
      [ Upstream commit dc3da046 ]
      
      Nothing ensures that session will still be valid by the time we
      dereference the pointer. Take and put a reference.
      
      In principle, we should always be able to get a reference here, but
      throw a warning if that's ever not the case.
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c42c61e9
    • Dinghao Liu's avatar
      PCI: tegra: Fix runtime PM imbalance on error · 23c233c6
      Dinghao Liu authored
      [ Upstream commit fcee90cd ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      when it returns an error code. Thus a pairing decrement is needed on
      the error handling path to keep the counter balanced.
      
      Also, call pm_runtime_disable() when pm_runtime_get_sync() returns
      an error code.
      
      Link: https://lore.kernel.org/r/20200521024709.2368-1-dinghao.liu@zju.edu.cnSigned-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Acked-by: default avatarThierry Reding <treding@nvidia.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      23c233c6
    • Dinghao Liu's avatar
      mtd: rawnand: omap_elm: Fix runtime PM imbalance on error · 2138dc84
      Dinghao Liu authored
      [ Upstream commit 37f72121 ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      when it returns an error code. Thus a pairing decrement is needed on
      the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      Link: https://lore.kernel.org/linux-mtd/20200522104008.28340-1-dinghao.liu@zju.edu.cnSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      2138dc84
    • Dinghao Liu's avatar
      wlcore: fix runtime pm imbalance in wlcore_regdomain_config · 345d68b4
      Dinghao Liu authored
      [ Upstream commit 282a04bf ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      the call returns an error code. Thus a pairing decrement is needed
      on the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Acked-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Link: https://lore.kernel.org/r/20200520124649.10848-1-dinghao.liu@zju.edu.cnSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      345d68b4
    • Dinghao Liu's avatar
      wlcore: fix runtime pm imbalance in wl1271_tx_work · 3ad6b023
      Dinghao Liu authored
      [ Upstream commit 9604617e ]
      
      There are two error handling paths in this functon. When
      wlcore_tx_work_locked() returns an error code, we should
      decrease the runtime PM usage counter the same way as the
      error handling path beginning from pm_runtime_get_sync().
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Acked-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Link: https://lore.kernel.org/r/20200520124241.9931-1-dinghao.liu@zju.edu.cnSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      3ad6b023
    • Dinghao Liu's avatar
      ASoC: img-i2s-out: Fix runtime PM imbalance on error · fce356af
      Dinghao Liu authored
      [ Upstream commit 65bd91dd ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      the call returns an error code. Thus a pairing decrement is needed
      on the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Link: https://lore.kernel.org/r/20200529012230.5863-1-dinghao.liu@zju.edu.cnSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      fce356af
    • Adrian Hunter's avatar
      perf kcore_copy: Fix module map when there are no modules loaded · a63689c0
      Adrian Hunter authored
      [ Upstream commit 61f82e3f ]
      
      In the absence of any modules, no "modules" map is created, but there
      are other executable pages to map, due to eBPF JIT, kprobe or ftrace.
      Map them by recognizing that the first "module" symbol is not
      necessarily from a module, and adjust the map accordingly.
      Signed-off-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Leo Yan <leo.yan@linaro.org>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
      Cc: x86@kernel.org
      Link: http://lore.kernel.org/lkml/20200512121922.8997-10-adrian.hunter@intel.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a63689c0
    • Ian Rogers's avatar
      perf metricgroup: Free metric_events on error · cc6ae850
      Ian Rogers authored
      [ Upstream commit a159e2fe ]
      
      Avoid a simple memory leak.
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Alexei Starovoitov <ast@kernel.org>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Andrii Nakryiko <andriin@fb.com>
      Cc: Cong Wang <xiyou.wangcong@gmail.com>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Cc: Jin Yao <yao.jin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: John Fastabend <john.fastabend@gmail.com>
      Cc: John Garry <john.garry@huawei.com>
      Cc: Kajol Jain <kjain@linux.ibm.com>
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Kim Phillips <kim.phillips@amd.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Martin KaFai Lau <kafai@fb.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Song Liu <songliubraving@fb.com>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Cc: Yonghong Song <yhs@fb.com>
      Cc: bpf@vger.kernel.org
      Cc: kp singh <kpsingh@chromium.org>
      Cc: netdev@vger.kernel.org
      Link: http://lore.kernel.org/lkml/20200508053629.210324-10-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      cc6ae850
    • Xie XiuQi's avatar
      perf util: Fix memory leak of prefix_if_not_in · dd155a48
      Xie XiuQi authored
      [ Upstream commit 07e9a6f5 ]
      
      Need to free "str" before return when asprintf() failed to avoid memory
      leak.
      Signed-off-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Hongbo Yao <yaohongbo@huawei.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Li Bin <huawei.libin@huawei.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: http://lore.kernel.org/lkml/20200521133218.30150-4-liwei391@huawei.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      dd155a48
    • Jiri Olsa's avatar
      perf stat: Fix duration_time value for higher intervals · d9116536
      Jiri Olsa authored
      [ Upstream commit ea9eb1f4 ]
      
      Joakim reported wrong duration_time value for interval bigger
      than 4000 [1].
      
      The problem is in the interval value we pass to update_stats
      function, which is typed as 'unsigned int' and overflows when
      we get over 2^32 (happens between intervals 4000 and 5000).
      
      Retyping the passed value to unsigned long long.
      
      [1] https://www.spinics.net/lists/linux-perf-users/msg11777.html
      
      Fixes: b90f1333 ("perf stat: Update walltime_nsecs_stats in interval mode")
      Reported-by: default avatarJoakim Zhang <qiangqing.zhang@nxp.com>
      Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Michael Petlan <mpetlan@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lore.kernel.org/lkml/20200518131445.3745083-1-jolsa@kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d9116536
    • Ian Rogers's avatar
      perf trace: Fix the selection for architectures to generate the errno name tables · aa0d162b
      Ian Rogers authored
      [ Upstream commit 7597ce89 ]
      
      Make the architecture test directory agree with the code comment.
      
      Committer notes:
      
      This was split from a larger patch.
      
      The code was assuming the developer always worked from tools/perf/, so make sure we
      do the test -d having $toolsdir/perf/arch/$arch, to match the intent expressed in the comment,
      just above that loop.
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Alexios Zavras <alexios.zavras@intel.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Igor Lubashev <ilubashe@akamai.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Nick Desaulniers <ndesaulniers@google.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Wei Li <liwei391@huawei.com>
      Link: http://lore.kernel.org/lkml/20200306071110.130202-4-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      aa0d162b
    • Ian Rogers's avatar
      perf evsel: Fix 2 memory leaks · 56540590
      Ian Rogers authored
      [ Upstream commit 3efc899d ]
      
      If allocated, perf_pkg_mask and metric_events need freeing.
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Reviewed-by: default avatarAndi Kleen <ak@linux.intel.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Link: http://lore.kernel.org/lkml/20200512235918.10732-1-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      56540590
    • Qian Cai's avatar
      vfio/pci: fix memory leaks of eventfd ctx · b7e24664
      Qian Cai authored
      [ Upstream commit 1518ac27 ]
      
      Finished a qemu-kvm (-device vfio-pci,host=0001:01:00.0) triggers a few
      memory leaks after a while because vfio_pci_set_ctx_trigger_single()
      calls eventfd_ctx_fdget() without the matching eventfd_ctx_put() later.
      Fix it by calling eventfd_ctx_put() for those memory in
      vfio_pci_release() before vfio_device_release().
      
      unreferenced object 0xebff008981cc2b00 (size 128):
        comm "qemu-kvm", pid 4043, jiffies 4294994816 (age 9796.310s)
        hex dump (first 32 bytes):
          01 00 00 00 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  ....kkkk.....N..
          ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
        backtrace:
          [<00000000917e8f8d>] slab_post_alloc_hook+0x74/0x9c
          [<00000000df0f2aa2>] kmem_cache_alloc_trace+0x2b4/0x3d4
          [<000000005fcec025>] do_eventfd+0x54/0x1ac
          [<0000000082791a69>] __arm64_sys_eventfd2+0x34/0x44
          [<00000000b819758c>] do_el0_svc+0x128/0x1dc
          [<00000000b244e810>] el0_sync_handler+0xd0/0x268
          [<00000000d495ef94>] el0_sync+0x164/0x180
      unreferenced object 0x29ff008981cc4180 (size 128):
        comm "qemu-kvm", pid 4043, jiffies 4294994818 (age 9796.290s)
        hex dump (first 32 bytes):
          01 00 00 00 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  ....kkkk.....N..
          ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
        backtrace:
          [<00000000917e8f8d>] slab_post_alloc_hook+0x74/0x9c
          [<00000000df0f2aa2>] kmem_cache_alloc_trace+0x2b4/0x3d4
          [<000000005fcec025>] do_eventfd+0x54/0x1ac
          [<0000000082791a69>] __arm64_sys_eventfd2+0x34/0x44
          [<00000000b819758c>] do_el0_svc+0x128/0x1dc
          [<00000000b244e810>] el0_sync_handler+0xd0/0x268
          [<00000000d495ef94>] el0_sync+0x164/0x180
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      b7e24664
    • David Sterba's avatar
      btrfs: don't force read-only after error in drop snapshot · 5915b8ec
      David Sterba authored
      [ Upstream commit 7c09c030 ]
      
      Deleting a subvolume on a full filesystem leads to ENOSPC followed by a
      forced read-only. This is not a transaction abort and the filesystem is
      otherwise ok, so the error should be just propagated to the callers.
      
      This is caused by unnecessary call to btrfs_handle_fs_error for all
      errors, except EAGAIN. This does not make sense as the standard
      transaction abort mechanism is in btrfs_drop_snapshot so all relevant
      failures are handled.
      
      Originally in commit cb1b69f4 ("Btrfs: forced readonly when
      btrfs_drop_snapshot() fails") there was no return value at all, so the
      btrfs_std_error made some sense but once the error handling and
      propagation has been implemented we don't need it anymore.
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5915b8ec
    • Yu Chen's avatar
      usb: dwc3: Increase timeout for CmdAct cleared by device controller · 8201fdac
      Yu Chen authored
      [ Upstream commit 1c0e69ae ]
      
      If the SS PHY is in P3, there is no pipe_clk, HW may use suspend_clk
      for function, as suspend_clk is slow so EP command need more time to
      complete, e.g, imx8M suspend_clk is 32K, set ep configuration will
      take about 380us per below trace time stamp(44.286278 - 44.285897
      = 0.000381):
      
      configfs_acm.sh-822   [000] d..1    44.285896: dwc3_writel: addr
      000000006d59aae1 value 00000401
      configfs_acm.sh-822   [000] d..1    44.285897: dwc3_readl: addr
      000000006d59aae1 value 00000401
      ... ...
      configfs_acm.sh-822   [000] d..1    44.286278: dwc3_readl: addr
      000000006d59aae1 value 00000001
      configfs_acm.sh-822   [000] d..1    44.286279: dwc3_gadget_ep_cmd:
      ep0out: cmd 'Set Endpoint Configuration' [401] params 00001000
      00000500 00000000 --> status: Successful
      
      This was originally found on Hisilicon Kirin Soc that need more time
      for the device controller to clear the CmdAct of DEPCMD.
      Signed-off-by: default avatarYu Chen <chenyu56@huawei.com>
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Signed-off-by: default avatarLi Jun <jun.li@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      8201fdac
    • Shreyas Joshi's avatar
      printk: handle blank console arguments passed in. · c6a95856
      Shreyas Joshi authored
      [ Upstream commit 48021f98 ]
      
      If uboot passes a blank string to console_setup then it results in
      a trashed memory. Ultimately, the kernel crashes during freeing up
      the memory.
      
      This fix checks if there is a blank parameter being
      passed to console_setup from uboot. In case it detects that
      the console parameter is blank then it doesn't setup the serial
      device and it gracefully exits.
      
      Link: https://lore.kernel.org/r/20200522065306.83-1-shreyas.joshi@biamp.comSigned-off-by: default avatarShreyas Joshi <shreyas.joshi@biamp.com>
      Acked-by: default avatarSergey Senozhatsky <sergey.senozhatsky@gmail.com>
      [pmladek@suse.com: Better format the commit message and code, remove unnecessary brackets.]
      Signed-off-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c6a95856
    • Dinghao Liu's avatar
      drm/nouveau/dispnv50: fix runtime pm imbalance on error · 39096c0f
      Dinghao Liu authored
      [ Upstream commit dc455f4c ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      the call returns an error code. Thus a pairing decrement is needed
      on the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      39096c0f
    • Dinghao Liu's avatar
      drm/nouveau: fix runtime pm imbalance on error · 12f61a92
      Dinghao Liu authored
      [ Upstream commit d7372dfb ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      the call returns an error code. Thus a pairing decrement is needed
      on the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      12f61a92
    • Dinghao Liu's avatar
      drm/nouveau/debugfs: fix runtime pm imbalance on error · 8e0f8fe0
      Dinghao Liu authored
      [ Upstream commit 00583fbe ]
      
      pm_runtime_get_sync() increments the runtime PM usage counter even
      the call returns an error code. Thus a pairing decrement is needed
      on the error handling path to keep the counter balanced.
      Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      8e0f8fe0
    • Alexander Duyck's avatar
      e1000: Do not perform reset in reset_task if we are already down · dc8ecb80
      Alexander Duyck authored
      [ Upstream commit 49ee3c2a ]
      
      We are seeing a deadlock in e1000 down when NAPI is being disabled. Looking
      over the kernel function trace of the system it appears that the interface
      is being closed and then a reset is hitting which deadlocks the interface
      as the NAPI interface is already disabled.
      
      To prevent this from happening I am disabling the reset task when
      __E1000_DOWN is already set. In addition code has been added so that we set
      the __E1000_DOWN while holding the __E1000_RESET flag in e1000_close in
      order to guarantee that the reset task will not run after we have started
      the close call.
      Signed-off-by: default avatarAlexander Duyck <alexander.h.duyck@linux.intel.com>
      Tested-by: default avatarMaxim Zhukov <mussitantesmortem@gmail.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      dc8ecb80
    • Anshuman Khandual's avatar
      arm64/cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register · e682e0d5
      Anshuman Khandual authored
      [ Upstream commit 1ed1b90a ]
      
      ID_DFR0 based TraceFilt feature should not be exposed to guests. Hence lets
      drop it.
      
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Marc Zyngier <maz@kernel.org>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: James Morse <james.morse@arm.com>
      Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: linux-kernel@vger.kernel.org
      Suggested-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarAnshuman Khandual <anshuman.khandual@arm.com>
      Reviewed-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Link: https://lore.kernel.org/r/1589881254-10082-3-git-send-email-anshuman.khandual@arm.comSigned-off-by: default avatarWill Deacon <will@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e682e0d5
    • Wei Yongjun's avatar
      scsi: cxlflash: Fix error return code in cxlflash_probe() · 6909507e
      Wei Yongjun authored
      [ Upstream commit d0b1e4a6 ]
      
      Fix to return negative error code -ENOMEM from create_afu error handling
      case instead of 0, as done elsewhere in this function.
      
      Link: https://lore.kernel.org/r/20200428141855.88704-1-weiyongjun1@huawei.comAcked-by: default avatarMatthew R. Ochs <mrochs@linux.ibm.com>
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      6909507e
    • Colin Ian King's avatar
      USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int · d4a74f43
      Colin Ian King authored
      [ Upstream commit a7f40c23 ]
      
      The comparison of hcd->irq to less than zero for an error check will
      never be true because hcd->irq is an unsigned int.  Fix this by
      assigning the int retval to the return of platform_get_irq and checking
      this for the -ve error condition and assigning hcd->irq to retval.
      
      Addresses-Coverity: ("Unsigned compared against 0")
      Fixes: c856b4b0 ("USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe()")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Link: https://lore.kernel.org/r/20200515165453.104028-1-colin.king@canonical.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d4a74f43
    • Miklos Szeredi's avatar
      fuse: don't check refcount after stealing page · 59da76a1
      Miklos Szeredi authored
      [ Upstream commit 32f98877 ]
      
      page_count() is unstable.  Unless there has been an RCU grace period
      between when the page was removed from the page cache and now, a
      speculative reference may exist from the page cache.
      Reported-by: default avatarMatthew Wilcox <willy@infradead.org>
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      59da76a1