1. 15 Mar, 2019 11 commits
    • Linus Torvalds's avatar
      Merge tag 'ntb-5.1' of git://github.com/jonmason/ntb · e8a71a38
      Linus Torvalds authored
      Pull NTB updates from Jon Mason:
      
       - fixes for switchtec debugability and mapping table entries
      
       - NTB transport improvements
      
       - a reworking of the peer_db_addr for better abstraction
      
      * tag 'ntb-5.1' of git://github.com/jonmason/ntb:
        NTB: add new parameter to peer_db_addr() db_bit and db_data
        NTB: ntb_transport: Ensure the destination buffer is mapped for TX DMA
        NTB: ntb_transport: Free MWs in ntb_transport_link_cleanup()
        ntb_hw_switchtec: Added support of >=4G memory windows
        ntb_hw_switchtec: NT req id mapping table register entry number should be 512
        ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers
      e8a71a38
    • Linus Torvalds's avatar
      Merge tag 'fbdev-v5.1' of git://github.com/bzolnier/linux · 2b9c272c
      Linus Torvalds authored
      Pull fbdev updates from Bartlomiej Zolnierkiewicz:
       "Just a couple of small fixes and cleanups:
      
         - fix memory access if logo is bigger than the screen (Manfred
           Schlaegl)
      
         - silence fbcon logo on 'quiet' boots (Prarit Bhargava)
      
         - use kvmalloc() for scrollback buffer in fbcon (Konstantin Khorenko)
      
         - misc fixes (Colin Ian King, YueHaibing, Matteo Croce, Mathieu
           Malaterre, Anders Roxell, Arnd Bergmann)
      
         - misc cleanups (Rob Herring, Lubomir Rintel, Greg Kroah-Hartman,
           Jani Nikula, Michal Vokáč)"
      
      * tag 'fbdev-v5.1' of git://github.com/bzolnier/linux:
        fbdev: mbx: fix a misspelled variable name
        fbdev: omap2: fix warnings in dss core
        video: fbdev: Fix potential NULL pointer dereference
        fbcon: Silence fbcon logo on 'quiet' boots
        printk: Export console_printk
        ARM: dts: imx28-cfa10036: Fix the reset gpio signal polarity
        video: ssd1307fb: Do not hard code active-low reset sequence
        dt-bindings: display: ssd1307fb: Remove reset-active-low from examples
        fbdev: fbmem: fix memory access if logo is bigger than the screen
        video/fbdev: refactor video= cmdline parsing
        fbdev: mbx: fix up debugfs file creation
        fbdev: omap2: no need to check return value of debugfs_create functions
        video: fbdev: geode: remove ifdef OLPC noise
        video: offb: annotate implicit fall throughs
        omapfb: fix typo
        fbdev: Use of_node_name_eq for node name comparisons
        fbcon: use kvmalloc() for scrollback buffer
        fbdev: chipsfb: remove set but not used variable 'size'
        fbdev/via: fix spelling mistake "Expandsion" -> "Expansion"
      2b9c272c
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 51b1ac0f
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "A set of driver bugfixes and an improvement for a core helper"
      
      * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: i2c-designware-platdrv: Always use a dynamic adapter number
        i2c: i2c-designware-platdrv: Cleanup setting of the adapter number
        i2c: add extra check to safe DMA buffer helper
        i2c: i2c-stm32f7: Fix SDADEL minimum formula
        i2c: rcar: explain the lockless design
        i2c: rcar: fix concurrency issue related to ICDMAER
        i2c: sis630: correct format strings
        i2c: mediatek: modify threshold passed to i2c_get_dma_safe_msg_buf()
      51b1ac0f
    • Linus Torvalds's avatar
      Merge tag 'sound-fix-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 2dbb0e6c
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Some cleaning after the first batch; mostly about HD-audio quirks but
        also some NULL dereference fixes in corner cases and a random build
        error fix, too"
      
      * tag 'sound-fix-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB
        ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
        ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook
        ALSA: pcm: Fix function name in kernel-doc comment
        ALSA: hda: hdmi - add Icelake support
        ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
        ALSA: hda/realtek - Fixed Headset Mic JD not stable
        ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255
        ALSA: hda/tegra: avoid build error without CONFIG_PM
        ALSA: usx2y: Fix potential NULL pointer dereference
        ALSA: hda: Avoid NULL pointer dereference at snd_hdac_stream_start()
      2dbb0e6c
    • Linus Torvalds's avatar
      Merge tag 'drm-next-2019-03-15' of git://anongit.freedesktop.org/drm/drm · 8264fd04
      Linus Torvalds authored
      Pull drm fixes and updates from Dave Airlie:
       "A few various fixes pulls and one late etnaviv pull but it was nearly
        all fixes anyways.
      
        etnaviv:
         - late next pull
         - mmu mapping fix
         - build non-ARM arches
         - misc fixes
      
        i915:
         - HDCP state handling fix
         - shrinker interaction fix
         - atomic state leak fix
      
        qxl:
         - kick out framebuffers early fix
      
        amdgpu:
         - Powerplay fixes
         - DC fixes
         - BACO turned off for now on vega20
         - Locking fix
         - KFD MQD fix
         - gfx9 golden register updates"
      
      * tag 'drm-next-2019-03-15' of git://anongit.freedesktop.org/drm/drm: (43 commits)
        drm/amdgpu: Update gc golden setting for vega family
        drm/amd/powerplay: correct power reading on fiji
        drm/amd/powerplay: set max fan target temperature as 105C
        drm/i915: Relax mmap VMA check
        drm/i915: Fix atomic state leak when resetting HDMI link
        drm/i915: Acquire breadcrumb ref before cancelling
        drm/i915/selftests: Always free spinner on __sseu_prepare error
        drm/i915: Reacquire priolist cache after dropping the engine lock
        drm/i915: Protect i915_active iterators from the shrinker
        drm/i915: HDCP state handling in ddi_update_pipe
        drm/qxl: remove conflicting framebuffers earlier
        drm/fb-helper: call vga_remove_vgacon automatically.
        drm: move i915_kick_out_vgacon to vgaarb
        drm/amd/display: don't call dm_pp_ function from an fpu block
        drm: add __user attribute to ptr_to_compat()
        drm/amdgpu: clear PDs/PTs only after initializing them
        drm/amd/display: Pass app_tf by value rather than by reference
        Revert "drm/amdgpu: use BACO reset on vega20 if platform support"
        drm/amd/powerplay: show the right override pcie parameters
        drm/amd/powerplay: honor the OD settings
        ...
      8264fd04
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.1-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · de578188
      Linus Torvalds authored
      Pull xfs cleanups from Darrick Wong:
       "Here's a few more cleanups that trickled in for the merge window.
      
        It's all fixes for static checker complaints and slowly unwinding
        typedef usage. The four patches here have gone through a few days
        worth of fstest runs with no new problems observed.
      
        Summary:
      
         - Fix some clang/smatch/sparse warnings about uninitialized
           variables.
      
         - Clean up some typedef usage"
      
      * tag 'xfs-5.1-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: clean up xfs_dir2_leaf_addname
        xfs: zero initialize highstale and lowstale in xfs_dir2_leaf_addname
        xfs: clean up xfs_dir2_leafn_add
        xfs: Zero initialize highstale and lowstale in xfs_dir2_leafn_add
      de578188
    • Linus Torvalds's avatar
      Merge tag 'f2fs-for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs · 5160bcce
      Linus Torvalds authored
      Pull f2fs updates from Jaegeuk Kim:
       "We've continued mainly to fix bugs in this round, as f2fs has been
        shipped in more devices. Especially, we've focused on stabilizing
        checkpoint=disable feature, and provided some interfaces for QA.
      
        Enhancements:
         - expose FS_NOCOW_FL for pin_file
         - run discard jobs at unmount time with timeout
         - tune discarding thread to avoid idling which consumes power
         - some checking codes to address vulnerabilities
         - give random value to i_generation
         - shutdown with more flags for QA
      
        Bug fixes:
         - clean up stale objects when mount is failed along with
           checkpoint=disable
         - fix system being stuck due to wrong count by atomic writes
         - handle some corrupted disk cases
         - fix a deadlock in f2fs_read_inline_dir
      
        We've also added some minor build error fixes and clean-up patches"
      
      * tag 'f2fs-for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (53 commits)
        f2fs: set pin_file under CAP_SYS_ADMIN
        f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
        f2fs: fix to adapt small inline xattr space in __find_inline_xattr()
        f2fs: fix to do sanity check with inode.i_inline_xattr_size
        f2fs: give some messages for inline_xattr_size
        f2fs: don't trigger read IO for beyond EOF page
        f2fs: fix to add refcount once page is tagged PG_private
        f2fs: remove wrong comment in f2fs_invalidate_page()
        f2fs: fix to use kvfree instead of kzfree
        f2fs: print more parameters in trace_f2fs_map_blocks
        f2fs: trace f2fs_ioc_shutdown
        f2fs: fix to avoid deadlock of atomic file operations
        f2fs: fix to dirty inode for i_mode recovery
        f2fs: give random value to i_generation
        f2fs: no need to take page lock in readdir
        f2fs: fix to update iostat correctly in IPU path
        f2fs: fix encrypted page memory leak
        f2fs: make fault injection covering __submit_flush_wait()
        f2fs: fix to retry fill_super only if recovery failed
        f2fs: silence VM_WARN_ON_ONCE in mempool_alloc
        ...
      5160bcce
    • Linus Torvalds's avatar
      Merge branch 'akpm' (rest of patches from Andrew) · f91f2ee5
      Linus Torvalds authored
      Merge the left-over patches from Andrew Morton.
      
      This merges the remaining two patches from Andrew's pile of "little bit
      more MM".  I mulled it over, and we emailed back and forth with Josef,
      and he pointed out where I was wrong.
      
      Rule #51 of kernel maintenance: when somebody makes it clear that they
      know the code better than you did, stop arguing and just apply the damn
      patch.
      
      Add a third patch by me to add a comment for the case that I had thought
      was buggy and Josef corrected me on.
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        filemap: add a comment about FAULT_FLAG_RETRY_NOWAIT behavior
        filemap: drop the mmap_sem for all blocking operations
        filemap: kill page_cache_read usage in filemap_fault
      f91f2ee5
    • Linus Torvalds's avatar
      filemap: add a comment about FAULT_FLAG_RETRY_NOWAIT behavior · 8b0f9fa2
      Linus Torvalds authored
      I thought Josef Bacik's patch to drop the mmap_sem was buggy, because
      when looking at the error cases, there was one case where we returned
      VM_FAULT_RETRY without actually dropping the mmap_sem.
      
      Josef had to explain to me (using small words) that yes, that's actually
      what we're supposed to do, and his patch was correct.  Which not only
      convinced me he knew what he was doing and I should stop arguing with
      him, but also that I should add a comment to the case I was confused
      about.
      Patiently-pointed-out-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8b0f9fa2
    • Josef Bacik's avatar
      filemap: drop the mmap_sem for all blocking operations · 6b4c9f44
      Josef Bacik authored
      Currently we only drop the mmap_sem if there is contention on the page
      lock.  The idea is that we issue readahead and then go to lock the page
      while it is under IO and we want to not hold the mmap_sem during the IO.
      
      The problem with this is the assumption that the readahead does anything.
      In the case that the box is under extreme memory or IO pressure we may end
      up not reading anything at all for readahead, which means we will end up
      reading in the page under the mmap_sem.
      
      Even if the readahead does something, it could get throttled because of io
      pressure on the system and the process is in a lower priority cgroup.
      
      Holding the mmap_sem while doing IO is problematic because it can cause
      system-wide priority inversions.  Consider some large company that does a
      lot of web traffic.  This large company has load balancing logic in it's
      core web server, cause some engineer thought this was a brilliant plan.
      This load balancing logic gets statistics from /proc about the system,
      which trip over processes mmap_sem for various reasons.  Now the web
      server application is in a protected cgroup, but these other processes may
      not be, and if they are being throttled while their mmap_sem is held we'll
      stall, and cause this nice death spiral.
      
      Instead rework filemap fault path to drop the mmap sem at any point that
      we may do IO or block for an extended period of time.  This includes while
      issuing readahead, locking the page, or needing to call ->readpage because
      readahead did not occur.  Then once we have a fully uptodate page we can
      return with VM_FAULT_RETRY and come back again to find our nicely in-cache
      page that was gotten outside of the mmap_sem.
      
      This patch also adds a new helper for locking the page with the mmap_sem
      dropped.  This doesn't make sense currently as generally speaking if the
      page is already locked it'll have been read in (unless there was an error)
      before it was unlocked.  However a forthcoming patchset will change this
      with the ability to abort read-ahead bio's if necessary, making it more
      likely that we could contend for a page lock and still have a not uptodate
      page.  This allows us to deal with this case by grabbing the lock and
      issuing the IO without the mmap_sem held, and then returning
      VM_FAULT_RETRY to come back around.
      
      [josef@toxicpanda.com: v6]
        Link: http://lkml.kernel.org/r/20181212152757.10017-1-josef@toxicpanda.com
      [kirill@shutemov.name: fix race in filemap_fault()]
        Link: http://lkml.kernel.org/r/20181228235106.okk3oastsnpxusxs@kshutemo-mobl1
      [akpm@linux-foundation.org: coding style fixes]
      Link: http://lkml.kernel.org/r/20181211173801.29535-4-josef@toxicpanda.comSigned-off-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Tested-by: syzbot+b437b5a429d680cf2217@syzkaller.appspotmail.com
      Cc: Dave Chinner <david@fromorbit.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6b4c9f44
    • Josef Bacik's avatar
      filemap: kill page_cache_read usage in filemap_fault · a75d4c33
      Josef Bacik authored
      Patch series "drop the mmap_sem when doing IO in the fault path", v6.
      
      Now that we have proper isolation in place with cgroups2 we have started
      going through and fixing the various priority inversions.  Most are all
      gone now, but this one is sort of weird since it's not necessarily a
      priority inversion that happens within the kernel, but rather because of
      something userspace does.
      
      We have giant applications that we want to protect, and parts of these
      giant applications do things like watch the system state to determine how
      healthy the box is for load balancing and such.  This involves running
      'ps' or other such utilities.  These utilities will often walk
      /proc/<pid>/whatever, and these files can sometimes need to
      down_read(&task->mmap_sem).  Not usually a big deal, but we noticed when
      we are stress testing that sometimes our protected application has latency
      spikes trying to get the mmap_sem for tasks that are in lower priority
      cgroups.
      
      This is because any down_write() on a semaphore essentially turns it into
      a mutex, so even if we currently have it held for reading, any new readers
      will not be allowed on to keep from starving the writer.  This is fine,
      except a lower priority task could be stuck doing IO because it has been
      throttled to the point that its IO is taking much longer than normal.  But
      because a higher priority group depends on this completing it is now stuck
      behind lower priority work.
      
      In order to avoid this particular priority inversion we want to use the
      existing retry mechanism to stop from holding the mmap_sem at all if we
      are going to do IO.  This already exists in the read case sort of, but
      needed to be extended for more than just grabbing the page lock.  With
      io.latency we throttle at submit_bio() time, so the readahead stuff can
      block and even page_cache_read can block, so all these paths need to have
      the mmap_sem dropped.
      
      The other big thing is ->page_mkwrite.  btrfs is particularly shitty here
      because we have to reserve space for the dirty page, which can be a very
      expensive operation.  We use the same retry method as the read path, and
      simply cache the page and verify the page is still setup properly the next
      pass through ->page_mkwrite().
      
      I've tested these patches with xfstests and there are no regressions.
      
      This patch (of 3):
      
      If we do not have a page at filemap_fault time we'll do this weird forced
      page_cache_read thing to populate the page, and then drop it again and
      loop around and find it.  This makes for 2 ways we can read a page in
      filemap_fault, and it's not really needed.  Instead add a FGP_FOR_MMAP
      flag so that pagecache_get_page() will return a unlocked page that's in
      pagecache.  Then use the normal page locking and readpage logic already in
      filemap_fault.  This simplifies the no page in page cache case
      significantly.
      
      [akpm@linux-foundation.org: fix comment text]
      [josef@toxicpanda.com: don't unlock null page in FGP_FOR_MMAP case]
        Link: http://lkml.kernel.org/r/20190312201742.22935-1-josef@toxicpanda.com
      Link: http://lkml.kernel.org/r/20181211173801.29535-2-josef@toxicpanda.comSigned-off-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Dave Chinner <david@fromorbit.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a75d4c33
  2. 14 Mar, 2019 24 commits
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · f261c4e5
      Linus Torvalds authored
      Merge misc patches from Andrew Morton:
      
      - a little bit more MM
      
      - a few fixups
      
      [ The "little bit more MM" is actually just one of the three patches
        Andrew sent for mm/filemap.c, I'm still mulling over two more of them
        from Josef Bacik     - Linus ]
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
        tools/testing/selftests/proc/proc-pid-vm.c: test with vsyscall in mind
        zram: default to lzo-rle instead of lzo
        filemap: pass vm_fault to the mmap ra helpers
      f261c4e5
    • Pi-Hsun Shih's avatar
      include/linux/swap.h: use offsetof() instead of custom __swapoffset macro · a4046c06
      Pi-Hsun Shih authored
      Use offsetof() to calculate offset of a field to take advantage of
      compiler built-in version when possible, and avoid UBSAN warning when
      compiling with Clang:
      
        UBSAN: Undefined behaviour in mm/swapfile.c:3010:38
        member access within null pointer of type 'union swap_header'
        CPU: 6 PID: 1833 Comm: swapon Tainted: G S                4.19.23 #43
        Call trace:
         dump_backtrace+0x0/0x194
         show_stack+0x20/0x2c
         __dump_stack+0x20/0x28
         dump_stack+0x70/0x94
         ubsan_epilogue+0x14/0x44
         ubsan_type_mismatch_common+0xf4/0xfc
         __ubsan_handle_type_mismatch_v1+0x34/0x54
         __se_sys_swapon+0x654/0x1084
         __arm64_sys_swapon+0x1c/0x24
         el0_svc_common+0xa8/0x150
         el0_svc_compat_handler+0x2c/0x38
         el0_svc_compat+0x8/0x18
      
      Link: http://lkml.kernel.org/r/20190312081902.223764-1-pihsun@chromium.orgSigned-off-by: default avatarPi-Hsun Shih <pihsun@chromium.org>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a4046c06
    • Alexey Dobriyan's avatar
      tools/testing/selftests/proc/proc-pid-vm.c: test with vsyscall in mind · 17415606
      Alexey Dobriyan authored
      : selftests: proc: proc-pid-vm
      : ========================================
      : proc-pid-vm: proc-pid-vm.c:277: main: Assertion `rv == strlen(buf0)' failed.
      : Aborted
      
      Because the vsyscall mapping is enabled.  Read from vsyscall page to tell
      if vsyscall is being used.
      
      Link: http://lkml.kernel.org/r/20190307183204.GA11405@avx2
      Link: http://lkml.kernel.org/r/20190219094722.GB28258@shao2-debian
      Fixes: 34aab6bec23e7e9 ("proc: test /proc/*/maps, smaps, smaps_rollup, statm")
      Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      Reported-by: default avatarkernel test robot <rong.a.chen@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      17415606
    • Dave Rodgman's avatar
      zram: default to lzo-rle instead of lzo · ce82f19f
      Dave Rodgman authored
      lzo-rle gives higher performance and similar compression ratios to lzo.
      
      Link: http://lkml.kernel.org/r/20190205155944.16007-4-dave.rodgman@arm.comSigned-off-by: default avatarDave Rodgman <dave.rodgman@arm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ce82f19f
    • Josef Bacik's avatar
      filemap: pass vm_fault to the mmap ra helpers · 2a1180f1
      Josef Bacik authored
      All of the arguments to these functions come from the vmf.
      
      Cut down on the amount of arguments passed by simply passing in the vmf
      to these two helpers.
      
      Link: http://lkml.kernel.org/r/20181211173801.29535-3-josef@toxicpanda.comSigned-off-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: Dave Chinner <david@fromorbit.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2a1180f1
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3b319ee2
      Linus Torvalds authored
      Pull more ACPI updates from Rafael Wysocki:
       "These fix a couple of issues and do some cleanups on top of the
        previous ACPI changes for 5.1-rc1.
      
        Specifics:
      
         - Fix a crash caused by unloading an SSDT overlay (Andy Shevchenko)
      
         - Prevent user space from getting confusing error values on failing
           ACPI sysfs accesses (Rafael Wysocki)
      
         - Simplify leaf node detection in the PPTT parsing code by using a
           new flag defined in ACPI 6.3 (Jeremy Linton)
      
         - Add missing "static" in some places in the ACPI configfs code (Andy
           Shevchenko)
      
         - Fix acpidbg tool path in the ACPI documentation (Flavio Suligoi)"
      
      * tag 'acpi-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: sysfs: Prevent get_status() from returning acpi_status
        ACPI / device_sysfs: Avoid OF modalias creation for removed device
        ACPI / configfs: Mark local data structures static
        ACPI / configfs: Mark local functions static
        ACPI: tables: Simplify PPTT leaf node detection
        ACPI: Documentation: Fix path for acpidbg tool
      3b319ee2
    • Linus Torvalds's avatar
      Merge tag 'pm-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 9352ca58
      Linus Torvalds authored
      Pull more power management updates from Rafael Wysocki:
       "These are mostly fixes and cleanups on top of the previously merged
        power management material for 5.1-rc1 with one cpupower utility update
        that wasn't pushed earlier due to unfortunate timing.
      
        Specifics:
      
         - Fix registration of new cpuidle governors partially broken during
           the 5.0 development cycle by mistake (Rafael Wysocki).
      
         - Avoid integer overflows in the menu cpuidle governor by making it
           discard the overflowing data points upfront (Rafael Wysocki).
      
         - Fix minor mistake in the recent update of the iowait boost
           computation in the intel_pstate driver (Rafael Wysocki).
      
         - Drop incorrect __init annotation from one function in the pxa2xx
           cpufreq driver (Arnd Bergmann).
      
         - Fix the operating performance points (OPP) framework initialization
           for devices in multiple power domains if only one of them is
           scalable (Rajendra Nayak).
      
         - Fix mistake in dev_pm_opp_set_rate() which causes it to skip
           updating the performance state if the new frequency is the same as
           the old one (Viresh Kumar).
      
         - Rework the cancellation of wakeup source timers to avoid potential
           issues with it and do some cleanups unlocked by that change (Viresh
           Kumar, Rafael Wysocki).
      
         - Clean up the code computing the active/suspended time of devices in
           the PM-runtime framework after recent changes (Ulf Hansson).
      
         - Make the power management infrastructure code use pr_fmt()
           consistently (Joe Perches).
      
         - Clean up the generic power domains (genpd) framework somewhat
           (Aisheng Dong).
      
         - Improve kerneldoc comments for two functions in the cpufreq core
           (Rafael Wysocki).
      
         - Fix typo in a PM QoS file description comment (Aisheng Dong).
      
         - Update the handling of CPU boost frequencies in the cpupower
           utility (Abhishek Goel)"
      
      * tag 'pm-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpuidle: governor: Add new governors to cpuidle_governors again
        cpufreq: intel_pstate: Fix up iowait_boost computation
        PM / OPP: Update performance state when freq == old_freq
        PM / wakeup: Drop wakeup_source_drop()
        PM / wakeup: Rework wakeup source timer cancellation
        PM / domains: Remove one unnecessary blank line
        PM / Domains: Return early for all errors in _genpd_power_off()
        PM / Domains: Improve warn for multiple states but no governor
        OPP: Fix handling of multiple power domains
        PM / QoS: Fix typo in file description
        cpufreq: pxa2xx: remove incorrect __init annotation
        PM-runtime: Call pm_runtime_active|suspended_time() from sysfs
        PM-runtime: Consolidate code to get active/suspended time
        PM: Add and use pr_fmt()
        cpufreq: Improve kerneldoc comments for cpufreq_cpu_get/put()
        cpuidle: menu: Avoid overflows when computing variance
        tools/power/cpupower: Display boost frequency separately
      9352ca58
    • Linus Torvalds's avatar
      Merge tag 'microblaze-v5.1-rc1' of git://git.monstr.eu/linux-2.6-microblaze · 9bc44610
      Linus Torvalds authored
      Pull Microblaze update from Michal Simek:
       "Simplify debugfs initialization"
      
      * tag 'microblaze-v5.1-rc1' of git://git.monstr.eu/linux-2.6-microblaze:
        microblaze: no need to check return value of debugfs_create functions
      9bc44610
    • Jaegeuk Kim's avatar
      f2fs: set pin_file under CAP_SYS_ADMIN · aff7b628
      Jaegeuk Kim authored
      Android uses pin_file for uncrypt during OTA, and that should be managed by
      CAP_SYS_ADMIN only.
      Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
      Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
      aff7b628
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · f3ca4c55
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "More fixes in the queue:
      
        1) Netfilter nat can erroneously register the device notifier twice,
           fix from Florian Westphal.
      
        2) Use after free in nf_tables, from Pablo Neira Ayuso.
      
        3) Parallel update of steering rule fix in mlx5 river, from Eli
           Britstein.
      
        4) RX processing panic in lan743x, fix from Bryan Whitehead.
      
        5) Use before initialization of TCP_SKB_CB, fix from Christoph Paasch.
      
        6) Fix locking in SRIOV mode of mlx4 driver, from Jack Morgenstein.
      
        7) Fix TX stalls in lan743x due to mishandling of interrupt ACKing
           modes, from Bryan Whitehead.
      
        8) Fix infoleak in l2tp_ip6_recvmsg(), from Eric Dumazet"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
        pptp: dst_release sk_dst_cache in pptp_sock_destruct
        MAINTAINERS: GENET & SYSTEMPORT: Add internal Broadcom list
        l2tp: fix infoleak in l2tp_ip6_recvmsg()
        net/tls: Inform user space about send buffer availability
        net_sched: return correct value for *notify* functions
        lan743x: Fix TX Stall Issue
        net/mlx4_core: Fix qp mtt size calculation
        net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling
        net/mlx4_core: Fix reset flow when in command polling mode
        mlxsw: minimal: Initialize base_mac
        mlxsw: core: Prevent duplication during QSFP module initialization
        net: dwmac-sun8i: fix a missing check of of_get_phy_mode
        net: sh_eth: fix a missing check of of_get_phy_mode
        net: 8390: fix potential NULL pointer dereferences
        net: fujitsu: fix a potential NULL pointer dereference
        net: qlogic: fix a potential NULL pointer dereference
        isdn: hfcpci: fix potential NULL pointer dereference
        Documentation: devicetree: add a new optional property for port mac address
        net: rocker: fix a potential NULL pointer dereference
        net: qlge: fix a potential NULL pointer dereference
        ...
      f3ca4c55
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-5.1-rc1' of git://git.infradead.org/users/vkoul/slave-dma · 31ef489a
      Linus Torvalds authored
      Pull dmaengine updates from Vinod Koul:
      
       - dmatest updates for modularizing common struct and code
      
       - remove SG support for VDMA xilinx IP and updates to driver
      
       - Update to dw driver to support Intel iDMA controllers multi-block
         support
      
       - tegra updates for proper reporting of residue
      
       - Add Snow Ridge ioatdma device id and support for IOATDMA v3.4
      
       - struct_size() usage and useless LIST_HEAD cleanups in subsystem.
      
       - qDMA controller driver for Layerscape SoCs
      
       - stm32-dma PM Runtime support
      
       - And usual updates to imx-sdma, sprd, Documentation, fsl-edma,
         bcm2835, qcom_hidma etc
      
      * tag 'dmaengine-5.1-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (81 commits)
        dmaengine: imx-sdma: fix consistent dma test failures
        dmaengine: imx-sdma: add a test for imx8mq multi sdma devices
        dmaengine: imx-sdma: add clock ratio 1:1 check
        dmaengine: dmatest: move test data alloc & free into functions
        dmaengine: dmatest: add short-hand `buf_size` var in dmatest_func()
        dmaengine: dmatest: wrap src & dst data into a struct
        dmaengine: ioatdma: support latency tolerance report (LTR) for v3.4
        dmaengine: ioatdma: add descriptor pre-fetch support for v3.4
        dmaengine: ioatdma: disable DCA enabling on IOATDMA v3.4
        dmaengine: ioatdma: Add Snow Ridge ioatdma device id
        dmaengine: sprd: Change channel id to slave id for DMA cell specifier
        dt-bindings: dmaengine: sprd: Change channel id to slave id for DMA cell specifier
        dmaengine: mv_xor: Use correct device for DMA API
        Documentation :dmaengine: clarify DMA desc. pointer after submission
        Documentation: dmaengine: fix dmatest.rst warning
        dmaengine: k3dma: Add support for dma-channel-mask
        dmaengine: k3dma: Delete axi_config
        dmaengine: k3dma: Upgrade k3dma driver to support hisi_asp_dma hardware
        Documentation: bindings: dma: Add binding for dma-channel-mask
        Documentation: bindings: k3dma: Extend the k3dma driver binding to support hisi-asp
        ...
      31ef489a
    • Linus Torvalds's avatar
      Merge tag 'rproc-v5.1' of git://github.com/andersson/remoteproc · 2f194646
      Linus Torvalds authored
      Pull remoteproc updates from Bjorn Andersson:
       "This contains the last patches in Loic's remoteproc resource table
        handling changes, a number of updates to documentation, support for
        invoking the crash handler (for testing purposes), a fix for the
        handling of virtio devices during recovery, performance state votes in
        Qualcomm modem driver, support for specifying board specific firmware
        path for Qualcomm modem driver and improved support for graceful
        shutdown of Qualcomm remoteprocs"
      
      * tag 'rproc-v5.1' of git://github.com/andersson/remoteproc: (33 commits)
        remoteproc: fix for "dma-mapping: remove the DMA_MEMORY_EXCLUSIVE flag"
        remoteproc: fix rproc_check_carveout_da() returned error and comments
        remoteproc: fix trace buffer va initialization
        remoteproc: fix rproc_alloc_carveout() for rproc with iommu domain
        remoteproc: add warning on resource table cast
        remoteproc: fix rproc_alloc_carveout() bad variable cast
        remoteproc: fix rproc_da_to_va in case of unallocated carveout
        remoteproc: correct rproc_mem_entry_init() comments
        remoteproc: fix recovery procedure
        rpmsg: virtio: change header file sort style
        rpmsg: virtio: allocate buffer from parent
        remoteproc: st: add reserved memory support
        remoteproc: create vdev subdevice with specific dma memory pool
        remoteproc: q6v5_adsp: Remove voting for lpass_aon clock
        dt-binding: remoteproc: Remove lpass_aon clock from adsp pil clock list
        remoteproc: q6v5-mss: Active powerdomain for SDM845
        remoteproc: q6v5-mss: Vote for rpmh power domains
        remoteproc: qcom: Add support for parsing fw dt bindings
        remoteproc: qcom_q6v5: don't auto boot remote processor
        remoteproc: qcom: Wait for shutdown-ack/ind on sysmon shutdown
        ...
      2f194646
    • Linus Torvalds's avatar
      Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · dc2535be
      Linus Torvalds authored
      Pull clk subsystem updates from Stephen Boyd:
       "We have a fairly balanced mix of clk driver updates and clk framework
        updates this time around. It's the usual pile of new drivers for new
        hardware out there and the normal small fixes and updates, but then we
        have some core framework changes too.
      
        In the core framework, we introduce support for a clk_get_optional()
        API to get clks that may not always be populated and a way to devm
        manage clkdev lookups registered by provider drivers. We also do some
        refactoring to simplify the interface between clkdev and the common
        clk framework so we can reuse the DT parsing and clk_get() path in
        provider drivers in the future. This work will continue in the next
        few cycles while we convert how providers specify clk parents.
      
        On the driver side, the biggest part of the dirstat is the Amlogic clk
        driver that got support for the G12A SoC. It dominates with almost
        half the overall diff, while the second largest part of the diff is in
        the i.MX clk driver that gained support for imx8mm SoCs. After that,
        we have the Actions Semiconductor and Qualcomm drivers rounding out
        the big part of the dirstat because they both got new hardware support
        for SoCs. The rest is just various updates and non-critical fixes for
        existing drivers.
      
        Core:
         - Convert a few clk bindings to JSON schema format
         - Add a {devm_}clk_get_optional() API
         - Add devm_clk_hw_register_clkdev() API to manage clkdev lookups
         - Start rewriting clk parent registration and supporting device links
           by moving around code that supports clk_get() and DT parsing of the
           'clocks' property
      
        New Drivers:
         - Add Qualcomm MSM8998 RPM managed clks
         - IPA clk support on Qualcomm RPMh clk controllers
         - Actions Semi S500 SoC clk support
         - Support for fixed rate clks populated from an MMIO register
         - Add RPC (QSPI/HyperFLASH) clocks on Renesas R-Car V3H
         - Add TMU (timer) clocks on Renesas RZ/G2E
         - Add Amlogic G12A Always-On Clock Controller
         - Add 32k clock generation for Amlogic AXG
         - Add support for the Mali GPU clocks on Amlogic Meson8
         - Add Amlogic G12A EE clock controller driver
         - Add missing CANFD clocks on Renesas RZ/G2M and RZ/G2E
         - Add i.MX8MM SoC clk driver support
      
        Removed Drivers:
         - Remove clps711x driver as the board support is gone
      
        Updates:
         - 3rd ECO fix for Mediatek MT2712 SoCs
         - Updates for Qualcomm MSM8998 GCC clks
         - Random static analysis fixes for clk drivers
         - Support for sleeping gpios in the clk-gpio type
         - Minor fixes for STM32MP1 clk driver (parents, critical flag, etc.)
         - Split LCDC into two clks on the Marvell MMP2 SoC
         - Various DT of_node refcount fixes
         - Get rid of CLK_IS_BASIC from TI code (yay!)
         - TI Autoidle clk support
         - Fix Amlogic Meson8 APB clock ID name
         - Claim input clocks through DT for Amlogic AXG and GXBB
         - Correct the DU (display unit) parent clock on Renesas RZ/G2E
         - Exynos5433 IMEM CMU crypto clk support (SlimSS)
         - Fix for the PLL-MIPI on the Allwinner A23
         - Fix Rockchip rk3328 PLL rate calculation
         - Add SET_RATE_PARENT flag on display clk of Rockhip rk3066
         - i.MX SCU clk driver clk_set_parent() and cpufreq support"
      
      * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (150 commits)
        dt-bindings: clock: imx8mq: Fix numbering overlaps and gaps
        clk: ti: clkctrl: Fix clkdm_name regression for TI_CLK_CLKCTRL_COMPAT
        clk: fixup default index for of_clk_get_by_name()
        clk: Move of_clk_*() APIs into clk.c from clkdev.c
        clk: Inform the core about consumer devices
        clk: Introduce of_clk_get_hw_from_clkspec()
        clk: core: clarify the check for runtime PM
        clk: Combine __clk_get() and __clk_create_clk()
        clk: imx8mq: add GPIO clocks to clock tree
        clk: mediatek: correct cpu clock name for MT8173 SoC
        clk: imx: Refactor entire sccg pll clk
        clk: imx: scu: add cpu frequency scaling support
        clk: mediatek: Mark bus and DRAM related clocks as critical
        clk: mediatek: Add flags to mtk_gate
        clk: mediatek: Add MUX_FLAGS macro
        clk: qcom: gcc-sdm845: Define parent of PCIe PIPE clocks
        clk: ingenic: Remove set but not used variable 'enable'
        clk: at91: programmable: remove unneeded register read
        clk: mediatek: using CLK_MUX_ROUND_CLOSEST for the clock of dpi1_sel
        clk: mediatek: add MUX_GATE_FLAGS_2
        ...
      dc2535be
    • Rafael J. Wysocki's avatar
      Merge branches 'acpi-tables', 'acpi-debug', 'acpi-doc' and 'acpi-misc' · b6e88119
      Rafael J. Wysocki authored
      * acpi-tables:
        ACPI: tables: Simplify PPTT leaf node detection
      
      * acpi-debug:
        ACPI: sysfs: Prevent get_status() from returning acpi_status
      
      * acpi-doc:
        ACPI: Documentation: Fix path for acpidbg tool
      
      * acpi-misc:
        ACPI / configfs: Mark local data structures static
        ACPI / configfs: Mark local functions static
      b6e88119
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-opp' and 'pm-tools' · b444e1aa
      Rafael J. Wysocki authored
      * pm-opp:
        PM / OPP: Update performance state when freq == old_freq
        OPP: Fix handling of multiple power domains
      
      * pm-tools:
        tools/power/cpupower: Display boost frequency separately
      b444e1aa
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-domains' · 75f3e239
      Rafael J. Wysocki authored
      * pm-domains:
        PM / domains: Remove one unnecessary blank line
        PM / Domains: Return early for all errors in _genpd_power_off()
        PM / Domains: Improve warn for multiple states but no governor
      75f3e239
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpuidle' and 'pm-cpufreq' · 4650b279
      Rafael J. Wysocki authored
      * pm-cpuidle:
        cpuidle: governor: Add new governors to cpuidle_governors again
        cpuidle: menu: Avoid overflows when computing variance
      
      * pm-cpufreq:
        cpufreq: intel_pstate: Fix up iowait_boost computation
        cpufreq: pxa2xx: remove incorrect __init annotation
        cpufreq: Improve kerneldoc comments for cpufreq_cpu_get/put()
      4650b279
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-core', 'pm-sleep' and 'pm-qos' · e6035258
      Rafael J. Wysocki authored
      * pm-core:
        PM-runtime: Call pm_runtime_active|suspended_time() from sysfs
        PM-runtime: Consolidate code to get active/suspended time
      
      * pm-sleep:
        PM / wakeup: Drop wakeup_source_drop()
        PM / wakeup: Rework wakeup source timer cancellation
      
      * pm-qos:
        PM / QoS: Fix typo in file description
      e6035258
    • Kailang Yang's avatar
      ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB · da484d00
      Kailang Yang authored
      Enable headset mode support for new WYSE NB platform.
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      da484d00
    • Kailang Yang's avatar
      ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO · 136824ef
      Kailang Yang authored
      This patch will enable WYSE AIO for Headset mode.
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      136824ef
    • Jaroslav Kysela's avatar
      ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook · c8a9afa6
      Jaroslav Kysela authored
      The ALC225_FIXUP_HEADSET_JACK fixup can be merged to alc295_fixup_chromebook.
      There are no other users for ALC225_FIXUP_HEADSET_JACK other than
      the chromebook hardware.
      
      Fixes: 10f5b1b8 ("ALSA: hda/realtek - Fixed Headset Mic JD not stable")
      Cc: Kailang Yang <kailang@realtek.com>
      Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      c8a9afa6
    • Dave Airlie's avatar
      Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm-next · 0f1d37e6
      Dave Airlie authored
      - Update golden regs for gfx9
      - Powerplay fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190313194249.3346-1-alexander.deucher@amd.com
      0f1d37e6
    • Dave Airlie's avatar
      Merge tag 'drm-intel-next-fixes-2019-03-12' of... · ad7ad48e
      Dave Airlie authored
      Merge tag 'drm-intel-next-fixes-2019-03-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
      
      - HDCP state handling in ddi_update_pipe
      - Protect i915_active iterators from the shrinker
      - Reacquire priolist cache after dropping the engine lock
      - (Selftest) Always free spinner on __sseu_prepare error
      - Acquire breadcrumb ref before canceling
      - Fix atomic state leak on HDMI link reset
      - Relax mmap VMA check
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Rodrigo Vivi <rodrigo.vivi@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190312205551.GA7701@intel.com
      ad7ad48e
    • Dave Airlie's avatar
      Merge tag 'drm-misc-next-fixes-2019-03-13' of... · 74cd45fa
      Dave Airlie authored
      Merge tag 'drm-misc-next-fixes-2019-03-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
      
       - qxl: Remove the conflicting framebuffers earlier
       - Split out some i915 code into the fb_helper to allow the above
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maxime Ripard <maxime.ripard@bootlin.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190313192158.k3qssf733khsqodn@flea
      74cd45fa
  3. 13 Mar, 2019 5 commits
    • Xin Long's avatar
      pptp: dst_release sk_dst_cache in pptp_sock_destruct · 9417d81f
      Xin Long authored
      sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
      so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
      otherwise, the dst refcnt will leak.
      
      It can be reproduced by this syz log:
      
        r1 = socket$pptp(0x18, 0x1, 0x2)
        bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
        connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
      
      Consecutive dmesg warnings will occur:
      
        unregister_netdevice: waiting for lo to become free. Usage count = 1
      
      v1->v2:
        - use rcu_dereference_protected() instead of rcu_dereference_check(),
          as suggested by Eric.
      
      Fixes: 00959ade ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
      Reported-by: default avatarXiumei Mu <xmu@redhat.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9417d81f
    • Florian Fainelli's avatar
      MAINTAINERS: GENET & SYSTEMPORT: Add internal Broadcom list · 63b6c974
      Florian Fainelli authored
      There is a patchwork instance behind bcm-kernel-feedback-list that is
      helpful to track submissions, add this list for the Broadcom GENET and
      SYSTEMPORT drivers.
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63b6c974
    • Eric Dumazet's avatar
      l2tp: fix infoleak in l2tp_ip6_recvmsg() · 163d1c3d
      Eric Dumazet authored
      Back in 2013 Hannes took care of most of such leaks in commit
      bceaa902 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
      
      But the bug in l2tp_ip6_recvmsg() has not been fixed.
      
      syzbot report :
      
      BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
      CPU: 1 PID: 10996 Comm: syz-executor362 Not tainted 5.0.0+ #11
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x173/0x1d0 lib/dump_stack.c:113
       kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600
       kmsan_internal_check_memory+0x9f4/0xb10 mm/kmsan/kmsan.c:694
       kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
       _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
       copy_to_user include/linux/uaccess.h:174 [inline]
       move_addr_to_user+0x311/0x570 net/socket.c:227
       ___sys_recvmsg+0xb65/0x1310 net/socket.c:2283
       do_recvmmsg+0x646/0x10c0 net/socket.c:2390
       __sys_recvmmsg net/socket.c:2469 [inline]
       __do_sys_recvmmsg net/socket.c:2492 [inline]
       __se_sys_recvmmsg+0x1d1/0x350 net/socket.c:2485
       __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2485
       do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
       entry_SYSCALL_64_after_hwframe+0x63/0xe7
      RIP: 0033:0x445819
      Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
      RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819
      RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003
      RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c
      R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf
      
      Local variable description: ----addr@___sys_recvmsg
      Variable was created at:
       ___sys_recvmsg+0xf6/0x1310 net/socket.c:2244
       do_recvmmsg+0x646/0x10c0 net/socket.c:2390
      
      Bytes 0-31 of 32 are uninitialized
      Memory access of size 32 starts at ffff8880ae62fbb0
      Data copied to user address 0000000020000000
      
      Fixes: a32e0eec ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      163d1c3d
    • Vakul Garg's avatar
      net/tls: Inform user space about send buffer availability · 4504ab0e
      Vakul Garg authored
      A previous fix ("tls: Fix write space handling") assumed that
      user space application gets informed about the socket send buffer
      availability when tls_push_sg() gets called. Inside tls_push_sg(), in
      case do_tcp_sendpages() returns 0, the function returns without calling
      ctx->sk_write_space. Further, the new function tls_sw_write_space()
      did not invoke ctx->sk_write_space. This leads to situation that user
      space application encounters a lockup always waiting for socket send
      buffer to become available.
      
      Rather than call ctx->sk_write_space from tls_push_sg(), it should be
      called from tls_write_space. So whenever tcp stack invokes
      sk->sk_write_space after freeing socket send buffer, we always declare
      the same to user space by the way of invoking ctx->sk_write_space.
      
      Fixes: 7463d3a2 ("tls: Fix write space handling")
      Signed-off-by: default avatarVakul Garg <vakul.garg@nxp.com>
      Reviewed-by: default avatarBoris Pismenny <borisp@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4504ab0e
    • Zhike Wang's avatar
      net_sched: return correct value for *notify* functions · 5b5f99b1
      Zhike Wang authored
      It is confusing to directly use return value of netlink_send()/
      netlink_unicast() as the return value of *notify*, as it may be not
      error at all.
      
      Example: in tc_del_tfilter(), after calling tfilter_del_notify(), it will
      goto errout if (err). However, the netlink_send()/netlink_unicast() will
      return positive value even for successful case. So it may not call
      tcf_chain_tp_remove() and so on to clean up the resource, as a result,
      resource is leaked.
      
      It may be easier to only check the return value of tfilter_del_nofiy(),
      but it is more clean to correct all related functions.
      Co-developed-by: default avatarZengmo Gao <gaozengmo@jd.com>
      Signed-off-by: default avatarZhike Wang <wangzhike@jd.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5b5f99b1