1. 12 Nov, 2019 9 commits
    • Andrey Pronin's avatar
      tpm: tpm_tis_spi: Support cr50 devices · 797c0113
      Andrey Pronin authored
      Add TPM2.0 PTP FIFO compatible SPI interface for chips with Cr50
      firmware. The firmware running on the currently supported H1 Secure
      Microcontroller requires a special driver to handle its specifics:
      
       - need to ensure a certain delay between SPI transactions, or else
         the chip may miss some part of the next transaction
       - if there is no SPI activity for some time, it may go to sleep,
         and needs to be waken up before sending further commands
       - access to vendor-specific registers
      
      Cr50 firmware has a requirement to wait for the TPM to wakeup before
      sending commands over the SPI bus. Otherwise, the firmware could be in
      deep sleep and not respond. The method to wait for the device to wakeup
      is slightly different than the usual flow control mechanism described in
      the TCG SPI spec. Add a completion to tpm_tis_spi_transfer() before we
      start a SPI transfer so we can keep track of the last time the TPM
      driver accessed the SPI bus to support the flow control mechanism.
      
      Split the cr50 logic off into a different file to keep it out of the
      normal code flow of the existing SPI driver while making it all part of
      the same module when the code is optionally compiled into the same
      module. Export a new function, tpm_tis_spi_init(), and the associated
      read/write/transfer APIs so that we can do this. Make the cr50 code wrap
      the tpm_tis_spi_phy struct with its own struct to override the behavior
      of tpm_tis_spi_transfer() by supplying a custom flow control hook. This
      shares the most code between the core driver and the cr50 support
      without combining everything into the core driver or exporting module
      symbols.
      Signed-off-by: default avatarAndrey Pronin <apronin@chromium.org>
      Cc: Andrey Pronin <apronin@chromium.org>
      Cc: Duncan Laurie <dlaurie@chromium.org>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Guenter Roeck <groeck@chromium.org>
      Cc: Alexander Steffen <Alexander.Steffen@infineon.com>
      Cc: Heiko Stuebner <heiko@sntech.de>
      [swboyd@chromium.org: Replace boilerplate with SPDX tag, drop
      suspended bit and remove ifdef checks in cr50.h, migrate to functions
      exported in tpm_tis_spi.h, combine into one module instead of two]
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Tested-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      797c0113
    • Stephen Boyd's avatar
      tpm: tpm_tis_spi: Introduce a flow control callback · 8ab5e82a
      Stephen Boyd authored
      Cr50 firmware has a different flow control protocol than the one used by
      this TPM PTP SPI driver. Introduce a flow control callback so we can
      override the standard sequence with the custom one that Cr50 uses.
      
      Cc: Andrey Pronin <apronin@chromium.org>
      Cc: Duncan Laurie <dlaurie@chromium.org>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Guenter Roeck <groeck@chromium.org>
      Cc: Alexander Steffen <Alexander.Steffen@infineon.com>
      Cc: Heiko Stuebner <heiko@sntech.de>
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Tested-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      8ab5e82a
    • Stephen Boyd's avatar
      tpm: Add a flag to indicate TPM power is managed by firmware · 2e2ee5a2
      Stephen Boyd authored
      On some platforms, the TPM power is managed by firmware and therefore we
      don't need to stop the TPM on suspend when going to a light version of
      suspend such as S0ix ("freeze" suspend state). Add a chip flag,
      TPM_CHIP_FLAG_FIRMWARE_POWER_MANAGED, to indicate this so that certain
      platforms can probe for the usage of this light suspend and avoid
      touching the TPM state across suspend/resume.
      
      Cc: Andrey Pronin <apronin@chromium.org>
      Cc: Duncan Laurie <dlaurie@chromium.org>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Guenter Roeck <groeck@chromium.org>
      Cc: Alexander Steffen <Alexander.Steffen@infineon.com>
      Cc: Heiko Stuebner <heiko@sntech.de>
      Tested-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      2e2ee5a2
    • Andrey Pronin's avatar
      dt-bindings: tpm: document properties for cr50 · fb8d6c8d
      Andrey Pronin authored
      Add TPM2.0 PTP FIFO compatible SPI interface for chips with Cr50
      firmware.
      
      Cc: Andrey Pronin <apronin@chromium.org>
      Cc: Duncan Laurie <dlaurie@chromium.org>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Guenter Roeck <groeck@chromium.org>
      Cc: Alexander Steffen <Alexander.Steffen@infineon.com>
      Cc: Heiko Stuebner <heiko@sntech.de>
      Signed-off-by: default avatarAndrey Pronin <apronin@chromium.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Acked-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      fb8d6c8d
    • Jerry Snitselaar's avatar
      tpm_tis: override durations for STM tpm with firmware 1.2.8.28 · 5af4f1d5
      Jerry Snitselaar authored
      There was revealed a bug in the STM TPM chipset used in Dell R415s.
      Bug is observed so far only on chipset firmware 1.2.8.28
      (1.2 TPM, device-id 0x0, rev-id 78). After some number of
      operations chipset hangs and stays in inconsistent state:
      
      tpm_tis 00:09: Operation Timed out
      tpm_tis 00:09: tpm_transmit: tpm_send: error -5
      
      Durations returned by the chip are the same like on other
      firmware revisions but apparently with specifically 1.2.8.28 fw
      durations should be reset to 2 minutes to enable tpm chip work
      properly. No working way of updating firmware was found.
      
      This patch adds implementation of ->update_durations method
      that matches only STM devices with specific firmware version.
      
      Cc: Peter Huewe <peterhuewe@gmx.de>
      Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Signed-off-by: default avatarAlexey Klimov <aklimov@redhat.com>
      Signed-off-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> (!update_durations path)
      Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> (!update_durations path)
      5af4f1d5
    • Jerry Snitselaar's avatar
      tpm: provide a way to override the chip returned durations · 15d0b22c
      Jerry Snitselaar authored
      Patch adds method ->update_durations to override returned
      durations in case TPM chip misbehaves for TPM 1.2 drivers.
      
      Cc: Peter Huewe <peterhuewe@gmx.de>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Signed-off-by: default avatarAlexey Klimov <aklimov@redhat.com>
      Signed-off-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> (!update_durations path)
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      15d0b22c
    • Jarkko Sakkinen's avatar
      tpm: Remove duplicate code from caps_show() in tpm-sysfs.c · f2f5820e
      Jarkko Sakkinen authored
      Replace existing TPM 1.x version structs with new structs that consolidate
      the common parts into a single struct so that code duplication is no longer
      needed in caps_show().
      
      Cc: Peter Huewe <peterhuewe@gmx.de>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Alexey Klimov <aklimov@redhat.com>
      Reviewed-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
      Tested-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      f2f5820e
    • Linus Torvalds's avatar
      Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · eb094f06
      Linus Torvalds authored
      Pull x86 TSX Async Abort and iTLB Multihit mitigations from Thomas Gleixner:
       "The performance deterioration departement is not proud at all of
        presenting the seventh installment of speculation mitigations and
        hardware misfeature workarounds:
      
         1) TSX Async Abort (TAA) - 'The Annoying Affair'
      
            TAA is a hardware vulnerability that allows unprivileged
            speculative access to data which is available in various CPU
            internal buffers by using asynchronous aborts within an Intel TSX
            transactional region.
      
            The mitigation depends on a microcode update providing a new MSR
            which allows to disable TSX in the CPU. CPUs which have no
            microcode update can be mitigated by disabling TSX in the BIOS if
            the BIOS provides a tunable.
      
            Newer CPUs will have a bit set which indicates that the CPU is not
            vulnerable, but the MSR to disable TSX will be available
            nevertheless as it is an architected MSR. That means the kernel
            provides the ability to disable TSX on the kernel command line,
            which is useful as TSX is a truly useful mechanism to accelerate
            side channel attacks of all sorts.
      
         2) iITLB Multihit (NX) - 'No eXcuses'
      
            iTLB Multihit is an erratum where some Intel processors may incur
            a machine check error, possibly resulting in an unrecoverable CPU
            lockup, when an instruction fetch hits multiple entries in the
            instruction TLB. This can occur when the page size is changed
            along with either the physical address or cache type. A malicious
            guest running on a virtualized system can exploit this erratum to
            perform a denial of service attack.
      
            The workaround is that KVM marks huge pages in the extended page
            tables as not executable (NX). If the guest attempts to execute in
            such a page, the page is broken down into 4k pages which are
            marked executable. The workaround comes with a mechanism to
            recover these shattered huge pages over time.
      
        Both issues come with full documentation in the hardware
        vulnerabilities section of the Linux kernel user's and administrator's
        guide.
      
        Thanks to all patch authors and reviewers who had the extraordinary
        priviledge to be exposed to this nuisance.
      
        Special thanks to Borislav Petkov for polishing the final TAA patch
        set and to Paolo Bonzini for shepherding the KVM iTLB workarounds and
        providing also the backports to stable kernels for those!"
      
      * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
        Documentation: Add ITLB_MULTIHIT documentation
        kvm: x86: mmu: Recovery of shattered NX large pages
        kvm: Add helper function for creating VM worker threads
        kvm: mmu: ITLB_MULTIHIT mitigation
        cpu/speculation: Uninline and export CPU mitigations helpers
        x86/cpu: Add Tremont to the cpu vulnerability whitelist
        x86/bugs: Add ITLB_MULTIHIT bug infrastructure
        x86/tsx: Add config options to set tsx=on|off|auto
        x86/speculation/taa: Add documentation for TSX Async Abort
        x86/tsx: Add "auto" option to the tsx= cmdline parameter
        kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
        x86/speculation/taa: Add sysfs reporting for TSX Async Abort
        x86/speculation/taa: Add mitigation for TSX Async Abort
        x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
        x86/cpu: Add a helper function x86_read_arch_cap_msr()
        x86/msr: Add the IA32_TSX_CTRL MSR
      eb094f06
    • Linus Torvalds's avatar
      Merge Intel Gen8/Gen9 graphics fixes from Jon Bloomfield. · 100d46bd
      Linus Torvalds authored
      This fixes two different classes of bugs in the Intel graphics hardware:
      
      MMIO register read hang:
       "On Intels Gen8 and Gen9 Graphics hardware, a read of specific graphics
        MMIO registers when the product is in certain low power states causes
        a system hang.
      
        There are two potential triggers for DoS:
          a) H/W corruption of the RC6 save/restore vector
          b) Hard hang within the MIPI hardware
      
        This prevents the DoS in two areas of the hardware:
          1) Detect corruption of RC6 address on exit from low-power state,
             and if we find it corrupted, disable RC6 and RPM
          2) Permanently lower the MIPI MMIO timeout"
      
      Blitter command streamer unrestricted memory accesses:
       "On Intels Gen9 Graphics hardware the Blitter Command Streamer (BCS)
        allows writing to Memory Mapped Input Output (MMIO) that should be
        blocked. With modifications of page tables, this can lead to privilege
        escalation. This exposure is limited to the Guest Physical Address
        space and does not allow for access outside of the graphics virtual
        machine.
      
        This series establishes a software parser into the Blitter command
        stream to scan for, and prevent, reads or writes to MMIO's that should
        not be accessible to non-privileged contexts.
      
        Much of the command parser infrastructure has existed for some time,
        and is used on Ivybridge/Haswell/Valleyview derived products to allow
        the use of features normally blocked by hardware. In this legacy
        context, the command parser is employed to allow normally unprivileged
        submissions to be run with elevated privileges in order to grant
        access to a limited set of extra capabilities. In this mode the parser
        is optional; In the event that the parser finds any construct that it
        cannot properly validate (e.g. nested command buffers), it simply
        aborts the scan and submits the buffer in non-privileged mode.
      
        For Gen9 Graphics, this series makes the parser mandatory for all
        Blitter submissions. The incoming user buffer is first copied to a
        kernel owned buffer, and parsed. If all checks are successful the
        kernel owned buffer is mapped READ-ONLY and submitted on behalf of the
        user. If any checks fail, or the parser is unable to complete the scan
        (nested buffers), it is forcibly rejected. The successfully scanned
        buffer is executed with NORMAL user privileges (key difference from
        legacy usage).
      
        Modern usermode does not use the Blitter on later hardware, having
        switched over to using the 3D engine instead for performance reasons.
        There are however some legacy usermode apps that rely on Blitter,
        notably the SNA X-Server. There are no known usermode applications
        that require nested command buffers on the Blitter, so the forcible
        rejection of such buffers in this patch series is considered an
        acceptable limitation"
      
      * Intel graphics fixes in emailed bundle from Jon Bloomfield <jon.bloomfield@intel.com>:
        drm/i915/cmdparser: Fix jump whitelist clearing
        drm/i915/gen8+: Add RC6 CTX corruption WA
        drm/i915: Lower RM timeout to avoid DSI hard hangs
        drm/i915/cmdparser: Ignore Length operands during command matching
        drm/i915/cmdparser: Add support for backward jumps
        drm/i915/cmdparser: Use explicit goto for error paths
        drm/i915: Add gen9 BCS cmdparsing
        drm/i915: Allow parsing of unsized batches
        drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
        drm/i915: Add support for mandatory cmdparsing
        drm/i915: Remove Master tables from cmdparser
        drm/i915: Disable Secure Batches for gen6+
        drm/i915: Rename gen7 cmdparser tables
      100d46bd
  2. 11 Nov, 2019 4 commits
  3. 10 Nov, 2019 13 commits
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 44866956
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "A set of fixes that have trickled in over the last couple of weeks:
      
         - MAINTAINER update for Cavium/Marvell ThunderX2
      
         - stm32 tweaks to pinmux for Joystick/Camera, and RAM allocation for
           CAN interfaces
      
         - i.MX fixes for voltage regulator GPIO mappings, fixes voltage
           scaling issues
      
         - More i.MX fixes for various issues on i.MX eval boards: interrupt
           storm due to u-boot leaving pins in new states, fixing power button
           config, a couple of compatible-string corrections.
      
         - Powerdown and Suspend/Resume fixes for Allwinner A83-based tablets
      
         - A few documentation tweaks and a fix of a memory leak in the reset
           subsystem"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
        MAINTAINERS: update Cavium ThunderX2 maintainers
        ARM: dts: stm32: change joystick pinctrl definition on stm32mp157c-ev1
        ARM: dts: stm32: remove OV5640 pinctrl definition on stm32mp157c-ev1
        ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c
        ARM: dts: stm32: relax qspi pins slew-rate for stm32mp157
        arm64: dts: zii-ultra: fix ARM regulator GPIO handle
        ARM: sunxi: Fix CPU powerdown on A83T
        ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
        arm64: dts: imx8mn: fix compatible string for sdma
        arm64: dts: imx8mm: fix compatible string for sdma
        reset: fix reset_control_ops kerneldoc comment
        ARM: dts: imx6-logicpd: Re-enable SNVS power key
        soc: imx: gpc: fix initialiser format
        ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
        arm64: dts: ls1028a: fix a compatible issue
        reset: fix reset_control_get_exclusive kerneldoc comment
        reset: fix reset_control_lookup kerneldoc comment
        reset: fix of_reset_control_get_count kerneldoc comment
        reset: fix of_reset_simple_xlate kerneldoc comment
        reset: Fix memory leak in reset_control_array_put()
      44866956
    • Linus Torvalds's avatar
      Merge tag 'staging-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · dd892625
      Linus Torvalds authored
      Pull IIO fixes and staging driver from Greg KH:
       "Here is a mix of a number of IIO driver fixes for 5.4-rc7, and a whole
        new staging driver.
      
        The IIO fixes resolve some reported issues, all are tiny.
      
        The staging driver addition is the vboxsf filesystem, which is the
        VirtualBox guest shared folder code. Hans has been trying to get
        filesystem reviewers to review the code for many months now, and
        Christoph finally said to just merge it in staging now as it is
        stand-alone and the filesystem people can review it easier over time
        that way.
      
        I know it's late for this big of an addition, but it is stand-alone.
      
        The code has been in linux-next for a while, long enough to pick up a
        few tiny fixes for it already so people are looking at it.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'staging-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: Fix error return code in vboxsf_fill_super()
        staging: vboxsf: fix dereference of pointer dentry before it is null checked
        staging: vboxsf: Remove unused including <linux/version.h>
        staging: Add VirtualBox guest shared folder (vboxsf) support
        iio: adc: stm32-adc: fix stopping dma
        iio: imu: inv_mpu6050: fix no data on MPU6050
        iio: srf04: fix wrong limitation in distance measuring
        iio: imu: adis16480: make sure provided frequency is positive
      dd892625
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 3de2a3e9
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are a number of late-arrival driver fixes for issues reported for
        some char/misc drivers for 5.4-rc7
      
        These all come from the different subsystem/driver maintainers as
        things that they had reports for and wanted to see fixed.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        intel_th: pci: Add Jasper Lake PCH support
        intel_th: pci: Add Comet Lake PCH support
        intel_th: msu: Fix possible memory leak in mode_store()
        intel_th: msu: Fix overflow in shift of an unsigned int
        intel_th: msu: Fix missing allocation failure check on a kstrndup
        intel_th: msu: Fix an uninitialized mutex
        intel_th: gth: Fix the window switching sequence
        soundwire: slave: fix scanf format
        soundwire: intel: fix intel_register_dai PDI offsets and numbers
        interconnect: Add locking in icc_set_tag()
        interconnect: qcom: Fix icc_onecell_data allocation
        soundwire: depend on ACPI || OF
        soundwire: depend on ACPI
        thunderbolt: Drop unnecessary read when writing LC command in Ice Lake
        thunderbolt: Fix lockdep circular locking depedency warning
        thunderbolt: Read DP IN adapter first two dwords in one go
      3de2a3e9
    • Linus Torvalds's avatar
      Merge tag 'configfs-for-5.4-2' of git://git.infradead.org/users/hch/configfs · a5871fcb
      Linus Torvalds authored
      Pull configfs regression fix from Christoph Hellwig:
       "Fix a regression from this merge window in the configfs symlink
        handling (Honggang Li)"
      
      * tag 'configfs-for-5.4-2' of git://git.infradead.org/users/hch/configfs:
        configfs: calculate the depth of parent item
      a5871fcb
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9805a683
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A small set of fixes for x86:
      
         - Make the tsc=reliable/nowatchdog command line parameter work again.
           It was broken with the introduction of the early TSC clocksource.
      
         - Prevent the evaluation of exception stacks before they are set up.
           This causes a crash in dumpstack because the stack walk termination
           gets screwed up.
      
         - Prevent a NULL pointer dereference in the rescource control file
           system.
      
         - Avoid bogus warnings about APIC id mismatch related to the LDR
           which can happen when the LDR is not in use and therefore not
           initialized. Only evaluate that when the APIC is in logical
           destination mode"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early
        x86/dumpstack/64: Don't evaluate exception stacks before setup
        x86/apic/32: Avoid bogus LDR warnings
        x86/resctrl: Prevent NULL pointer dereference when reading mondata
      9805a683
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 621084cd
      Linus Torvalds authored
      Pull timer fixes from Thomas Gleixner:
       "A small set of fixes for timekeepoing and clocksource drivers:
      
         - VDSO data was updated conditional on the availability of a VDSO
           capable clocksource. This causes the VDSO functions which do not
           depend on a VDSO capable clocksource to operate on stale data.
           Always update unconditionally.
      
         - Prevent a double free in the mediatek driver
      
         - Use the proper helper in the sh_mtu2 driver so it won't attempt to
           initialize non-existing interrupts"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        timekeeping/vsyscall: Update VDSO data unconditionally
        clocksource/drivers/sh_mtu2: Do not loop using platform_get_irq_by_name()
        clocksource/drivers/mediatek: Fix error handling
      621084cd
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 81388c2b
      Linus Torvalds authored
      Pull scheduler fixes from Thomas Gleixner:
       "Two fixes for scheduler regressions:
      
         - Plug a subtle race condition which was introduced with the rework
           of the next task selection functionality. The change of task
           properties became unprotected which can be observed inconsistently
           causing state corruption.
      
         - A trivial compile fix for CONFIG_CGROUPS=n"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched: Fix pick_next_task() vs 'change' pattern race
        sched/core: Fix compilation error when cgroup not selected
      81388c2b
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · b584a176
      Linus Torvalds authored
      Pull perf tooling fixes from Thomas Gleixner:
      
       - Fix the time sorting algorithm which was broken due to truncation of
         big numbers
      
       - Fix the python script generator fail caused by a broken tracepoint
         array iterator
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf tools: Fix time sorting
        perf tools: Remove unused trace_find_next_event()
        perf scripting engines: Iterate on tep event arrays directly
      b584a176
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ffba65ea
      Linus Torvalds authored
      Pull irq fixlet from Thomas Gleixner:
       "A trivial fix for a kernel doc regression where an argument change was
        not reflected in the documentation"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irq/irqdomain: Update __irq_domain_alloc_fwnode() function documentation
      ffba65ea
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 20c7e296
      Linus Torvalds authored
      Pull stacktrace fix from Thomas Gleixner:
       "A small fix for a stacktrace regression.
      
        Saving a stacktrace for a foreign task skipped an extra entry which
        makes e.g. the output of /proc/$PID/stack incomplete"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        stacktrace: Don't skip first entry on noncurrent tasks
      20c7e296
    • Linus Torvalds's avatar
      Merge tag '5.4-rc7-smb3-fix' of git://git.samba.org/sfrench/cifs-2.6 · 79a64063
      Linus Torvalds authored
      Pull cifs fix from Steve French:
       "Small fix for an smb3 reconnect bug (also marked for stable)"
      
      * tag '5.4-rc7-smb3-fix' of git://git.samba.org/sfrench/cifs-2.6:
        SMB3: Fix persistent handles reconnect
      79a64063
    • Corentin Labbe's avatar
      lib: Remove select of inexistant GENERIC_IO · 820b7c71
      Corentin Labbe authored
      config option GENERIC_IO was removed but still selected by lib/kconfig
      This patch finish the cleaning.
      
      Fixes: 9de8da47 ("kconfig: kill off GENERIC_IO option")
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarCorentin Labbe <clabbe@baylibre.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      820b7c71
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v5.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 4763c089
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
      
       - Fix glitch risks in the Intel GPIO
      
       - Fix the Intel Cherryview valid irq mask calculation.
      
       - Allocate the Intel Cherryview irqchip dynamically.
      
       - Fix the valid mask init sequency on the ST STMFX driver.
      
      * tag 'pinctrl-v5.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: stmfx: fix valid_mask init sequence
        pinctrl: cherryview: Allocate IRQ chip dynamic
        pinctrl: cherryview: Fix irq_valid_mask calculation
        pinctrl: intel: Avoid potential glitches if pin is in GPIO mode
      4763c089
  4. 09 Nov, 2019 11 commits
    • Linus Torvalds's avatar
      Merge tag 'for-5.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 00aff683
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "A few regressions and fixes for stable.
      
        Regressions:
      
         - fix a race leading to metadata space leak after task received a
           signal
      
         - un-deprecate 2 ioctls, marked as deprecated by mistake
      
        Fixes:
      
         - fix limit check for number of devices during chunk allocation
      
         - fix a race due to double evaluation of i_size_read inside max()
           macro, can cause a crash
      
         - remove wrong device id check in tree-checker"
      
      * tag 'for-5.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: un-deprecate ioctls START_SYNC and WAIT_SYNC
        btrfs: save i_size to avoid double evaluation of i_size_read in compress_file_range
        Btrfs: fix race leading to metadata space leak after task received signal
        btrfs: tree-checker: Fix wrong check on max devid
        btrfs: Consider system chunk array size for new SYSTEM chunks
      00aff683
    • Linus Torvalds's avatar
      Merge tag 'linux-watchdog-5.4-rc7' of git://www.linux-watchdog.org/linux-watchdog · 4aba1a7e
      Linus Torvalds authored
      Pull watchdog fixes from Wim Van Sebroeck:
      
       - cpwd: fix build regression
      
       - pm8916_wdt: fix pretimeout registration flow
      
       - meson: Fix the wrong value of left time
      
       - imx_sc_wdt: Pretimeout should follow SCU firmware format
      
       - bd70528: Add MODULE_ALIAS to allow module auto loading
      
      * tag 'linux-watchdog-5.4-rc7' of git://www.linux-watchdog.org/linux-watchdog:
        watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading
        watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format
        watchdog: meson: Fix the wrong value of left time
        watchdog: pm8916_wdt: fix pretimeout registration flow
        watchdog: cpwd: fix build regression
      4aba1a7e
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 0058b0a5
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) BPF sample build fixes from Björn Töpel
      
       2) Fix powerpc bpf tail call implementation, from Eric Dumazet.
      
       3) DCCP leaks jiffies on the wire, fix also from Eric Dumazet.
      
       4) Fix crash in ebtables when using dnat target, from Florian Westphal.
      
       5) Fix port disable handling whne removing bcm_sf2 driver, from Florian
          Fainelli.
      
       6) Fix kTLS sk_msg trim on fallback to copy mode, from Jakub Kicinski.
      
       7) Various KCSAN fixes all over the networking, from Eric Dumazet.
      
       8) Memory leaks in mlx5 driver, from Alex Vesker.
      
       9) SMC interface refcounting fix, from Ursula Braun.
      
      10) TSO descriptor handling fixes in stmmac driver, from Jose Abreu.
      
      11) Add a TX lock to synchonize the kTLS TX path properly with crypto
          operations. From Jakub Kicinski.
      
      12) Sock refcount during shutdown fix in vsock/virtio code, from Stefano
          Garzarella.
      
      13) Infinite loop in Intel ice driver, from Colin Ian King.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits)
        ixgbe: need_wakeup flag might not be set for Tx
        i40e: need_wakeup flag might not be set for Tx
        igb/igc: use ktime accessors for skb->tstamp
        i40e: Fix for ethtool -m issue on X722 NIC
        iavf: initialize ITRN registers with correct values
        ice: fix potential infinite loop because loop counter being too small
        qede: fix NULL pointer deref in __qede_remove()
        net: fix data-race in neigh_event_send()
        vsock/virtio: fix sock refcnt holding during the shutdown
        net: ethernet: octeon_mgmt: Account for second possible VLAN header
        mac80211: fix station inactive_time shortly after boot
        net/fq_impl: Switch to kvmalloc() for memory allocation
        mac80211: fix ieee80211_txq_setup_flows() failure path
        ipv4: Fix table id reference in fib_sync_down_addr
        ipv6: fixes rt6_probe() and fib6_nh->last_probe init
        net: hns: Fix the stray netpoll locks causing deadlock in NAPI path
        net: usb: qmi_wwan: add support for DW5821e with eSIM support
        CDC-NCM: handle incomplete transfer of MTU
        nfc: netlink: fix double device reference drop
        NFC: st21nfca: fix double free
        ...
      0058b0a5
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2019-11-08' of git://git.kernel.dk/linux-block · 5cb8418c
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Two NVMe device removal crash fixes, and a compat fixup for for an
         ioctl that was introduced in this release (Anton, Charles, Max - via
         Keith)
      
       - Missing error path mutex unlock for drbd (Dan)
      
       - cgroup writeback fixup on dead memcg (Tejun)
      
       - blkcg online stats print fix (Tejun)
      
      * tag 'for-linus-2019-11-08' of git://git.kernel.dk/linux-block:
        cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead
        block: drbd: remove a stray unlock in __drbd_send_protocol()
        blkcg: make blkcg_print_stat() print stats only for online blkgs
        nvme: change nvme_passthru_cmd64 to explicitly mark rsvd
        nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths
        nvme-rdma: fix a segmentation fault during module unload
      5cb8418c
    • David S. Miller's avatar
      Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue · a2582cdc
      David S. Miller authored
      Jeff Kirsher says:
      
      ====================
      Intel Wired LAN Driver Fixes 2019-11-08
      
      This series contains fixes to igb, igc, ixgbe, i40e, iavf and ice
      drivers.
      
      Colin Ian King fixes a potentially wrap-around counter in a for-loop.
      
      Nick fixes the default ITR values for the iavf driver to 50 usecs
      interval.
      
      Arkadiusz fixes 'ethtool -m' for X722 devices where the correct value
      cannot be obtained from the firmware, so add X722 to the check to ensure
      the wrong value is not returned.
      
      Jake fixes igb and igc drivers in their implementation of launch time
      support by declaring skb->tstamp value as ktime_t instead of s64.
      
      Magnus fixes ixgbe and i40e where the need_wakeup flag for transmit may
      not be set for AF_XDP sockets that are only used to send packets.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2582cdc
    • Magnus Karlsson's avatar
      ixgbe: need_wakeup flag might not be set for Tx · 0843aa8f
      Magnus Karlsson authored
      The need_wakeup flag for Tx might not be set for AF_XDP sockets that
      are only used to send packets. This happens if there is at least one
      outstanding packet that has not been completed by the hardware and we
      get that corresponding completion (which will not generate an
      interrupt since interrupts are disabled in the napi poll loop) between
      the time we stopped processing the Tx completions and interrupts are
      enabled again. In this case, the need_wakeup flag will have been
      cleared at the end of the Tx completion processing as we believe we
      will get an interrupt from the outstanding completion at a later point
      in time. But if this completion interrupt occurs before interrupts
      are enable, we lose it and should at that point really have set the
      need_wakeup flag since there are no more outstanding completions that
      can generate an interrupt to continue the processing. When this
      happens, user space will see a Tx queue need_wakeup of 0 and skip
      issuing a syscall, which means will never get into the Tx processing
      again and we have a deadlock.
      
      This patch introduces a quick fix for this issue by just setting the
      need_wakeup flag for Tx to 1 all the time. I am working on a proper
      fix for this that will toggle the flag appropriately, but it is more
      challenging than I anticipated and I am afraid that this patch will
      not be completed before the merge window closes, therefore this easier
      fix for now. This fix has a negative performance impact in the range
      of 0% to 4%. Towards the higher end of the scale if you have driver
      and application on the same core and issue a lot of packets, and
      towards no negative impact if you use two cores, lower transmission
      speeds and/or a workload that also receives packets.
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      0843aa8f
    • Magnus Karlsson's avatar
      i40e: need_wakeup flag might not be set for Tx · 70563957
      Magnus Karlsson authored
      The need_wakeup flag for Tx might not be set for AF_XDP sockets that
      are only used to send packets. This happens if there is at least one
      outstanding packet that has not been completed by the hardware and we
      get that corresponding completion (which will not generate an
      interrupt since interrupts are disabled in the napi poll loop) between
      the time we stopped processing the Tx completions and interrupts are
      enabled again. In this case, the need_wakeup flag will have been
      cleared at the end of the Tx completion processing as we believe we
      will get an interrupt from the outstanding completion at a later point
      in time. But if this completion interrupt occurs before interrupts
      are enable, we lose it and should at that point really have set the
      need_wakeup flag since there are no more outstanding completions that
      can generate an interrupt to continue the processing. When this
      happens, user space will see a Tx queue need_wakeup of 0 and skip
      issuing a syscall, which means will never get into the Tx processing
      again and we have a deadlock.
      
      This patch introduces a quick fix for this issue by just setting the
      need_wakeup flag for Tx to 1 all the time. I am working on a proper
      fix for this that will toggle the flag appropriately, but it is more
      challenging than I anticipated and I am afraid that this patch will
      not be completed before the merge window closes, therefore this easier
      fix for now. This fix has a negative performance impact in the range
      of 0% to 4%. Towards the higher end of the scale if you have driver
      and application on the same core and issue a lot of packets, and
      towards no negative impact if you use two cores, lower transmission
      speeds and/or a workload that also receives packets.
      Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      70563957
    • Jacob Keller's avatar
      igb/igc: use ktime accessors for skb->tstamp · 6acab13b
      Jacob Keller authored
      When implementing launch time support in the igb and igc drivers, the
      skb->tstamp value is assumed to be a s64, but it's declared as a ktime_t
      value.
      
      Although ktime_t is typedef'd to s64 it wasn't always, and the kernel
      provides accessors for ktime_t values.
      
      Use the ktime_to_timespec64 and ktime_set accessors instead of directly
      assuming that the variable is always an s64.
      
      This improves portability if the code is ever moved to another kernel
      version, or if the definition of ktime_t ever changes again in the
      future.
      Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Acked-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      6acab13b
    • Arkadiusz Kubalewski's avatar
      i40e: Fix for ethtool -m issue on X722 NIC · 4c9da6f2
      Arkadiusz Kubalewski authored
      This patch contains fix for a problem with command:
      'ethtool -m <dev>'
      which breaks functionality of:
      'ethtool <dev>'
      when called on X722 NIC
      
      Disallowed update of link phy_types on X722 NIC
      Currently correct value cannot be obtained from FW
      Previously wrong value returned by FW was used and was
      a root cause for incorrect output of 'ethtool <dev>' command
      Signed-off-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      4c9da6f2
    • Nicholas Nunley's avatar
      iavf: initialize ITRN registers with correct values · 4eda4e00
      Nicholas Nunley authored
      Since commit 92418fb1 ("i40e/i40evf: Use usec value instead of reg
      value for ITR defines") the driver tracks the interrupt throttling
      intervals in single usec units, although the actual ITRN registers are
      programmed in 2 usec units. Most register programming flows in the driver
      correctly handle the conversion, although it is currently not applied when
      the registers are initialized to their default values. Most of the time
      this doesn't present a problem since the default values are usually
      immediately overwritten through the standard adaptive throttling mechanism,
      or updated manually by the user, but if adaptive throttling is disabled and
      the interval values are left alone then the incorrect value will persist.
      
      Since the intended default interval of 50 usecs (vs. 100 usecs as
      programmed) performs better for most traffic workloads, this can lead to
      performance regressions.
      
      This patch adds the correct conversion when writing the initial values to
      the ITRN registers.
      Signed-off-by: default avatarNicholas Nunley <nicholas.d.nunley@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      4eda4e00
    • Colin Ian King's avatar
      ice: fix potential infinite loop because loop counter being too small · 615457a2
      Colin Ian King authored
      Currently the for-loop counter i is a u8 however it is being checked
      against a maximum value hw->num_tx_sched_layers which is a u16. Hence
      there is a potential wrap-around of counter i back to zero if
      hw->num_tx_sched_layers is greater than 255.  Fix this by making i
      a u16.
      
      Addresses-Coverity: ("Infinite loop")
      Fixes: b36c598c ("ice: Updates to Tx scheduler code")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      615457a2
  5. 08 Nov, 2019 3 commits
    • Manish Chopra's avatar
      qede: fix NULL pointer deref in __qede_remove() · deabc871
      Manish Chopra authored
      While rebooting the system with SR-IOV vfs enabled leads
      to below crash due to recurrence of __qede_remove() on the VF
      devices (first from .shutdown() flow of the VF itself and
      another from PF's .shutdown() flow executing pci_disable_sriov())
      
      This patch adds a safeguard in __qede_remove() flow to fix this,
      so that driver doesn't attempt to remove "already removed" devices.
      
      [  194.360134] BUG: unable to handle kernel NULL pointer dereference at 00000000000008dc
      [  194.360227] IP: [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
      [  194.360304] PGD 0
      [  194.360325] Oops: 0000 [#1] SMP
      [  194.360360] Modules linked in: tcp_lp fuse tun bridge stp llc devlink bonding ip_set nfnetlink ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_umad rpcrdma sunrpc rdma_ucm ib_uverbs ib_iser rdma_cm iw_cm ib_cm libiscsi scsi_transport_iscsi dell_smbios iTCO_wdt iTCO_vendor_support dell_wmi_descriptor dcdbas vfat fat pcc_cpufreq skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd qedr ib_core pcspkr ses enclosure joydev ipmi_ssif sg i2c_i801 lpc_ich mei_me mei wmi ipmi_si ipmi_devintf ipmi_msghandler tpm_crb acpi_pad acpi_power_meter xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_pclmul crct10dif_common crc32c_intel mgag200
      [  194.361044]  qede i2c_algo_bit drm_kms_helper qed syscopyarea sysfillrect nvme sysimgblt fb_sys_fops ttm nvme_core mpt3sas crc8 ptp drm pps_core ahci raid_class scsi_transport_sas libahci libata drm_panel_orientation_quirks nfit libnvdimm dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ip_tables]
      [  194.361297] CPU: 51 PID: 7996 Comm: reboot Kdump: loaded Not tainted 3.10.0-1062.el7.x86_64 #1
      [  194.361359] Hardware name: Dell Inc. PowerEdge MX840c/0740HW, BIOS 2.4.6 10/15/2019
      [  194.361412] task: ffff9cea9b360000 ti: ffff9ceabebdc000 task.ti: ffff9ceabebdc000
      [  194.361463] RIP: 0010:[<ffffffffc03553c4>]  [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
      [  194.361534] RSP: 0018:ffff9ceabebdfac0  EFLAGS: 00010282
      [  194.361570] RAX: 0000000000000000 RBX: ffff9cd013846098 RCX: 0000000000000000
      [  194.361621] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9cd013846098
      [  194.361668] RBP: ffff9ceabebdfae8 R08: 0000000000000000 R09: 0000000000000000
      [  194.361715] R10: 00000000bfe14201 R11: ffff9ceabfe141e0 R12: 0000000000000000
      [  194.361762] R13: ffff9cd013846098 R14: 0000000000000000 R15: ffff9ceab5e48000
      [  194.361810] FS:  00007f799c02d880(0000) GS:ffff9ceacb0c0000(0000) knlGS:0000000000000000
      [  194.361865] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  194.361903] CR2: 00000000000008dc CR3: 0000001bdac76000 CR4: 00000000007607e0
      [  194.361953] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  194.362002] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  194.362051] PKRU: 55555554
      [  194.362073] Call Trace:
      [  194.362109]  [<ffffffffc0355500>] qede_remove+0x10/0x20 [qede]
      [  194.362180]  [<ffffffffb97d0f3e>] pci_device_remove+0x3e/0xc0
      [  194.362240]  [<ffffffffb98b3c52>] __device_release_driver+0x82/0xf0
      [  194.362285]  [<ffffffffb98b3ce3>] device_release_driver+0x23/0x30
      [  194.362343]  [<ffffffffb97c86d4>] pci_stop_bus_device+0x84/0xa0
      [  194.362388]  [<ffffffffb97c87e2>] pci_stop_and_remove_bus_device+0x12/0x20
      [  194.362450]  [<ffffffffb97f153f>] pci_iov_remove_virtfn+0xaf/0x160
      [  194.362496]  [<ffffffffb97f1aec>] sriov_disable+0x3c/0xf0
      [  194.362534]  [<ffffffffb97f1bc3>] pci_disable_sriov+0x23/0x30
      [  194.362599]  [<ffffffffc02f83c3>] qed_sriov_disable+0x5e3/0x650 [qed]
      [  194.362658]  [<ffffffffb9622df6>] ? kfree+0x106/0x140
      [  194.362709]  [<ffffffffc02cc0c0>] ? qed_free_stream_mem+0x70/0x90 [qed]
      [  194.362754]  [<ffffffffb9622df6>] ? kfree+0x106/0x140
      [  194.362803]  [<ffffffffc02cd659>] qed_slowpath_stop+0x1a9/0x1d0 [qed]
      [  194.362854]  [<ffffffffc035544e>] __qede_remove+0xae/0x130 [qede]
      [  194.362904]  [<ffffffffc03554e0>] qede_shutdown+0x10/0x20 [qede]
      [  194.362956]  [<ffffffffb97cf90a>] pci_device_shutdown+0x3a/0x60
      [  194.363010]  [<ffffffffb98b180b>] device_shutdown+0xfb/0x1f0
      [  194.363066]  [<ffffffffb94b66c6>] kernel_restart_prepare+0x36/0x40
      [  194.363107]  [<ffffffffb94b66e2>] kernel_restart+0x12/0x60
      [  194.363146]  [<ffffffffb94b6959>] SYSC_reboot+0x229/0x260
      [  194.363196]  [<ffffffffb95f200d>] ? handle_mm_fault+0x39d/0x9b0
      [  194.363253]  [<ffffffffb942b621>] ? __switch_to+0x151/0x580
      [  194.363304]  [<ffffffffb9b7ec28>] ? __schedule+0x448/0x9c0
      [  194.363343]  [<ffffffffb94b69fe>] SyS_reboot+0xe/0x10
      [  194.363387]  [<ffffffffb9b8bede>] system_call_fastpath+0x25/0x2a
      [  194.363430] Code: f9 e9 37 ff ff ff 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 4c 8d af 98 00 00 00 41 54 4c 89 ef 41 89 f4 53 e8 4c e4 55 f9 <80> b8 dc 08 00 00 01 48 89 c3 4c 8d b8 c0 08 00 00 4c 8b b0 c0
      [  194.363712] RIP  [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
      [  194.363764]  RSP <ffff9ceabebdfac0>
      [  194.363791] CR2: 00000000000008dc
      Signed-off-by: default avatarManish Chopra <manishc@marvell.com>
      Signed-off-by: default avatarAriel Elior <aelior@marvell.com>
      Signed-off-by: default avatarSudarsana Kalluru <skalluru@marvell.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      deabc871
    • Eric Dumazet's avatar
      net: fix data-race in neigh_event_send() · 1b53d644
      Eric Dumazet authored
      KCSAN reported the following data-race [1]
      
      The fix will also prevent the compiler from optimizing out
      the condition.
      
      [1]
      
      BUG: KCSAN: data-race in neigh_resolve_output / neigh_resolve_output
      
      write to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 1:
       neigh_event_send include/net/neighbour.h:443 [inline]
       neigh_resolve_output+0x78/0x480 net/core/neighbour.c:1474
       neigh_output include/net/neighbour.h:511 [inline]
       ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228
       __ip_finish_output net/ipv4/ip_output.c:308 [inline]
       __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
       ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
       NF_HOOK_COND include/linux/netfilter.h:294 [inline]
       ip_output+0xdf/0x210 net/ipv4/ip_output.c:432
       dst_output include/net/dst.h:436 [inline]
       ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
       __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
       ip_queue_xmit+0x45/0x60 include/net/ip.h:237
       __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
       tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
       __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976
       tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999
       tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515
       tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598
       tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:618
      
      read to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 0:
       neigh_event_send include/net/neighbour.h:442 [inline]
       neigh_resolve_output+0x57/0x480 net/core/neighbour.c:1474
       neigh_output include/net/neighbour.h:511 [inline]
       ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228
       __ip_finish_output net/ipv4/ip_output.c:308 [inline]
       __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
       ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
       NF_HOOK_COND include/linux/netfilter.h:294 [inline]
       ip_output+0xdf/0x210 net/ipv4/ip_output.c:432
       dst_output include/net/dst.h:436 [inline]
       ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
       __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
       ip_queue_xmit+0x45/0x60 include/net/ip.h:237
       __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
       tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
       __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976
       tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999
       tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515
       tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598
      
      Reported by Kernel Concurrency Sanitizer on:
      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc3+ #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1b53d644
    • Linus Torvalds's avatar
      Merge tag 'pwm/for-5.4-rc7' of... · abf6c397
      Linus Torvalds authored
      Merge tag 'pwm/for-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm
      
      Pull pwm fix from Thierry Reding:
       "One more fix to keep a reference to the driver's module as long as
        there are users of the PWM exposed by the driver"
      
      * tag 'pwm/for-5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm:
        pwm: bcm-iproc: Prevent unloading the driver module while in use
      abf6c397