1. 02 Oct, 2020 14 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · cb6f55af
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Two patches in driver frameworks. The iscsi one corrects a bug induced
        by a BPF change to network locking and the other is a regression we
        introduced"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername()
        scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case
      cb6f55af
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.9-2020-10-02' of git://git.kernel.dk/linux-block · 702bfc89
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - fix for async buffered reads if read-ahead is fully disabled (Hao)
      
       - double poll match fix
      
       - ->show_fdinfo() potential ABBA deadlock complaint fix
      
      * tag 'io_uring-5.9-2020-10-02' of git://git.kernel.dk/linux-block:
        io_uring: fix async buffered reads when readahead is disabled
        io_uring: fix potential ABBA deadlock in ->show_fdinfo()
        io_uring: always delete double poll wait entry on match
      702bfc89
    • Linus Torvalds's avatar
      Merge tag 'block-5.9-2020-10-02' of git://git.kernel.dk/linux-block · f016a540
      Linus Torvalds authored
      Pull block fix from Jens Axboe:
       "Single fix for a ->commit_rqs failure case"
      
      * tag 'block-5.9-2020-10-02' of git://git.kernel.dk/linux-block:
        blk-mq: call commit_rqs while list empty but error happen
      f016a540
    • Linus Torvalds's avatar
      Merge branch 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · d4fce2e2
      Linus Torvalds authored
      Pull epoll fixes from Al Viro:
       "Several race fixes in epoll"
      
      * 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        ep_create_wakeup_source(): dentry name can change under you...
        epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
        epoll: replace ->visited/visited_list with generation count
        epoll: do not insert into poll queues until all sanity checks are done
      d4fce2e2
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · db23baa2
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
       "Two fixes for this week:
      
         - The addition of a symbol export for clint_time_val, which has been
           inlined into some timex functions and can be used by drivers.
      
         - A fix to avoid calling get_cycles() before the timers have been
           probed.
      
        These both only effect !MMU systems"
      
      * tag 'riscv-for-linus-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        RISC-V: Check clint_time_val before use
        clocksource: clint: Export clint_time_val for modules
      db23baa2
    • Linus Torvalds's avatar
      Merge tag 'for-5.9-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 4e3b9ce2
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "Two more fixes.
      
        One is for a lockdep warning/lockup (also caught by syzbot), that one
        has been seen in practice. Regarding the other syzbot reports
        mentioned last time, they don't seem to be urgent and reliably
        reproducible so they'll be fixed later.
      
        The second fix is for a potential corruption when device replace
        finishes and the in-memory state of trim is not copied to the new
        device"
      
      * tag 'for-5.9-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix filesystem corruption after a device replace
        btrfs: move btrfs_rm_dev_replace_free_srcdev outside of all locks
        btrfs: move btrfs_scratch_superblocks into btrfs_dev_replace_finishing
      4e3b9ce2
    • Linus Torvalds's avatar
      Merge tag 'pm-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · c5130911
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix one more issue related to the recent RCU-lockdep changes, a
        typo in documentation and add a missing return statement to
        intel_pstate.
      
        Specifics:
      
         - Fix up RCU usage for cpuidle on the ARM imx6q platform (Ulf
           Hansson)
      
         - Fix typo in the PM documentation (Yoann Congal)
      
         - Add return statement that is missing after recent changes in the
           intel_pstate driver (Zhang Rui)"
      
      * tag 'pm-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ARM: imx6q: Fixup RCU usage for cpuidle
        Documentation: PM: Fix a reStructuredText syntax error
        cpufreq: intel_pstate: Fix missing return statement
      c5130911
    • Linus Torvalds's avatar
      Merge tag 'staging-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · cc8ad8fa
      Linus Torvalds authored
      Pull IIO fixes from Greg KH:
       "Here are two small IIO driver fixes for 5.9-rc8 that resolve some
        reported issues:
      
         - driver name fixed in one driver
      
         - device name typo fixed
      
        Both have been in linux-next for a while with no reported problems"
      
      * tag 'staging-5.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio: adc: qcom-spmi-adc5: fix driver name
        iio: adc: ad7124: Fix typo in device name
      cc8ad8fa
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 0bf0dfda
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Some late GPIO fixes for the v5.9 series:
      
         - Fix compiler warnings on the OMAP when PM is disabled
      
         - Clear the interrupt when setting edge sensitivity on the Spreadtrum
           driver.
      
         - Fix up spurious interrupts on the TC35894.
      
         - Support threaded interrupts on the Siox controller.
      
         - Fix resource leaks on the mockup driver.
      
         - Fix line event handling in syscall compatible mode for the
           character device.
      
         - Fix an unitialized variable in the PCA953A driver.
      
         - Fix access to all GPIO IRQs on the Aspeed AST2600.
      
         - Fix line direction on the AMD FCH driver.
      
         - Use the bitmap API instead of compiler intrinsics for bit
           manipulation in the PCA953x driver"
      
      * tag 'gpio-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: pca953x: Correctly initialize registers 6 and 7 for PCA957x
        gpio: pca953x: Use bitmap API over implicit GCC extension
        gpio: amd-fch: correct logic of GPIO_LINE_DIRECTION
        gpio: aspeed: fix ast2600 bank properties
        gpio/aspeed-sgpio: don't enable all interrupts by default
        gpio/aspeed-sgpio: enable access to all 80 input & output sgpios
        gpio: pca953x: Fix uninitialized pending variable
        gpiolib: Fix line event handling in syscall compatible mode
        gpio: mockup: fix resource leak in error path
        gpio: siox: explicitly support only threaded irqs
        gpio: tc35894: fix up tc35894 interrupt configuration
        gpio: sprd: Clear interrupt when setting the type as edge
        gpio: omap: Fix warnings if PM is disabled
      0bf0dfda
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.9-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 2270b890
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
      
       - Fix deadlock when removing MEMSTICK host
      
       - Workaround broken CMDQ on Intel GLK based IRBIS models
      
      * tag 'mmc-v5.9-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models
        memstick: Skip allocating card when removing host
      2270b890
    • Thibaut Sautereau's avatar
      random32: Restore __latent_entropy attribute on net_rand_state · 09a6b0bc
      Thibaut Sautereau authored
      Commit f227e3ec ("random32: update the net random state on interrupt
      and activity") broke compilation and was temporarily fixed by Linus in
      83bdc727 ("random32: remove net_rand_state from the latent entropy
      gcc plugin") by entirely moving net_rand_state out of the things handled
      by the latent_entropy GCC plugin.
      
      From what I understand when reading the plugin code, using the
      __latent_entropy attribute on a declaration was the wrong part and
      simply keeping the __latent_entropy attribute on the variable definition
      was the correct fix.
      
      Fixes: 83bdc727 ("random32: remove net_rand_state from the latent entropy gcc plugin")
      Acked-by: default avatarWilly Tarreau <w@1wt.eu>
      Cc: Emese Revfy <re.emese@gmail.com>
      Signed-off-by: default avatarThibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      09a6b0bc
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpufreq' · 7bbe8f2a
      Rafael J. Wysocki authored
      * pm-cpufreq:
        cpufreq: intel_pstate: Fix missing return statement
      7bbe8f2a
    • Roman Gushchin's avatar
      mm: memcg/slab: fix slab statistics in !SMP configuration · be458311
      Roman Gushchin authored
      Since commit ea426c2a ("mm: memcg: prepare for byte-sized vmstat
      items") the write side of slab counters accepts a value in bytes and
      converts it to pages.  It happens in __mod_node_page_state().
      
      However a non-SMP version of __mod_node_page_state() doesn't perform
      this conversion.  It leads to incorrect (unrealistically high) slab
      counters values.  Fix this by adding a similar conversion to the non-SMP
      version of __mod_node_page_state().
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-and-tested-by: default avatarBastian Bittorf <bb@npl.de>
      Fixes: ea426c2a ("mm: memcg: prepare for byte-sized vmstat items")
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      be458311
    • Linus Torvalds's avatar
      pipe: remove pipe_wait() and fix wakeup race with splice · 472e5b05
      Linus Torvalds authored
      The pipe splice code still used the old model of waiting for pipe IO by
      using a non-specific "pipe_wait()" that waited for any pipe event to
      happen, which depended on all pipe IO being entirely serialized by the
      pipe lock.  So by checking the state you were waiting for, and then
      adding yourself to the wait queue before dropping the lock, you were
      guaranteed to see all the wakeups.
      
      Strictly speaking, the actual wakeups were not done under the lock, but
      the pipe_wait() model still worked, because since the waiter held the
      lock when checking whether it should sleep, it would always see the
      current state, and the wakeup was always done after updating the state.
      
      However, commit 0ddad21d ("pipe: use exclusive waits when reading or
      writing") split the single wait-queue into two, and in the process also
      made the "wait for event" code wait for _two_ wait queues, and that then
      showed a race with the wakers that were not serialized by the pipe lock.
      
      It's only splice that used that "pipe_wait()" model, so the problem
      wasn't obvious, but Josef Bacik reports:
      
       "I hit a hang with fstest btrfs/187, which does a btrfs send into
        /dev/null. This works by creating a pipe, the write side is given to
        the kernel to write into, and the read side is handed to a thread that
        splices into a file, in this case /dev/null.
      
        The box that was hung had the write side stuck here [pipe_write] and
        the read side stuck here [splice_from_pipe_next -> pipe_wait].
      
        [ more details about pipe_wait() scenario ]
      
        The problem is we're doing the prepare_to_wait, which sets our state
        each time, however we can be woken up either with reads or writes. In
        the case above we race with the WRITER waking us up, and re-set our
        state to INTERRUPTIBLE, and thus never break out of schedule"
      
      Josef had a patch that avoided the issue in pipe_wait() by just making
      it set the state only once, but the deeper problem is that pipe_wait()
      depends on a level of synchonization by the pipe mutex that it really
      shouldn't.  And the whole "wait for any pipe state change" model really
      isn't very good to begin with.
      
      So rather than trying to work around things in pipe_wait(), remove that
      legacy model of "wait for arbitrary pipe event" entirely, and actually
      create functions that wait for the pipe actually being readable or
      writable, and can do so without depending on the pipe lock serializing
      everything.
      
      Fixes: 0ddad21d ("pipe: use exclusive waits when reading or writing")
      Link: https://lore.kernel.org/linux-fsdevel/bfa88b5ad6f069b2b679316b9e495a970130416c.1601567868.git.josef@toxicpanda.com/Reported-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Reviewed-and-tested-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      472e5b05
  2. 01 Oct, 2020 9 commits
  3. 30 Sep, 2020 17 commits
    • Ard Biesheuvel's avatar
      arm64: permit ACPI core to map kernel memory used for table overrides · a509a66a
      Ard Biesheuvel authored
      Jonathan reports that the strict policy for memory mapped by the
      ACPI core breaks the use case of passing ACPI table overrides via
      initramfs. This is due to the fact that the memory type used for
      loading the initramfs in memory is not recognized as a memory type
      that is typically used by firmware to pass firmware tables.
      
      Since the purpose of the strict policy is to ensure that no AML or
      other ACPI code can manipulate any memory that is used by the kernel
      to keep its internal state or the state of user tasks, we can relax
      the permission check, and allow mappings of memory that is reserved
      and marked as NOMAP via memblock, and therefore not covered by the
      linear mapping to begin with.
      
      Fixes: 1583052d ("arm64/acpi: disallow AML memory opregions to access kernel memory")
      Fixes: 325f5585 ("arm64/acpi: disallow writeable AML opregion mapping for EFI code regions")
      Reported-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
      Tested-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Link: https://lore.kernel.org/r/20200929132522.18067-1-ardb@kernel.orgSigned-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      a509a66a
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 60e72093
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "Another batch of clk driver fixes:
      
         - Make sure DRAM and ChipID region doesn't get disabled on Exynos
      
         - Fix a SATA failure on Tegra
      
         - Fix the emac_ptp clk divider on stratix10"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk
        clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
        clk: tegra: Fix missing prototype for tegra210_clk_register_emc()
        clk: tegra: Always program PLL_E when enabled
        clk: tegra: Capitalization fixes
        clk: samsung: Keep top BPLL mux on Exynos542x enabled
      60e72093
    • Anup Patel's avatar
      RISC-V: Check clint_time_val before use · aa988760
      Anup Patel authored
      The NoMMU kernel is broken for QEMU virt machine from Linux-5.9-rc6
      because clint_time_val is used even before CLINT driver is probed
      at following places:
      1. rand_initialize() calls get_cycles() which in-turn uses
         clint_time_val
      2. boot_init_stack_canary() calls get_cycles() which in-turn
         uses clint_time_val
      
      The issue#1 (above) is fixed by providing custom random_get_entropy()
      for RISC-V NoMMU kernel. For issue#2 (above), we remove dependency of
      boot_init_stack_canary() on get_cycles() and this is aligned with the
      boot_init_stack_canary() implementations of ARM, ARM64 and MIPS kernel.
      
      Fixes: d5be89a8 ("RISC-V: Resurrect the MMIO timer implementation for M-mode systems")
      Signed-off-by: default avatarAnup Patel <anup.patel@wdc.com>
      Tested-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      aa988760
    • Filipe Manana's avatar
      btrfs: fix filesystem corruption after a device replace · 4c8f3532
      Filipe Manana authored
      We use a device's allocation state tree to track ranges in a device used
      for allocated chunks, and we set ranges in this tree when allocating a new
      chunk. However after a device replace operation, we were not setting the
      allocated ranges in the new device's allocation state tree, so that tree
      is empty after a device replace.
      
      This means that a fitrim operation after a device replace will trim the
      device ranges that have allocated chunks and extents, as we trim every
      range for which there is not a range marked in the device's allocation
      state tree. It is also important during chunk allocation, since the
      device's allocation state is used to determine if a range is already
      allocated when allocating a new chunk.
      
      This is trivial to reproduce and the following script triggers the bug:
      
        $ cat reproducer.sh
        #!/bin/bash
      
        DEV1="/dev/sdg"
        DEV2="/dev/sdh"
        DEV3="/dev/sdi"
      
        wipefs -a $DEV1 $DEV2 $DEV3 &> /dev/null
      
        # Create a raid1 test fs on 2 devices.
        mkfs.btrfs -f -m raid1 -d raid1 $DEV1 $DEV2 > /dev/null
        mount $DEV1 /mnt/btrfs
      
        xfs_io -f -c "pwrite -S 0xab 0 10M" /mnt/btrfs/foo
      
        echo "Starting to replace $DEV1 with $DEV3"
        btrfs replace start -B $DEV1 $DEV3 /mnt/btrfs
        echo
      
        echo "Running fstrim"
        fstrim /mnt/btrfs
        echo
      
        echo "Unmounting filesystem"
        umount /mnt/btrfs
      
        echo "Mounting filesystem in degraded mode using $DEV3 only"
        wipefs -a $DEV1 $DEV2 &> /dev/null
        mount -o degraded $DEV3 /mnt/btrfs
        if [ $? -ne 0 ]; then
                dmesg | tail
                echo
                echo "Failed to mount in degraded mode"
                exit 1
        fi
      
        echo
        echo "File foo data (expected all bytes = 0xab):"
        od -A d -t x1 /mnt/btrfs/foo
      
        umount /mnt/btrfs
      
      When running the reproducer:
      
        $ ./replace-test.sh
        wrote 10485760/10485760 bytes at offset 0
        10 MiB, 2560 ops; 0.0901 sec (110.877 MiB/sec and 28384.5216 ops/sec)
        Starting to replace /dev/sdg with /dev/sdi
      
        Running fstrim
      
        Unmounting filesystem
        Mounting filesystem in degraded mode using /dev/sdi only
        mount: /mnt/btrfs: wrong fs type, bad option, bad superblock on /dev/sdi, missing codepage or helper program, or other error.
        [19581.748641] BTRFS info (device sdg): dev_replace from /dev/sdg (devid 1) to /dev/sdi started
        [19581.803842] BTRFS info (device sdg): dev_replace from /dev/sdg (devid 1) to /dev/sdi finished
        [19582.208293] BTRFS info (device sdi): allowing degraded mounts
        [19582.208298] BTRFS info (device sdi): disk space caching is enabled
        [19582.208301] BTRFS info (device sdi): has skinny extents
        [19582.212853] BTRFS warning (device sdi): devid 2 uuid 1f731f47-e1bb-4f00-bfbb-9e5a0cb4ba9f is missing
        [19582.213904] btree_readpage_end_io_hook: 25839 callbacks suppressed
        [19582.213907] BTRFS error (device sdi): bad tree block start, want 30490624 have 0
        [19582.214780] BTRFS warning (device sdi): failed to read root (objectid=7): -5
        [19582.231576] BTRFS error (device sdi): open_ctree failed
      
        Failed to mount in degraded mode
      
      So fix by setting all allocated ranges in the replace target device when
      the replace operation is finishing, when we are holding the chunk mutex
      and we can not race with new chunk allocations.
      
      A test case for fstests follows soon.
      
      Fixes: 1c11b63e ("btrfs: replace pending/pinned chunks lists with io tree")
      CC: stable@vger.kernel.org # 5.2+
      Reviewed-by: default avatarNikolay Borisov <nborisov@suse.com>
      Reviewed-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
      Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      4c8f3532
    • Josef Bacik's avatar
      btrfs: move btrfs_rm_dev_replace_free_srcdev outside of all locks · a466c85e
      Josef Bacik authored
      When closing and freeing the source device we could end up doing our
      final blkdev_put() on the bdev, which will grab the bd_mutex.  As such
      we want to be holding as few locks as possible, so move this call
      outside of the dev_replace->lock_finishing_cancel_unmount lock.  Since
      we're modifying the fs_devices we need to make sure we're holding the
      uuid_mutex here, so take that as well.
      
      There's a report from syzbot probably hitting one of the cases where
      the bd_mutex and device_list_mutex are taken in the wrong order, however
      it's not with device replace, like this patch fixes. As there's no
      reproducer available so far, we can't verify the fix.
      
      https://lore.kernel.org/lkml/000000000000fc04d105afcf86d7@google.com/
      dashboard link: https://syzkaller.appspot.com/bug?extid=84a0634dc5d21d488419
      
        WARNING: possible circular locking dependency detected
        5.9.0-rc5-syzkaller #0 Not tainted
        ------------------------------------------------------
        syz-executor.0/6878 is trying to acquire lock:
        ffff88804c17d780 (&bdev->bd_mutex){+.+.}-{3:3}, at: blkdev_put+0x30/0x520 fs/block_dev.c:1804
      
        but task is already holding lock:
        ffff8880908cfce0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: close_fs_devices.part.0+0x2e/0x800 fs/btrfs/volumes.c:1159
      
        which lock already depends on the new lock.
      
        the existing dependency chain (in reverse order) is:
      
        -> #4 (&fs_devs->device_list_mutex){+.+.}-{3:3}:
      	 __mutex_lock_common kernel/locking/mutex.c:956 [inline]
      	 __mutex_lock+0x134/0x10e0 kernel/locking/mutex.c:1103
      	 btrfs_finish_chunk_alloc+0x281/0xf90 fs/btrfs/volumes.c:5255
      	 btrfs_create_pending_block_groups+0x2f3/0x700 fs/btrfs/block-group.c:2109
      	 __btrfs_end_transaction+0xf5/0x690 fs/btrfs/transaction.c:916
      	 find_free_extent_update_loop fs/btrfs/extent-tree.c:3807 [inline]
      	 find_free_extent+0x23b7/0x2e60 fs/btrfs/extent-tree.c:4127
      	 btrfs_reserve_extent+0x166/0x460 fs/btrfs/extent-tree.c:4206
      	 cow_file_range+0x3de/0x9b0 fs/btrfs/inode.c:1063
      	 btrfs_run_delalloc_range+0x2cf/0x1410 fs/btrfs/inode.c:1838
      	 writepage_delalloc+0x150/0x460 fs/btrfs/extent_io.c:3439
      	 __extent_writepage+0x441/0xd00 fs/btrfs/extent_io.c:3653
      	 extent_write_cache_pages.constprop.0+0x69d/0x1040 fs/btrfs/extent_io.c:4249
      	 extent_writepages+0xcd/0x2b0 fs/btrfs/extent_io.c:4370
      	 do_writepages+0xec/0x290 mm/page-writeback.c:2352
      	 __writeback_single_inode+0x125/0x1400 fs/fs-writeback.c:1461
      	 writeback_sb_inodes+0x53d/0xf40 fs/fs-writeback.c:1721
      	 wb_writeback+0x2ad/0xd40 fs/fs-writeback.c:1894
      	 wb_do_writeback fs/fs-writeback.c:2039 [inline]
      	 wb_workfn+0x2dc/0x13e0 fs/fs-writeback.c:2080
      	 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
      	 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
      	 kthread+0x3b5/0x4a0 kernel/kthread.c:292
      	 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
      
        -> #3 (sb_internal#2){.+.+}-{0:0}:
      	 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
      	 __sb_start_write+0x234/0x470 fs/super.c:1672
      	 sb_start_intwrite include/linux/fs.h:1690 [inline]
      	 start_transaction+0xbe7/0x1170 fs/btrfs/transaction.c:624
      	 find_free_extent_update_loop fs/btrfs/extent-tree.c:3789 [inline]
      	 find_free_extent+0x25e1/0x2e60 fs/btrfs/extent-tree.c:4127
      	 btrfs_reserve_extent+0x166/0x460 fs/btrfs/extent-tree.c:4206
      	 cow_file_range+0x3de/0x9b0 fs/btrfs/inode.c:1063
      	 btrfs_run_delalloc_range+0x2cf/0x1410 fs/btrfs/inode.c:1838
      	 writepage_delalloc+0x150/0x460 fs/btrfs/extent_io.c:3439
      	 __extent_writepage+0x441/0xd00 fs/btrfs/extent_io.c:3653
      	 extent_write_cache_pages.constprop.0+0x69d/0x1040 fs/btrfs/extent_io.c:4249
      	 extent_writepages+0xcd/0x2b0 fs/btrfs/extent_io.c:4370
      	 do_writepages+0xec/0x290 mm/page-writeback.c:2352
      	 __writeback_single_inode+0x125/0x1400 fs/fs-writeback.c:1461
      	 writeback_sb_inodes+0x53d/0xf40 fs/fs-writeback.c:1721
      	 wb_writeback+0x2ad/0xd40 fs/fs-writeback.c:1894
      	 wb_do_writeback fs/fs-writeback.c:2039 [inline]
      	 wb_workfn+0x2dc/0x13e0 fs/fs-writeback.c:2080
      	 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
      	 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
      	 kthread+0x3b5/0x4a0 kernel/kthread.c:292
      	 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
      
        -> #2 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}:
      	 __flush_work+0x60e/0xac0 kernel/workqueue.c:3041
      	 wb_shutdown+0x180/0x220 mm/backing-dev.c:355
      	 bdi_unregister+0x174/0x590 mm/backing-dev.c:872
      	 del_gendisk+0x820/0xa10 block/genhd.c:933
      	 loop_remove drivers/block/loop.c:2192 [inline]
      	 loop_control_ioctl drivers/block/loop.c:2291 [inline]
      	 loop_control_ioctl+0x3b1/0x480 drivers/block/loop.c:2257
      	 vfs_ioctl fs/ioctl.c:48 [inline]
      	 __do_sys_ioctl fs/ioctl.c:753 [inline]
      	 __se_sys_ioctl fs/ioctl.c:739 [inline]
      	 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
      	 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
      	 entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
        -> #1 (loop_ctl_mutex){+.+.}-{3:3}:
      	 __mutex_lock_common kernel/locking/mutex.c:956 [inline]
      	 __mutex_lock+0x134/0x10e0 kernel/locking/mutex.c:1103
      	 lo_open+0x19/0xd0 drivers/block/loop.c:1893
      	 __blkdev_get+0x759/0x1aa0 fs/block_dev.c:1507
      	 blkdev_get fs/block_dev.c:1639 [inline]
      	 blkdev_open+0x227/0x300 fs/block_dev.c:1753
      	 do_dentry_open+0x4b9/0x11b0 fs/open.c:817
      	 do_open fs/namei.c:3251 [inline]
      	 path_openat+0x1b9a/0x2730 fs/namei.c:3368
      	 do_filp_open+0x17e/0x3c0 fs/namei.c:3395
      	 do_sys_openat2+0x16d/0x420 fs/open.c:1168
      	 do_sys_open fs/open.c:1184 [inline]
      	 __do_sys_open fs/open.c:1192 [inline]
      	 __se_sys_open fs/open.c:1188 [inline]
      	 __x64_sys_open+0x119/0x1c0 fs/open.c:1188
      	 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
      	 entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
        -> #0 (&bdev->bd_mutex){+.+.}-{3:3}:
      	 check_prev_add kernel/locking/lockdep.c:2496 [inline]
      	 check_prevs_add kernel/locking/lockdep.c:2601 [inline]
      	 validate_chain kernel/locking/lockdep.c:3218 [inline]
      	 __lock_acquire+0x2a96/0x5780 kernel/locking/lockdep.c:4426
      	 lock_acquire+0x1f3/0xae0 kernel/locking/lockdep.c:5006
      	 __mutex_lock_common kernel/locking/mutex.c:956 [inline]
      	 __mutex_lock+0x134/0x10e0 kernel/locking/mutex.c:1103
      	 blkdev_put+0x30/0x520 fs/block_dev.c:1804
      	 btrfs_close_bdev fs/btrfs/volumes.c:1117 [inline]
      	 btrfs_close_bdev fs/btrfs/volumes.c:1107 [inline]
      	 btrfs_close_one_device fs/btrfs/volumes.c:1133 [inline]
      	 close_fs_devices.part.0+0x1a4/0x800 fs/btrfs/volumes.c:1161
      	 close_fs_devices fs/btrfs/volumes.c:1193 [inline]
      	 btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
      	 close_ctree+0x688/0x6cb fs/btrfs/disk-io.c:4149
      	 generic_shutdown_super+0x144/0x370 fs/super.c:464
      	 kill_anon_super+0x36/0x60 fs/super.c:1108
      	 btrfs_kill_super+0x38/0x50 fs/btrfs/super.c:2265
      	 deactivate_locked_super+0x94/0x160 fs/super.c:335
      	 deactivate_super+0xad/0xd0 fs/super.c:366
      	 cleanup_mnt+0x3a3/0x530 fs/namespace.c:1118
      	 task_work_run+0xdd/0x190 kernel/task_work.c:141
      	 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
      	 exit_to_user_mode_loop kernel/entry/common.c:163 [inline]
      	 exit_to_user_mode_prepare+0x1e1/0x200 kernel/entry/common.c:190
      	 syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:265
      	 entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
        other info that might help us debug this:
      
        Chain exists of:
          &bdev->bd_mutex --> sb_internal#2 --> &fs_devs->device_list_mutex
      
         Possible unsafe locking scenario:
      
      	 CPU0                    CPU1
      	 ----                    ----
          lock(&fs_devs->device_list_mutex);
      				 lock(sb_internal#2);
      				 lock(&fs_devs->device_list_mutex);
          lock(&bdev->bd_mutex);
      
         *** DEADLOCK ***
      
        3 locks held by syz-executor.0/6878:
         #0: ffff88809070c0e0 (&type->s_umount_key#70){++++}-{3:3}, at: deactivate_super+0xa5/0xd0 fs/super.c:365
         #1: ffffffff8a5b37a8 (uuid_mutex){+.+.}-{3:3}, at: btrfs_close_devices+0x23/0x1f0 fs/btrfs/volumes.c:1178
         #2: ffff8880908cfce0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: close_fs_devices.part.0+0x2e/0x800 fs/btrfs/volumes.c:1159
      
        stack backtrace:
        CPU: 0 PID: 6878 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
        Call Trace:
         __dump_stack lib/dump_stack.c:77 [inline]
         dump_stack+0x198/0x1fd lib/dump_stack.c:118
         check_noncircular+0x324/0x3e0 kernel/locking/lockdep.c:1827
         check_prev_add kernel/locking/lockdep.c:2496 [inline]
         check_prevs_add kernel/locking/lockdep.c:2601 [inline]
         validate_chain kernel/locking/lockdep.c:3218 [inline]
         __lock_acquire+0x2a96/0x5780 kernel/locking/lockdep.c:4426
         lock_acquire+0x1f3/0xae0 kernel/locking/lockdep.c:5006
         __mutex_lock_common kernel/locking/mutex.c:956 [inline]
         __mutex_lock+0x134/0x10e0 kernel/locking/mutex.c:1103
         blkdev_put+0x30/0x520 fs/block_dev.c:1804
         btrfs_close_bdev fs/btrfs/volumes.c:1117 [inline]
         btrfs_close_bdev fs/btrfs/volumes.c:1107 [inline]
         btrfs_close_one_device fs/btrfs/volumes.c:1133 [inline]
         close_fs_devices.part.0+0x1a4/0x800 fs/btrfs/volumes.c:1161
         close_fs_devices fs/btrfs/volumes.c:1193 [inline]
         btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
         close_ctree+0x688/0x6cb fs/btrfs/disk-io.c:4149
         generic_shutdown_super+0x144/0x370 fs/super.c:464
         kill_anon_super+0x36/0x60 fs/super.c:1108
         btrfs_kill_super+0x38/0x50 fs/btrfs/super.c:2265
         deactivate_locked_super+0x94/0x160 fs/super.c:335
         deactivate_super+0xad/0xd0 fs/super.c:366
         cleanup_mnt+0x3a3/0x530 fs/namespace.c:1118
         task_work_run+0xdd/0x190 kernel/task_work.c:141
         tracehook_notify_resume include/linux/tracehook.h:188 [inline]
         exit_to_user_mode_loop kernel/entry/common.c:163 [inline]
         exit_to_user_mode_prepare+0x1e1/0x200 kernel/entry/common.c:190
         syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:265
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        RIP: 0033:0x460027
        RSP: 002b:00007fff59216328 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
        RAX: 0000000000000000 RBX: 0000000000076035 RCX: 0000000000460027
        RDX: 0000000000403188 RSI: 0000000000000002 RDI: 00007fff592163d0
        RBP: 0000000000000333 R08: 0000000000000000 R09: 000000000000000b
        R10: 0000000000000005 R11: 0000000000000246 R12: 00007fff59217460
        R13: 0000000002df2a60 R14: 0000000000000000 R15: 00007fff59217460
      Signed-off-by: default avatarJosef Bacik <josef@toxicpanda.com>
      [ add syzbot reference ]
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      a466c85e
    • Ulf Hansson's avatar
      ARM: imx6q: Fixup RCU usage for cpuidle · 1a67b926
      Ulf Hansson authored
      The commit eb1f0023 ("lockdep,trace: Expose tracepoints"), started to
      expose us for tracepoints. For imx6q cpuidle, this leads to an RCU splat
      according to below.
      
      [6.870684] [<c0db7690>] (_raw_spin_lock) from [<c011f6a4>] (imx6q_enter_wait+0x18/0x9c)
      [6.878846] [<c011f6a4>] (imx6q_enter_wait) from [<c09abfb0>] (cpuidle_enter_state+0x168/0x5e4)
      
      To fix the problem, let's assign the corresponding idlestate->flags the
      CPUIDLE_FLAG_RCU_IDLE bit, which enables us to call rcu_idle_enter|exit()
      at the proper point.
      Reported-by: default avatarDong Aisheng <aisheng.dong@nxp.com>
      Suggested-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      1a67b926
    • Yoann Congal's avatar
      Documentation: PM: Fix a reStructuredText syntax error · eac53b3e
      Yoann Congal authored
      Fix a reStructuredText syntax error in the cpuidle PM admin-guide
      documentation: the ``...'' quotation marks are parsed as partial ''...''
      reStructuredText markup and break the output formatting.
      
      This change them to "...".
      Signed-off-by: default avatarYoann Congal <yoann.congal@smile.fr>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      eac53b3e
    • Zhang Rui's avatar
      cpufreq: intel_pstate: Fix missing return statement · fc7d1755
      Zhang Rui authored
      Fix missing return statement when writing "off" to intel_pstate status
      sysfs I/F.
      
      Fixes: 55671ea3 ("cpufreq: intel_pstate: Free memory only when turning off")
      Signed-off-by: default avatarZhang Rui <rui.zhang@intel.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      fc7d1755
    • Jiansong Chen's avatar
      drm/amdgpu: disable gfxoff temporarily for navy_flounder · 95433a13
      Jiansong Chen authored
      gfxoff is temporarily disabled for navy_flounder, since
      at present the feature caused some tdr when performing
      display operations.
      Signed-off-by: default avatarJiansong Chen <Jiansong.Chen@amd.com>
      Reviewed-by: default avatarTao Zhou <tao.zhou1@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      95433a13
    • Evan Quan's avatar
      drm/amd/pm: setup APU dpm clock table in SMU HW initialization · b1951525
      Evan Quan authored
      As the dpm clock table is needed during DC HW initialization.
      And that (DC HW initialization) comes before smu_late_init()
      where current APU dpm clock table setup is performed. So, NULL
      pointer dereference will be triggered. By moving APU dpm clock
      table setup to smu_hw_init(), this can be avoided.
      
      Fixes: 02cf91c1 ("drm/amd/powerplay: postpone operations not required for hw setup to late_init")
      Acked-by: default avatarNirmoy Das <nirmoy.das@amd.com>
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarEvan Quan <evan.quan@amd.com>
      Reported-by: default avatarDirk Gouders <dirk@gouders.net>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      b1951525
    • Linus Walleij's avatar
      Merge tag 'gpio-fixes-for-v5.9' of... · 17479aa3
      Linus Walleij authored
      Merge tag 'gpio-fixes-for-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes
      
      gpio fixes for v5.9
      
      - correct logic of GPIO_LINE_DIRECTION in gpio-amd-fch
      17479aa3
    • Palmer Dabbelt's avatar
      clocksource: clint: Export clint_time_val for modules · c14decfc
      Palmer Dabbelt authored
      clint_time_val will soon be used by the RISC-V implementation of
      random_get_entropy(), which is a static inline function that may be used by
      modules (at least CRYPTO_JITTERENTROPY=m).
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      c14decfc
    • Dave Airlie's avatar
      Merge branch 'vmwgfx-fixes-5.9' of git://people.freedesktop.org/~sroland/linux into drm-fixes · 6f4fc18f
      Dave Airlie authored
      One vmwgfx regression fix.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: "Roland Scheidegger (VMware)" <rscheidegger.oss@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200930041000.2423-1-rscheidegger.oss@gmail.com
      6f4fc18f
    • Zack Rusin's avatar
      drm/vmwgfx: Fix error handling in get_node · f54c4442
      Zack Rusin authored
      ttm_mem_type_manager_func.get_node was changed to return -ENOSPC
      instead of setting the node pointer to NULL. Unfortunately
      vmwgfx still had two places where it was explicitly converting
      -ENOSPC to 0 causing regressions. This fixes those spots by
      allowing -ENOSPC to be returned. That seems to fix recent
      regressions with vmwgfx.
      Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
      Reviewed-by: default avatarRoland Scheidegger <sroland@vmware.com>
      Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
      Sigend-off-by: default avatarRoland Scheidegger <sroland@vmware.com>
      f54c4442
    • Mark Mielke's avatar
      scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername() · bcf3a295
      Mark Mielke authored
      The kernel may fail to boot or devices may fail to come up when
      initializing iscsi_tcp devices starting with Linux 5.8.
      
      Commit a79af8a6 ("[SCSI] iscsi_tcp: use iscsi_conn_get_addr_param
      libiscsi function") introduced getpeername() within the session spinlock.
      
      Commit 1b66d253 ("bpf: Add get{peer, sock}name attach types for
      sock_addr") introduced BPF_CGROUP_RUN_SA_PROG_LOCK() within getpeername(),
      which acquires a mutex and when used from iscsi_tcp devices can now lead to
      "BUG: scheduling while atomic:" and subsequent damage.
      
      Ensure that the spinlock is released before calling getpeername() or
      getsockname(). sock_hold() and sock_put() are used to ensure that the
      socket reference is preserved until after the getpeername() or
      getsockname() complete.
      
      Link: https://bugzilla.redhat.com/show_bug.cgi?id=1877345
      Link: https://lkml.org/lkml/2020/7/28/1085
      Link: https://lkml.org/lkml/2020/8/31/459
      Link: https://lore.kernel.org/r/20200928043329.606781-1-mark.mielke@gmail.com
      Fixes: a79af8a6 ("[SCSI] iscsi_tcp: use iscsi_conn_get_addr_param libiscsi function")
      Fixes: 1b66d253 ("bpf: Add get{peer, sock}name attach types for sock_addr")
      Cc: stable@vger.kernel.org
      Reported-by: default avatarMarc Dionne <marc.c.dionne@gmail.com>
      Tested-by: default avatarMarc Dionne <marc.c.dionne@gmail.com>
      Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
      Signed-off-by: default avatarMark Mielke <mark.mielke@gmail.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      bcf3a295
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-5.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · 02de58b2
      Linus Torvalds authored
      Pull devicetree fixes from Rob Herring:
      
       - Fix handling of HOST_EXTRACFLAGS for dtc
      
       - Several warning fixes for DT bindings
      
      * tag 'devicetree-fixes-for-5.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting
        dt-bindings: Fix 'reg' size issues in zynqmp examples
        ARM: dts: bcm2835: Change firmware compatible from simple-bus to simple-mfd
        dt-bindings: leds: cznic,turris-omnia-leds: fix error in binding
        dt-bindings: crypto: sa2ul: fix a DT binding check warning
      02de58b2
    • Linus Torvalds's avatar
      autofs: use __kernel_write() for the autofs pipe writing · 90fb7027
      Linus Torvalds authored
      autofs got broken in some configurations by commit 13c164b1
      ("autofs: switch to kernel_write") because there is now an extra LSM
      permission check done by security_file_permission() in rw_verify_area().
      
      autofs is one if the few places that really does want the much more
      limited __kernel_write(), because the write is an internal kernel one
      that shouldn't do any user permission checks (it also doesn't need the
      file_start_write/file_end_write logic, since it's just a pipe).
      
      There are a couple of other cases like that - accounting, core dumping,
      and splice - but autofs stands out because it can be built as a module.
      
      As a result, we need to export this internal __kernel_write() function
      again.
      
      We really don't want any other module to use this, but we don't have a
      "EXPORT_SYMBOL_FOR_AUTOFS_ONLY()".  But we can mark it GPL-only to at
      least approximate that "internal use only" for licensing.
      
      While in this area, make autofs pass in NULL for the file position
      pointer, since it's always a pipe, and we now use a NULL file pointer
      for streaming file descriptors (see file_ppos() and commit 438ab720:
      "vfs: pass ppos=NULL to .read()/.write() of FMODE_STREAM files")
      
      This effectively reverts commits 9db97752 ("fs: unexport
      __kernel_write") and 13c164b1 ("autofs: switch to kernel_write").
      
      Fixes: 13c164b1 ("autofs: switch to kernel_write")
      Reported-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
      Acked-by: default avatarChristoph Hellwig <hch@lst.de>
      Acked-by: default avatarAcked-by: Ian Kent <raven@themaw.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      90fb7027