when we create a kthread with ktrhead_create_on_cpu(),the child thread
entry is ktread.c:ktrhead() which will be preempted by the parent after
call complete(done) while schedule() is not called yet,then the parent
will call wait_task_inactive(child) but the child is still on the runqueue,
so the parent will schedule_hrtimeout() for 1 jiffy,it will waste a lot of
time,especially on startup.
parent child
ktrhead_create_on_cpu()
wait_fo_completion(&done) -----> ktread.c:ktrhead()
|----- complete(done);--wakeup and preempted by parent
kthread_bind() <------------| |-> schedule();--dequeue here
wait_task_inactive(child) |
schedule_hrtimeout(1 jiffy) -|
So we hope the child just wakeup parent but not preempted by parent, and the
child is going to call schedule() soon,then the parent will not call
schedule_hrtimeout(1 jiffy) as the child is already dequeue.
The same issue for ktrhead_park()&&kthread_parkme().
This patch can save 120ms on rk312x startup with CONFIG_HZ=300.
Signed-off-by: Liang Chen <cl@rock-chips.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Link: https://lkml.kernel.org/r/20200306070133.18335-2-cl@rock-chips.com
Bug: 163398263
(cherry picked from commit 26c7295be0c5e6da3fa45970e9748be983175b1b)
Change-Id: I4d3dd1af2c640a2f3d57af528532da23e00db194
It's already enabled in arm64 gki_defconfig by virtue of other
dependancies dragging it in, but enable it in x86 gki_defconfig to
provide good code coverage.
Bug: 163379072
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I26707e49046888e9d4b607e4b6d7766610cedfa1
Leaf changes summary: 21 artifacts changed (1 filtered out)
Changed leaf types summary: 2 (1 filtered out) leaf types changed
Removed/Changed/Added functions summary: 0 Removed, 19 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
19 functions with some sub-type change:
[C] 'function int ufshcd_crypto_cap_find(ufs_hba*, blk_crypto_mode_num, unsigned int)' at ufshcd-crypto.c:40:1 has some sub-type changes:
CRC value (modversions) changed from 0x66bb6e3c to 0xdf5be4ed
[C] 'function void ufshcd_crypto_disable_spec(ufs_hba*)' at ufshcd-crypto.c:250:1 has some sub-type changes:
CRC value (modversions) changed from 0x4d38f061 to 0x2c937f4d
[C] 'function void ufshcd_crypto_enable_spec(ufs_hba*)' at ufshcd-crypto.c:238:1 has some sub-type changes:
CRC value (modversions) changed from 0x2ec41648 to 0x3e4398d8
[C] 'function int ufshcd_dme_get_attr(ufs_hba*, unsigned int, unsigned int*, unsigned char)' at ufshcd.h:1004:1 has some sub-type changes:
CRC value (modversions) changed from 0xc8a30bfe to 0x91b23c09
[C] 'function int ufshcd_dme_set_attr(ufs_hba*, unsigned int, unsigned char, unsigned int, unsigned char)' at ufshcd.h:1002:1 has some sub-type changes:
CRC value (modversions) changed from 0x6e8f8104 to 0xe521b7d4
[C] 'function int ufshcd_dump_regs(ufs_hba*, size_t, size_t, const char*)' at ufshcd.c:124:1 has some sub-type changes:
CRC value (modversions) changed from 0xf884730c to 0xafacb437
[C] 'function u32 ufshcd_get_local_unipro_ver(ufs_hba*)' at ufshcd.c:947:1 has some sub-type changes:
CRC value (modversions) changed from 0xa4115536 to 0x5ba29f1
[C] 'function int ufshcd_hold(ufs_hba*, bool)' at ufshcd.c:1628:1 has some sub-type changes:
CRC value (modversions) changed from 0xdd0150bd to 0x2c3b45af
[C] 'function int ufshcd_pltfrm_init(platform_device*, const ufs_hba_variant_ops*)' at ufshcd-pltfrm.h:31:1 has some sub-type changes:
CRC value (modversions) changed from 0x8b5a0527 to 0x6a553691
[C] 'function int ufshcd_query_attr(ufs_hba*, query_opcode, attr_idn, u8, u8, u32*)' at ufshcd.c:3011:1 has some sub-type changes:
CRC value (modversions) changed from 0x7e1e7dca to 0xdb7ff407
[C] 'function int ufshcd_query_descriptor_retry(ufs_hba*, query_opcode, desc_idn, u8, u8, u8*, int*)' at ufshcd.c:3180:1 has some sub-type changes:
CRC value (modversions) changed from 0x38291d4f to 0xd93e04d3
[C] 'function int ufshcd_query_flag(ufs_hba*, query_opcode, flag_idn, u8, bool*)' at ufshcd.c:2941:1 has some sub-type changes:
CRC value (modversions) changed from 0x8fbcc248 to 0xbfcc001a
[C] 'function void ufshcd_release(ufs_hba*)' at ufshcd.c:1804:1 has some sub-type changes:
CRC value (modversions) changed from 0xa73a71b3 to 0x8d3a4fd
[C] 'function void ufshcd_remove(ufs_hba*)' at ufshcd.h:947:1 has some sub-type changes:
CRC value (modversions) changed from 0xf320631d to 0x2c8e8662
[C] 'function int ufshcd_shutdown(ufs_hba*)' at ufshcd.h:1001:1 has some sub-type changes:
CRC value (modversions) changed from 0x1da80ce1 to 0x75c9a638
[C] 'function int ufshcd_system_resume(ufs_hba*)' at ufshcd.h:1000:1 has some sub-type changes:
CRC value (modversions) changed from 0xe1cdb47c to 0xc0522ea
[C] 'function int ufshcd_system_suspend(ufs_hba*)' at ufshcd.h:999:1 has some sub-type changes:
CRC value (modversions) changed from 0x3a6991b9 to 0xde7f1ce5
[C] 'function int ufshcd_uic_hibern8_enter(ufs_hba*)' at ufshcd.c:4080:1 has some sub-type changes:
CRC value (modversions) changed from 0x81575439 to 0xbc0c783f
[C] 'function int ufshcd_uic_hibern8_exit(ufs_hba*)' at ufshcd.c:4104:1 has some sub-type changes:
CRC value (modversions) changed from 0x69bd2d57 to 0x6e341295
'struct ufs_hba at ufshcd.h:599:1' changed:
type size changed from 32000 to 32192 (in bits)
2 data member insertions:
'workqueue_struct* ufs_hba::eh_wq', at offset 3264 (in bits) at ufshcd.h:760:1
'bool ufs_hba::force_reset', at offset 15296 (in bits) at ufshcd.h:770:1
there are data member changes:
'work_struct ufs_hba::eh_work' offset changed from 3264 to 3328 (in bits) (by +64 bits)
'work_struct ufs_hba::eeh_work' offset changed from 3648 to 3712 (in bits) (by +64 bits)
'u32 ufs_hba::errors' offset changed from 4032 to 4096 (in bits) (by +64 bits)
'u32 ufs_hba::uic_error' offset changed from 4064 to 4128 (in bits) (by +64 bits)
'u32 ufs_hba::saved_err' offset changed from 4096 to 4160 (in bits) (by +64 bits)
'u32 ufs_hba::saved_uic_err' offset changed from 4128 to 4192 (in bits) (by +64 bits)
type 'struct ufs_stats' of 'ufs_hba::ufs_stats' changed:
type size changed from 10944 to 11072 (in bits)
2 data member insertions:
'u32 ufs_stats::last_intr_status', at offset 0 (in bits) at ufshcd.h:517:1
'ktime_t ufs_stats::last_intr_ts', at offset 64 (in bits) at ufshcd.h:518:1
there are data member changes:
'u32 ufs_stats::hibern8_exit_cnt' offset changed from 0 to 128 (in bits) (by +128 bits)
'ktime_t ufs_stats::last_hibern8_exit_tstamp' offset changed from 64 to 192 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::pa_err' offset changed from 128 to 256 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::dl_err' offset changed from 960 to 1088 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::nl_err' offset changed from 1792 to 1920 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::tl_err' offset changed from 2624 to 2752 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::dme_err' offset changed from 3456 to 3584 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::auto_hibern8_err' offset changed from 4288 to 4416 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::fatal_err' offset changed from 5120 to 5248 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::link_startup_err' offset changed from 5952 to 6080 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::resume_err' offset changed from 6784 to 6912 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::suspend_err' offset changed from 7616 to 7744 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::dev_reset' offset changed from 8448 to 8576 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::host_reset' offset changed from 9280 to 9408 (in bits) (by +128 bits)
'ufs_err_reg_hist ufs_stats::task_abort' offset changed from 10112 to 10240 (in bits) (by +128 bits)
19 impacted interfaces
and offset changed from 4160 to 4224 (in bits) (by +64 bits)
'bool ufs_hba::silence_err_logs' offset changed from 15104 to 15304 (in bits) (by +200 bits)
'ufs_dev_cmd ufs_hba::dev_cmd' offset changed from 15168 to 15360 (in bits) (by +192 bits)
'ktime_t ufs_hba::last_dme_cmd_tstamp' offset changed from 16192 to 16384 (in bits) (by +192 bits)
'ufs_dev_info ufs_hba::dev_info' offset changed from 16256 to 16448 (in bits) (by +192 bits)
'bool ufs_hba::auto_bkops_enabled' offset changed from 16576 to 16768 (in bits) (by +192 bits)
'ufs_vreg_info ufs_hba::vreg_info' offset changed from 16640 to 16832 (in bits) (by +192 bits)
'list_head ufs_hba::clk_list_head' offset changed from 16896 to 17088 (in bits) (by +192 bits)
'bool ufs_hba::wlun_dev_clr_ua' offset changed from 17024 to 17216 (in bits) (by +192 bits)
'int ufs_hba::req_abort_count' offset changed from 17056 to 17248 (in bits) (by +192 bits)
'u32 ufs_hba::lanes_per_direction' offset changed from 17088 to 17280 (in bits) (by +192 bits)
'ufs_pa_layer_attr ufs_hba::pwr_info' offset changed from 17120 to 17312 (in bits) (by +192 bits)
'ufs_pwr_mode_info ufs_hba::max_pwr_info' offset changed from 17344 to 17536 (in bits) (by +192 bits)
'ufs_clk_gating ufs_hba::clk_gating' offset changed from 17600 to 17792 (in bits) (by +192 bits)
'u32 ufs_hba::caps' offset changed from 19904 to 20096 (in bits) (by +192 bits)
'devfreq* ufs_hba::devfreq' offset changed from 19968 to 20160 (in bits) (by +192 bits)
'ufs_clk_scaling ufs_hba::clk_scaling' offset changed from 20032 to 20224 (in bits) (by +192 bits)
'bool ufs_hba::is_sys_suspended' offset changed from 21696 to 21888 (in bits) (by +192 bits)
'bkops_status ufs_hba::urgent_bkops_lvl' offset changed from 21728 to 21920 (in bits) (by +192 bits)
'bool ufs_hba::is_urgent_bkops_lvl_checked' offset changed from 21760 to 21952 (in bits) (by +192 bits)
'rw_semaphore ufs_hba::clk_scaling_lock' offset changed from 21824 to 22016 (in bits) (by +192 bits)
'ufs_desc_size ufs_hba::desc_size' offset changed from 22144 to 22336 (in bits) (by +192 bits)
'atomic_t ufs_hba::scsi_block_reqs_cnt' offset changed from 22368 to 22560 (in bits) (by +192 bits)
'device ufs_hba::bsg_dev' offset changed from 22400 to 22592 (in bits) (by +192 bits)
'request_queue* ufs_hba::bsg_queue' offset changed from 29760 to 29952 (in bits) (by +192 bits)
'ufs_crypto_capabilities ufs_hba::crypto_capabilities' offset changed from 29824 to 30016 (in bits) (by +192 bits)
'ufs_crypto_cap_entry* ufs_hba::crypto_cap_array' offset changed from 29888 to 30080 (in bits) (by +192 bits)
'u32 ufs_hba::crypto_cfg_register' offset changed from 29952 to 30144 (in bits) (by +192 bits)
'keyslot_manager* ufs_hba::ksm' offset changed from 30016 to 30208 (in bits) (by +192 bits)
'void* ufs_hba::crypto_DO_NOT_USE[8]' offset changed from 30080 to 30272 (in bits) (by +192 bits)
'bool ufs_hba::wb_buf_flush_enabled' offset changed from 30592 to 30784 (in bits) (by +192 bits)
'bool ufs_hba::wb_enabled' offset changed from 30600 to 30792 (in bits) (by +192 bits)
'delayed_work ufs_hba::rpm_dev_flush_recheck_work' offset changed from 30656 to 30848 (in bits) (by +192 bits)
'u64 ufs_hba::android_kabi_reserved1' offset changed from 31744 to 31936 (in bits) (by +192 bits)
'u64 ufs_hba::android_kabi_reserved2' offset changed from 31808 to 32000 (in bits) (by +192 bits)
'u64 ufs_hba::android_kabi_reserved3' offset changed from 31872 to 32064 (in bits) (by +192 bits)
'u64 ufs_hba::android_kabi_reserved4' offset changed from 31936 to 32128 (in bits) (by +192 bits)
19 impacted interfaces
'struct ufs_stats at ufshcd.h:509:1' changed:
details were reported earlier
Bug: 165343119
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Ib28519365126f83131793b8738d62e06b3f16ad5
In current UFS task abort hook, namely ufshcd_abort(), if one task is
aborted successfully, clk_gating.active_reqs held by this task is not
decreased, which makes clk_gating.active_reqs stay above zero forever, thus
clock gating would never happen. Instead of releasing resources of one task
"manually", use the existing func __ufshcd_transfer_req_compl(). This
change also eliminates a possible race of scsi_dma_unmap() from the real
completion in IRQ handler path.
Link: https://lore.kernel.org/r/1596975355-39813-10-git-send-email-cang@codeaurora.org
Fixes: 5a0b0cb9be ("ufs: Add support for clock gating")
CC: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 35afe60929abd61567f48608e55f5987c6fd1aa0
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: Ief56863c07fc9b7983d48a4ab91916ffc0b07b14
[can: Resolved minor conflict in ufshcd_abort()]
Signed-off-by: Can Guo <cang@codeaurora.org>
The current IRQ handler blocks SCSI requests before scheduling eh_work,
when error handler calls pm_runtime_get_sync, if ufshcd_suspend/resume
sends a SCSI cmd, most likely the SSU cmd, since SCSI requests are blocked,
pm_runtime_get_sync() will never return because ufshcd_suspend/resume is
blocked by the SCSI cmd.
- In queuecommand path, hba->ufshcd_state check and ufshcd_send_command
should stay under the same spin lock. This is to make sure that no more
commands leak into doorbell after hba->ufshcd_state is changed.
- Don't block SCSI requests before error handler starts to run, let error
handler block SCSI requests when it is ready to start error recovery.
- Don't let SCSI layer keep requeuing the SCSI cmds sent from HBA runtime
PM ops, let them pass or fail them. Let them pass if eh_work is
scheduled due to non-fatal errors. Fail them if eh_work is scheduled due
to fatal errors, otherwise the cmds may eventually time out since UFS is
in bad state, which gets error handler blocked for too long. If we fail
the SCSI cmds sent from HBA runtime PM ops, HBA runtime PM ops fails
too, but it does not hurt since error handler can recover HBA runtime PM
error.
Link: https://lore.kernel.org/r/1596975355-39813-9-git-send-email-cang@codeaurora.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 5586dd8ea250ab0851caeab6f461a9dbf57c806f
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I7a0e563e47c28f7cf61c88485e5907d6d1d9ab02
[can: Resolved minor conflicts in queuecommand and err_handler]
Signed-off-by: Can Guo <cang@codeaurora.org>
Performing dumps in the IRQ handler causes system stability issues. Move
dumps to the error handler and only print basic host registers here.
Link: https://lore.kernel.org/r/1596975355-39813-8-git-send-email-cang@codeaurora.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit c3be8d1ee1bff7c6f7e588d2a87f076148f40326
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I8ab59f56cb44d3b31c493c775377ffb579d57d85
Signed-off-by: Can Guo <cang@codeaurora.org>
The current error handler can not recover HBA runtime PM error if
ufshcd_suspend/resume has failed due to UFS errors, e.g. hibern8 enter/exit
error or SSU cmd error. When this happens, error handler may fail
performing a full reset and restore because error handler always assumes
that power, IRQs and clocks are ready after pm_runtime_get_sync returns,
but actually they are not if ufshcd_resume fails[1].
If ufschd_suspend/resume fails due to UFS errors, runtime PM framework
saves the error value to dev.power.runtime_error. After that, HBA dev
runtime suspend/resume would not be invoked anymore unless runtime_error is
cleared[2].
In case of ufshcd_suspend/resume fails due to UFS errors, for scenario [1],
error handler cannot assume anything of pm_runtime_get_sync, meaning error
handler should explicitly turn ON powers, IRQs and clocks again. To get the
HBA runtime PM work as regard for scenario [2], error handler can clear the
runtime_error by calling pm_runtime_set_active() if full reset and restore
succeeds. And, more important, if pm_runtime_set_active() returns no error,
which means runtime_error has been cleared, we also need to resume those
scsi devices under HBA in case any of them has failed to be resumed due to
HBA runtime resume failure. This is to unblock blk_queue_enter in case
there are bios waiting inside it.
Link: https://lore.kernel.org/r/1596975355-39813-7-git-send-email-cang@codeaurora.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit c72e79c0ad2bd7efb1cf84f630f59daf9ba8c510
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I66e05ea58aa9af7f009f20e0791cd9bf76237fcd
[can: Resolved minor conflict in ufshcd.c]
Signed-off-by: Can Guo <cang@codeaurora.org>
Error recovery can be invoked from multiple code paths, including hibern8
enter/exit (from ufshcd_link_recovery), ufshcd_eh_host_reset_handler() and
eh_work scheduled from IRQ context. Ultimately, these paths are all trying
to invoke ufshcd_reset_and_restore() in either a synchronous or
asynchronous manner. This causes problems:
- If link recovery happens during ungate work, ufshcd_hold() would be
called recursively. Although commit 53c12d0ef6 ("scsi: ufs: fix error
recovery after the hibern8 exit failure") fixed a deadlock due to
recursive calls of ufshcd_hold() by adding a check of eh_in_progress
into ufshcd_hold, this check allows eh_work to run in parallel while
link recovery is running.
- Similar concurrency can also happen when error recovery is invoked from
ufshcd_eh_host_reset_handler and ufshcd_link_recovery.
- Concurrency can even happen between eh_works. eh_work, currently queued
on system_wq, is allowed to have multiple instances running in parallel,
but we don't have proper protection for that.
If any of above concurrency scenarios happen, error recovery would fail and
lead ufs device and host into bad states. To fix the concurrency problem,
this change queues eh_work on a single threaded workqueue and removes link
recovery calls from the hibern8 enter/exit path. In addition, make use of
eh_work in eh_host_reset_handler instead of calling
ufshcd_reset_and_restore. This unifies the UFS error recovery mechanism.
According to the UFSHCI JEDEC spec, hibern8 enter/exit error occurs when
the link is broken. This essentially applies to any power mode change
operations (since they all use PACP_PWR cmds in UniPro layer). So, if a
power mode change operation (including AH8 enter/exit) fails, mark link
state as UIC_LINK_BROKEN_STATE and schedule the eh_work. In this case,
error handler needs to do a full reset and restore to recover the link back
to active. Before the link state is recovered to active,
ufshcd_uic_pwr_ctrl simply returns -ENOLINK to avoid more errors.
Link: https://lore.kernel.org/r/1596975355-39813-6-git-send-email-cang@codeaurora.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 4db7a23605973ac4a2cb24e759bebaaa82054f21
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I9718d7752016682607fc6735402fad7c0059ed3a
[can: Resolved minor conflict in ufshcd.c]
Signed-off-by: Can Guo <cang@codeaurora.org>
Information about the last interrupt status and timestamp is helpful when
debugging system stability issues (IRQ starvation, for instance). Add this
information to ufshcd_print_host_state() output.
In addition, UFS device information such as model name and firmware version
also comes in handy during debugging. This is printed as well.
Link: https://lore.kernel.org/r/1596975355-39813-5-git-send-email-cang@codeaurora.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 3f8af6044713fab0aeb884e1be6bcc2cb276725e
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I6b8ec998a0563252786f1baf2e6bc962659118a8
[can: Resolved minor conflict in ufshcd.c]
Signed-off-by: Can Guo <cang@codeaurora.org>
Dumping testbus registers outputs a lot of information and can cause
stability issues. Remove the dump code.
Link: https://lore.kernel.org/r/1596975355-39813-4-git-send-email-cang@codeaurora.org
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 423cc66b5152a309e99a3693d856157a5e4a8d39
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I8f7eee4381d15e686d716ab08d24e615df2d08b8
Signed-off-by: Can Guo <cang@codeaurora.org>
If ufs_qcom_dump_dbg_regs() calls ufs_qcom_testbus_config() from
ufshcd_suspend/resume and/or clk gate/ungate context, pm_runtime_get_sync()
and ufshcd_hold() will cause a race condition. Fix this by removing the
unnecessary calls of pm_runtime_get_sync() and ufshcd_hold().
Link: https://lore.kernel.org/r/1596975355-39813-3-git-send-email-cang@codeaurora.org
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 89dd87acd40a44de8ff3358138aedf8f73f4efc6
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: I9d7316220df2631493ed385b5243e182458b1376
Signed-off-by: Can Guo <cang@codeaurora.org>
Clock gating can be turned on/off selectively which means the associated
state information is only correct if the feature is enabled. This change
makes sure that we only look at state of clk-gating if it is enabled.
Link: https://lore.kernel.org/r/1596975355-39813-2-git-send-email-cang@codeaurora.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 165343119
(cherry picked from commit 2dec9475a4028ba0a4ede51452f89dead2c008e1
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 5.10/scsi-queue)
Change-Id: Ie1f582658d27935891236cad3fb23c018240a15b
Signed-off-by: Can Guo <cang@codeaurora.org>
__cfi_check needs to be aligned to 4k, not necessarily PAGE_SIZE.
Furthermore, using arch-specific includes currently breaks `make
scripts`.
Bug: 165591024
Change-Id: Id80fce84d4c111374718d8d84e7c06812a5d4e4b
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
android_vh_ptype_head:
To add a debugging chain to ptype list
android_vh_kfree_skb
To sniff the dropped packet at kernel network
Bug: 163716381
Signed-off-by: Bae Soukjin <soukjin.bae@samsung.com>
Change-Id: Ide80bf0a129da31a1824d4a33026ac42be327361
This reverts commit 10de419977 which is
commit 1b7ecc241a67ad6b584e071bd791a54e0cd5f097 upstream.
It breaks the abi for the android11-5.4 branch, and isn't needed in
android devices, so just revert it.
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I081472f3c3663edaa0c1275fe5e1303833bd533c
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88xTwACgkQONu9yGCS
aT60Lw/9HV3JZ0KDYKHRRS/n4UWh2w7jHe5hwFTfX8/KibexzGzgV3gTaXsyQx75
Bj2ruJTGZKDvy+a9/IsjTe1v1/HPwPydDyfABNl/Rn8vQuyHzyyGzQo2owqGb57w
4wVuoqhPASn0n2QAMG05caAx1uqPlXcT/I4H8vpzieNEHbB/2TbwFiWvrDC2d+nw
mw1PkRmaFp2GSMOHSb68n2oYUv19EBHDtxF9WkwyftdKALQYz5x4O/n4lhpzMSmO
OeiUg/dpLi0bptL1SQAfaY/Lxa1gFb62YvP47WbWp/P6zespOInk2n8kmpoHxol3
MMZelRCdl9NtIKVXMEOFEv/asXPlF2wARGmNejGCYLaRqal1bH67yG4eja7biIJe
gr5OBOFVPol83sPAnb6V4P2SEs650WR95hshYpRL9lbmcHY4q5zoXVm9ul/Hp49R
qjjfxHDNQQoQgX4ZhEJLp2a5AEJUM4Kz28pZXHyczKYc2R6/AZWqHfnbQVURf+au
0xJ/tOFxn3yqRtTkmuuifkZcUTJ5iRnzxUUYiGyhTqZOTNZTD0FgiI+S7gckI//K
idoWGTszHZb6YkNBEwz4WJFtxCGpO95xgD95jOpJVxFcJ5f5PpfZE7RkXUDLR5UO
XzJopB3nOT1h3EoI3xq7aPDF1hKbkp+VRMWcVrBeP9KgcpLisS4=
=Tk2c
-----END PGP SIGNATURE-----
Merge 5.4.59 into android11-5.4
Changes in 5.4.59
tracepoint: Mark __tracepoint_string's __used
HID: input: Fix devices that return multiple bytes in battery report
nvme: add a Identify Namespace Identification Descriptor list quirk
fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe
clk: qcom: clk-rpmh: Wait for completion when enabling clocks
x86/mce/inject: Fix a wrong assignment of i_mce.status
sched/fair: Fix NOHZ next idle balance
sched: correct SD_flags returned by tl->sd_flags()
arm64: dts: rockchip: fix rk3368-lion gmac reset gpio
arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio
arm64: dts: rockchip: fix rk3399-puma gmac reset gpio
EDAC: Fix reference count leaks
crc-t10dif: Fix potential crypto notify dead-lock
arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
blktrace: fix debugfs use after free
crypto: ccree - fix resource leak on error path
ARM: exynos: MCPM: Restore big.LITTLE cpuidle support
firmware: arm_scmi: Fix SCMI genpd domain probing
arm64: dts: exynos: Fix silent hang after boot on Espresso
sched/uclamp: Fix initialization of struct uclamp_rq
clk: scmi: Fix min and max rate when registering clocks with discrete rates
m68k: mac: Don't send IOP message until channel is idle
m68k: mac: Fix IOP status/control register writes
platform/x86: intel-hid: Fix return value check in check_acpi_dev()
platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
ARM: dts: gose: Fix ports node name for adv7180
ARM: dts: gose: Fix ports node name for adv7612
ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores
ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages
spi: lantiq: fix: Rx overflow error in full duplex mode
tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.
regulator: fix memory leak on error path of regulator_register()
io_uring: fix sq array offset calculation
spi: rockchip: Fix error in SPI slave pio read
ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
iocost: Fix check condition of iocg abs_vdebt
irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource()
seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID
md: raid0/linear: fix dereference before null check on pointer mddev
nvme-tcp: fix controller reset hang during traffic
nvme-rdma: fix controller reset hang during traffic
nvme-multipath: fix logic for non-optimized paths
nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths
drm/tilcdc: fix leak & null ref in panel_connector_get_modes
soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
Bluetooth: add a mutex lock to avoid UAF in do_enale_set
loop: be paranoid on exit and prevent new additions / removals
fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
drm/amdgpu: avoid dereferencing a NULL pointer
drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
crypto: aesni - Fix build with LLVM_IAS=1
video: fbdev: savage: fix memory leak on error handling path in probe
video: fbdev: neofb: fix memory leak in neo_scan_monitor()
bus: ti-sysc: Add missing quirk flags for usb_host_hs
md-cluster: fix wild pointer of unlock_all_bitmaps()
drm/nouveau/kms/nv50-: Fix disabling dithering
arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding
drm/etnaviv: fix ref count leak via pm_runtime_get_sync
drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek
drm/nouveau: fix multiple instances of reference count leaks
mmc: sdhci-cadence: do not use hardware tuning for SD mode
btrfs: fix lockdep splat from btrfs_dump_space_info
usb: mtu3: clear dual mode of u3port when disable device
drm: msm: a6xx: fix gpu failure after system resume
drm/msm: Fix a null pointer access in msm_gem_shrinker_count()
drm/debugfs: fix plain echo to connector "force" attribute
drm/radeon: disable AGP by default
irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock
mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
drm/amdgpu/display bail early in dm_pp_get_static_clocks
drm/amd/powerplay: fix compile error with ARCH=arc
bpf: Fix fds_example SIGSEGV error
brcmfmac: keep SDIO watchdog running when console_interval is non-zero
brcmfmac: To fix Bss Info flag definition Bug
brcmfmac: set state of hanger slot to FREE when flushing PSQ
platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15
iwlegacy: Check the return value of pcie_capability_read_*()
gpu: host1x: debug: Fix multiple channels emitting messages simultaneously
ionic: update eid test for overflow
mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
usb: gadget: net2280: fix memory leak on probe error handling paths
bdc: Fix bug causing crash after multiple disconnects
usb: bdc: Halt controller on suspend
dyndbg: fix a BUG_ON in ddebug_describe_flags
bcache: fix super block seq numbers comparision in register_cache_set()
ACPICA: Do not increment operation_region reference counts for field units
drm/msm: ratelimit crtc event overflow error
drm/gem: Fix a leak in drm_gem_objects_lookup()
drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers
agp/intel: Fix a memory leak on module initialisation failure
mwifiex: Fix firmware filename for sd8977 chipset
mwifiex: Fix firmware filename for sd8997 chipset
btmrvl: Fix firmware filename for sd8977 chipset
btmrvl: Fix firmware filename for sd8997 chipset
video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
console: newport_con: fix an issue about leak related system resources
video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
ath10k: Acquire tx_lock in tx error paths
iio: improve IIO_CONCENTRATION channel type description
drm/etnaviv: Fix error path on failure to enable bus clk
drm/arm: fix unintentional integer overflow on left shift
clk: bcm63xx-gate: fix last clock availability
leds: lm355x: avoid enum conversion warning
Bluetooth: btusb: fix up firmware download sequence
Bluetooth: btmtksdio: fix up firmware download sequence
media: cxusb-analog: fix V4L2 dependency
media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
ASoC: SOF: nocodec: add missing .owner field
ASoC: Intel: bxt_rt298: add missing .owner field
scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
cxl: Fix kobject memleak
drm/radeon: fix array out-of-bounds read and write issues
staging: vchiq_arm: Add a matching unregister call
iavf: fix error return code in iavf_init_get_resources()
iavf: Fix updating statistics
RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
scsi: powertec: Fix different dev_id between request_irq() and free_irq()
scsi: eesox: Fix different dev_id between request_irq() and free_irq()
ipvs: allow connection reuse for unconfirmed conntrack
media: firewire: Using uninitialized values in node_probe()
media: exynos4-is: Add missed check for pinctrl_lookup_state()
media: cros-ec-cec: do not bail on device_init_wakeup failure
xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
xfs: fix reflink quota reservation accounting error
RDMA/rxe: Skip dgid check in loopback mode
PCI: Fix pci_cfg_wait queue locking problem
drm/stm: repair runtime power management
kobject: Avoid premature parent object freeing in kobject_cleanup()
leds: core: Flush scheduled work for system suspend
drm: panel: simple: Fix bpc for LG LB070WV8 panel
phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
drm/bridge: sil_sii8620: initialize return of sii8620_readb
scsi: scsi_debug: Add check for sdebug_max_queue during module init
mwifiex: Prevent memory corruption handling keys
kernfs: do not call fsnotify() with name without a parent
powerpc/rtas: don't online CPUs for partition suspend
powerpc/vdso: Fix vdso cpu truncation
RDMA/qedr: SRQ's bug fixes
RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
ima: Have the LSM free its audit rule
staging: rtl8192u: fix a dubious looking mask before a shift
ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback
PCI/ASPM: Add missing newline in sysfs 'policy'
phy: renesas: rcar-gen3-usb2: move irq registration to init
powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
drm/imx: fix use after free
drm/imx: tve: fix regulator_disable error path
gpu: ipu-v3: Restore RGB32, BGR32
spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM
USB: serial: iuu_phoenix: fix led-activity helpers
usb: core: fix quirks_param_set() writing to a const pointer
thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor()
coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
powerpc/perf: Fix missing is_sier_aviable() during build
mt76: mt7615: fix potential memory leak in mcu message handler
phy: armada-38x: fix NETA lockup when repeatedly switching speeds
MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init()
usb: dwc2: Fix error path in gadget registration
usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
scsi: megaraid_sas: Clear affinity hint
scsi: mesh: Fix panic after host or bus reset
net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
macintosh/via-macii: Access autopoll_devs when inside lock
PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
RDMA/core: Fix return error value in _ib_modify_qp() to negative
Smack: fix another vsscanf out of bounds
Smack: prevent underflow in smk_set_cipso()
power: supply: check if calc_soc succeeded in pm860x_init_battery
Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
Bluetooth: hci_serdev: Only unregister device if it was registered
net: dsa: rtl8366: Fix VLAN semantics
net: dsa: rtl8366: Fix VLAN set-up
xfs: fix inode allocation block res calculation precedence
selftests/powerpc: Squash spurious errors due to device removal
powerpc/32s: Fix CONFIG_BOOK3S_601 uses
powerpc/boot: Fix CONFIG_PPC_MPC52XX references
selftests/powerpc: Fix CPU affinity for child process
RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP
PCI: Release IVRS table in AMD ACS quirk
cpufreq: ap806: fix cpufreq driver needs ap cpu clk
selftests/powerpc: Fix online CPU selection
ASoC: meson: axg-tdm-interface: fix link fmt setup
ASoC: meson: axg-tdmin: fix g12a skew
ASoC: meson: axg-tdm-formatters: fix sclk inversion
ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK
s390/qeth: don't process empty bridge port events
ice: Graceful error handling in HW table calloc failure
rtw88: fix LDPC field for RA info
rtw88: fix short GI capability based on current bandwidth
rtw88: coex: only skip coex triggered by BT info
wl1251: fix always return 0 error
tools, build: Propagate build failures from tools/build/Makefile.build
tools, bpftool: Fix wrong return value in do_dump()
net/mlx5: DR, Change push vlan action sequence
net/mlx5: Delete extra dump stack that gives nothing
net: ethernet: aquantia: Fix wrong return value
liquidio: Fix wrong return value in cn23xx_get_pf_num()
net: spider_net: Fix the size used in a 'dma_free_coherent()' call
fsl/fman: use 32-bit unsigned integer
fsl/fman: fix dereference null return value
fsl/fman: fix unreachable code
fsl/fman: check dereferencing null pointer
fsl/fman: fix eth hash table allocation
net: thunderx: initialize VF's mailbox mutex before first usage
dlm: Fix kobject memleak
ocfs2: fix unbalanced locking
pinctrl-single: fix pcs_parse_pinconf() return value
svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()")
x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
crypto: aesni - add compatibility with IAS
af_packet: TPACKET_V3: fix fill status rwlock imbalance
drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
net: Fix potential memory leak in proto_register()
net/nfc/rawsock.c: add CAP_NET_RAW check.
net: phy: fix memory leak in device-create error path
net: Set fput_needed iff FDPUT_FPUT is set
net/tls: Fix kmap usage
tcp: correct read of TFO keys on big endian systems
vmxnet3: use correct tcp hdr length when packet is encapsulated
net: refactor bind_bucket fastreuse into helper
net: initialize fastreuse on inet_inherit_port
USB: serial: cp210x: re-enable auto-RTS on open
USB: serial: cp210x: enable usb generic throttle/unthrottle
ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
9p: Fix memory leak in v9fs_mount
media: media-request: Fix crash if memory allocation fails
drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
io_uring: set ctx sq/cq entry count earlier
NFS: Don't move layouts to plh_return_segs list while in use
NFS: Don't return layout segments that are in use
cpufreq: Fix locking issues with governors
cpufreq: dt: fix oops on armada37xx
include/asm-generic/vmlinux.lds.h: align ro_after_init
spi: spidev: Align buffers for DMA
mtd: rawnand: qcom: avoid write to unavailable register
erofs: fix extended inode could cross boundary
Revert "parisc: Drop LDCW barrier in CAS code when running UP"
Revert "parisc: Use ldcw instruction for SMP spinlock release barrier"
Revert "parisc: Revert "Release spinlocks using ordered store""
parisc: Do not use an ordered store in pa_tlb_lock()
parisc: Implement __smp_store_release and __smp_load_acquire barriers
parisc: mask out enable and reserved bits from sba imask
ARM: 8992/1: Fix unwind_frame for clang-built kernels
irqdomain/treewide: Free firmware node after domain removal
ALSA: usb-audio: add quirk for Pioneer DDJ-RB
tpm: Unify the mismatching TPM space buffer sizes
pstore: Fix linking when crypto API disabled
crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
crypto: qat - fix double free in qat_uclo_create_batch_init_list
crypto: ccp - Fix use of merged scatterlists
crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
bitfield.h: don't compile-time validate _val in FIELD_FIT
fs/minix: check return value of sb_getblk()
fs/minix: don't allow getting deleted inodes
fs/minix: reject too-large maximum file size
xen/balloon: fix accounting in alloc_xenballooned_pages error path
xen/balloon: make the balloon wait interruptible
xen/gntdev: Fix dmabuf import with non-zero sgt offset
s390/dasd: fix inability to use DASD with DIAG driver
s390/gmap: improve THP splitting
io_uring: Fix NULL pointer dereference in loop_rw_iter()
Linux 5.4.59
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4bc685ec9234d8f72a9c66ee2d509a2975f6d711
commit ba925fa35057a062ac98c3e8138b013ce4ce351c upstream.
During s390_enable_sie(), we need to take care of splitting all qemu user
process THP mappings. This is currently done with follow_page(FOLL_SPLIT),
by simply iterating over all vma ranges, with PAGE_SIZE increment.
This logic is sub-optimal and can result in a lot of unnecessary overhead,
especially when using qemu and ASAN with large shadow map. Ilya reported
significant system slow-down with one CPU busy for a long time and overall
unresponsiveness.
Fix this by using walk_page_vma() and directly calling split_huge_pmd()
only for present pmds, which greatly reduces overhead.
Cc: <stable@vger.kernel.org> # v5.4+
Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9f4aa52387c68049403b59939df5c0dd8e3872cc upstream.
During initialization of the DASD DIAG driver a request is issued
that has a bio structure that resides on the stack. With virtually
mapped kernel stacks this bio address might be in virtual storage
which is unsuitable for usage with the diag250 call.
In this case the device can not be set online using the DIAG
discipline and fails with -EOPNOTSUP.
In the system journal the following error message is presented:
dasd: X.X.XXXX Setting the DASD online with discipline DIAG failed
with rc=-95
Fix by allocating the bio structure instead of having it on the stack.
Fixes: ce3dc44749 ("s390: add support for virtually mapped kernel stacks")
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Cc: stable@vger.kernel.org #4.20
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5fa4e6f1c2d8c9a4e47e1931b42893172d388f2b upstream.
It is possible that the scatter-gather table during dmabuf import has
non-zero offset of the data, but user-space doesn't expect that.
Fix this by failing the import, so user-space doesn't access wrong data.
Fixes: bf8dc55b13 ("xen/gntdev: Implement dma-buf import functionality")
Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Acked-by: Juergen Gross <jgross@suse.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200813062113.11030-2-andr2000@gmail.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 88a479ff6ef8af7f07e11593d58befc644244ff7 upstream.
So it can be killed, or else processes can get hung indefinitely
waiting for balloon pages.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200727091342.52325-3-roger.pau@citrix.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1951fa33ec259abdf3497bfee7b63e7ddbb1a394 upstream.
target_unpopulated is incremented with nr_pages at the start of the
function, but the call to free_xenballooned_pages will only subtract
pgno number of pages, and thus the rest need to be subtracted before
returning or else accounting will be skewed.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200727091342.52325-2-roger.pau@citrix.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 270ef41094e9fa95273f288d7d785313ceab2ff3 upstream.
If the minix filesystem tries to map a very large logical block number to
its on-disk location, block_to_path() can return offsets that are too
large, causing out-of-bounds memory accesses when accessing indirect index
blocks. This should be prevented by the check against the maximum file
size, but this doesn't work because the maximum file size is read directly
from the on-disk superblock and isn't validated itself.
Fix this by validating the maximum file size at mount time.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+c7d9ec7a1a7272dd71b3@syzkaller.appspotmail.com
Reported-by: syzbot+3b7b03a0c28948054fb5@syzkaller.appspotmail.com
Reported-by: syzbot+6e056ee473568865f3e6@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-4-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit facb03dddec04e4aac1bb2139accdceb04deb1f3 upstream.
If an inode has no links, we need to mark it bad rather than allowing it
to be accessed. This avoids WARNINGs in inc_nlink() and drop_nlink() when
doing directory operations on a fuzzed filesystem.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a9ac3de1b5de5fb10efc@syzkaller.appspotmail.com
Reported-by: syzbot+df958cf5688a96ad3287@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-3-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit da27e0a0e5f655f0d58d4e153c3182bb2b290f64 upstream.
Patch series "fs/minix: fix syzbot bugs and set s_maxbytes".
This series fixes all syzbot bugs in the minix filesystem:
KASAN: null-ptr-deref Write in get_block
KASAN: use-after-free Write in get_block
KASAN: use-after-free Read in get_block
WARNING in inc_nlink
KMSAN: uninit-value in get_block
WARNING in drop_nlink
It also fixes the minix filesystem to set s_maxbytes correctly, so that
userspace sees the correct behavior when exceeding the max file size.
This patch (of 6):
sb_getblk() can fail, so check its return value.
This fixes a NULL pointer dereference.
Originally from Qiujun Huang.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+4a88b2b9dc280f47baf4@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-1-ebiggers@kernel.org
Link: http://lkml.kernel.org/r/20200628060846.682158-2-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 444da3f52407d74c9aa12187ac6b01f76ee47d62 upstream.
When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the
compiler to deduce a case where _val can only have the value of -1 at
compile time. Specifically,
/* struct bpf_insn: _s32 imm */
u64 imm = insn->imm; /* sign extend */
if (imm >> 32) { /* non-zero only if insn->imm is negative */
/* inlined from ur_load_imm_any */
u32 __imm = imm >> 32; /* therefore, always 0xffffffff */
if (__builtin_constant_p(__imm) && __imm > 255)
compiletime_assert_XXX()
This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that
checks that a given value is representable in one byte (interpreted as
unsigned).
FIELD_FIT() should return true or false at runtime for whether a value
can fit for not. Don't break the build over a value that's too large for
the mask. We'd prefer to keep the inlining and compiler optimizations
though we know this case will always return false.
Cc: stable@vger.kernel.org
Fixes: 1697599ee3 ("bitfield.h: add FIELD_FIT() helper")
Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjXpEUL7d=V0CXiAXcNw@mail.gmail.com/
Reported-by: Masahiro Yamada <masahiroy@kernel.org>
Debugged-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9e27c99104707f083dccd3b4d79762859b5a0614 upstream.
There is this call chain:
cvm_encrypt -> cvm_enc_dec -> cptvf_do_request -> process_request -> kzalloc
where we call sleeping allocator function even if CRYPTO_TFM_REQ_MAY_SLEEP
was not specified.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org # v4.11+
Fixes: c694b23329 ("crypto: cavium - Add the Virtual Function driver for CPT")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8a302808c60d441d9884cb00ea7f2b534f2e3ca5 upstream.
Running the crypto manager self tests with
CONFIG_CRYPTO_MANAGER_EXTRA_TESTS may result in several types of errors
when using the ccp-crypto driver:
alg: skcipher: cbc-des3-ccp encryption failed on test vector 0; expected_error=0, actual_error=-5 ...
alg: skcipher: ctr-aes-ccp decryption overran dst buffer on test vector 0 ...
alg: ahash: sha224-ccp test failed (wrong result) on test vector ...
These errors are the result of improper processing of scatterlists mapped
for DMA.
Given a scatterlist in which entries are merged as part of mapping the
scatterlist for DMA, the DMA length of a merged entry will reflect the
combined length of the entries that were merged. The subsequent
scatterlist entry will contain DMA information for the scatterlist entry
after the last merged entry, but the non-DMA information will be that of
the first merged entry.
The ccp driver does not take this scatterlist merging into account. To
address this, add a second scatterlist pointer to track the current
position in the DMA mapped representation of the scatterlist. Both the DMA
representation and the original representation of the scatterlist must be
tracked as while most of the driver can use just the DMA representation,
scatterlist_map_and_copy() must use the original representation and
expects the scatterlist pointer to be accurate to the original
representation.
In order to properly walk the original scatterlist, the scatterlist must
be walked until the combined lengths of the entries seen is equal to the
DMA length of the current entry being processed in the DMA mapped
representation.
Fixes: 63b945091a ("crypto: ccp - CCP device driver and interface support")
Signed-off-by: John Allen <john.allen@amd.com>
Cc: stable@vger.kernel.org
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c06c76602e03bde24ee69a2022a829127e504202 upstream.
clang static analysis flags this error
qat_uclo.c:297:3: warning: Attempt to free released memory
[unix.Malloc]
kfree(*init_tab_base);
^~~~~~~~~~~~~~~~~~~~~
When input *init_tab_base is null, the function allocates memory for
the head of the list. When there is problem allocating other list
elements the list is unwound and freed. Then a check is made if the
list head was allocated and is also freed.
Keeping track of the what may need to be freed is the variable 'tail_old'.
The unwinding/freeing block is
while (tail_old) {
mem_init = tail_old->next;
kfree(tail_old);
tail_old = mem_init;
}
The problem is that the first element of tail_old is also what was
allocated for the list head
init_header = kzalloc(sizeof(*init_header), GFP_KERNEL);
...
*init_tab_base = init_header;
flag = 1;
}
tail_old = init_header;
So *init_tab_base/init_header are freed twice.
There is another problem.
When the input *init_tab_base is non null the tail_old is calculated by
traveling down the list to first non null entry.
tail_old = init_header;
while (tail_old->next)
tail_old = tail_old->next;
When the unwinding free happens, the last entry of the input list will
be freed.
So the freeing needs a general changed.
If locally allocated the first element of tail_old is freed, else it
is skipped. As a bit of cleanup, reset *init_tab_base if it came in
as null.
Fixes: b4b7e67c91 ("crypto: qat - Intel(R) QAT ucode part of fw loader")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5ead051780404b5cb22147170acadd1994dc3236 upstream.
There is this call chain:
sec_alg_skcipher_encrypt -> sec_alg_skcipher_crypto ->
sec_alg_alloc_and_calc_split_sizes -> kcalloc
where we call sleeping allocator function even if CRYPTO_TFM_REQ_MAY_SLEEP
was not specified.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org # v4.19+
Fixes: 915e4e8413 ("crypto: hisilicon - SEC security accelerator driver")
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit fd49e03280e596e54edb93a91bc96170f8e97e4a upstream.
When building a kernel with CONFIG_PSTORE=y and CONFIG_CRYPTO not set,
a build error happens:
ld: fs/pstore/platform.o: in function `pstore_dump':
platform.c:(.text+0x3f9): undefined reference to `crypto_comp_compress'
ld: fs/pstore/platform.o: in function `pstore_get_backend_records':
platform.c:(.text+0x784): undefined reference to `crypto_comp_decompress'
This because some pstore code uses crypto_comp_(de)compress regardless
of the CONFIG_CRYPTO status. Fix it by wrapping the (de)compress usage
by IS_ENABLED(CONFIG_PSTORE_COMPRESS)
Signed-off-by: Matteo Croce <mcroce@linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20200706234045.9516-1-mcroce@linux.microsoft.com
Fixes: cb3bee0369 ("pstore: Use crypto compress API")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6c4e79d99e6f42b79040f1a33cd4018f5425030b upstream.
The size of the buffers for storing context's and sessions can vary from
arch to arch as PAGE_SIZE can be anything between 4 kB and 256 kB (the
maximum for PPC64). Define a fixed buffer size set to 16 kB. This should be
enough for most use with three handles (that is how many we allow at the
moment). Parametrize the buffer size while doing this, so that it is easier
to revisit this later on if required.
Cc: stable@vger.kernel.org
Reported-by: Stefan Berger <stefanb@linux.ibm.com>
Fixes: 745b361e98 ("tpm: infrastructure for TPM spaces")
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6e8596172ee1cd46ec0bfd5adcf4ff86371478b6 upstream.
This is just another Pioneer device with fixed endpoints. Input is dummy
but used as feedback (it always returns silence).
Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200810082502.225979-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ec0160891e387f4771f953b888b1fe951398e5d9 upstream.
Commit 711419e504 ("irqdomain: Add the missing assignment of
domain->fwnode for named fwnode") unintentionally caused a dangling pointer
page fault issue on firmware nodes that were freed after IRQ domain
allocation. Commit e3beca48a45b fixed that dangling pointer issue by only
freeing the firmware node after an IRQ domain allocation failure. That fix
no longer frees the firmware node immediately, but leaves the firmware node
allocated after the domain is removed.
The firmware node must be kept around through irq_domain_remove, but should be
freed it afterwards.
Add the missing free operations after domain removal where where appropriate.
Fixes: e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated")
Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com> # drivers/pci
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1595363169-7157-1-git-send-email-jonathan.derrick@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b4d5ec9b39f8b31d98f65bc5577b5d15d93795d7 upstream.
Since clang does not push pc and sp in function prologues, the current
implementation of unwind_frame does not work. By using the previous
frame's lr/fp instead of saved pc/sp we get valid unwinds on clang-built
kernels.
The bounds check on next frame pointer must be changed as well since
there are 8 less bytes between frames.
This fixes /proc/<pid>/stack.
Link: https://github.com/ClangBuiltLinux/linux/issues/912
Reported-by: Miles Chen <miles.chen@mediatek.com>
Tested-by: Miles Chen <miles.chen@mediatek.com>
Cc: stable@vger.kernel.org
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5b24993c21cbf2de11aff077a48c5cb0505a0450 upstream.
When using kexec the SBA IOMMU IBASE might still have the RE
bit set. This triggers a WARN_ON when trying to write back the
IBASE register later, and it also makes some mask calculations fail.
Cc: <stable@vger.kernel.org>
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e96ebd589debd9a6a793608c4ec7019c38785dea upstream.
This patch implements the __smp_store_release and __smp_load_acquire barriers
using ordered stores and loads. This avoids the sync instruction present in
the generic implementation.
Cc: <stable@vger.kernel.org> # 4.14+
Signed-off-by: Dave Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e72b23dec1da5e62a0090c5da1d926778284e230 upstream.
No need to use an ordered store in pa_tlb_lock() and update the comment
regarng usage of the sid register to unlocak a spinlock in
tlb_unlock0().
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v5.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6e9f06ee6c9566f3606d93182ac8f803a148504b upstream.
This reverts commit 9e5c602186.
No need to use the ldcw instruction as SMP spinlock release barrier.
Revert it to gain back speed again.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v5.2+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 462fb756c7de1ffe5bc6099149136031c2d9c02a upstream.
This reverts commit e6eb5fe912.
We need to optimize it differently. A follow up patch will correct it.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v5.2+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0dcd3c94e02438f4a571690e26f4ee997524102a upstream.
Each ondisk inode should be aligned with inode slot boundary
(32-byte alignment) because of nid calculation formula, so all
compact inodes (32 byte) cannot across page boundary. However,
extended inode is now 64-byte form, which can across page boundary
in principle if the location is specified on purpose, although
it's hard to be generated by mkfs due to the allocation policy
and rarely used by Android use case now mainly for > 4GiB files.
For now, only two fields `i_ctime_nsec` and `i_nlink' couldn't
be read from disk properly and cause out-of-bound memory read
with random value.
Let's fix now.
Fixes: 431339ba90 ("staging: erofs: add inode operations")
Cc: <stable@vger.kernel.org> # 4.19+
Link: https://lore.kernel.org/r/20200729175801.GA23973@xiangao.remote.csb
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 443440cc4a901af462239d286cd10721aa1c7dfc upstream.
SFLASHC_BURST_CFG is only available on older ipq NAND platforms, this
register has been removed when the NAND controller got implemented in
the qpic controller.
Avoid writing this register on devices which are based on qpic NAND
controller.
Fixes: dce84760b0 ("mtd: nand: qcom: Support for IPQ8074 QPIC NAND controller")
Cc: stable@vger.kernel.org
Signed-off-by: Sivaprakash Murugesan <sivaprak@codeaurora.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/1591948696-16015-2-git-send-email-sivaprak@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aa9e862d7d5bcecd4dca9f39e8b684b93dd84ee7 upstream.
Simply copying all xfers from userspace into one bounce buffer causes
alignment problems if the SPI controller uses DMA.
Ensure that all transfer data blocks within the rx and tx bounce buffers
are aligned for DMA (according to ARCH_KMALLOC_MINALIGN).
Alignment may increase the usage of the bounce buffers. In some cases,
the buffers may need to be increased using the "bufsiz" module
parameter.
Signed-off-by: Christian Eggers <ceggers@arri.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200728100832.24788-1-ceggers@arri.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7f897acbe5d57995438c831670b7c400e9c0dc00 upstream.
Since the patch [1], building the kernel using a toolchain built with
binutils 2.33.1 prevents booting a sh4 system under Qemu. Apply the patch
provided by Alan Modra [2] that fix alignment of rodata.
[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ebd2263ba9a9124d93bbc0ece63d7e0fae89b40e
[2] https://www.sourceware.org/ml/binutils/2019-12/msg00112.html
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alan Modra <amodra@gmail.com>
Cc: Bin Meng <bin.meng@windriver.com>
Cc: Chen Zhou <chenzhou10@huawei.com>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Rich Felker <dalias@libc.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Link: https://marc.info/?l=linux-sh&m=158429470221261
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 10470dec3decaf5ed3c596f85debd7c42777ae12 upstream.
Commit 0c868627e617e43a295d8 (cpufreq: dt: Allow platform specific
intermediate callbacks) added two function pointers to the
struct cpufreq_dt_platform_data. However, armada37xx_cpufreq_driver_init()
has this struct (pdata) located on the stack and uses only "suspend"
and "resume" fields. So these newly added "get_intermediate" and
"target_intermediate" pointers are uninitialized and contain arbitrary
non-null values, causing all kinds of trouble.
For instance, here is an oops on espressobin after an attempt to change
the cpefreq governor:
[ 29.174554] Unable to handle kernel execute from non-executable memory at virtual address ffff00003f87bdc0
...
[ 29.269373] pc : 0xffff00003f87bdc0
[ 29.272957] lr : __cpufreq_driver_target+0x138/0x580
...
Fixed by zeroing out pdata before use.
Cc: <stable@vger.kernel.org> # v5.7+
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8cc46ae565c393f77417cb9530b1265eb50f5d2e upstream.
The locking around governors handling isn't adequate currently.
The list of governors should never be traversed without the locking
in place. Also governor modules must not be removed while the code
in them is still in use.
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Changelog ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d474f96104bd4377573526ebae2ee212205a6839 upstream.
If the NFS_LAYOUT_RETURN_REQUESTED flag is set, we want to return the
layout as soon as possible, meaning that the affected layout segments
should be marked as invalid, and should no longer be in use for I/O.
Fixes: f0b429819b ("pNFS: Ignore non-recalled layouts in pnfs_layout_need_return()")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ff041727e9e029845857cac41aae118ead5e261b upstream.
If the layout segment is still in use for a read or a write, we should
not move it to the layout plh_return_segs list. If we do, we can end
up returning the layout while I/O is still in progress.
Fixes: e0b7d420f7 ("pNFS: Don't discard layout segments that are marked for return")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
