This change adds correct return value when client driver does a probe and
calls the API in common driver. Since individual QUP SE driver relies on
return value, it helps if dependencies are not met and can decide to defer
the probe.
Change-Id: I6bd75d0acc05fbd1fd2f7fb37c67dc34c4904e7b
Signed-off-by: Mukesh Kumar Savaliya <msavaliy@codeaurora.org>
Update the master and slave ID constants for Holi interconnect
providers which consumers can use to set bandwidth constraints
and find paths in the NoC (Network-On-Chip) topology.
Change-Id: I45b73970484220af09d9ab55062da197038a82cd
Signed-off-by: Odelu Kukatla <okukatla@codeaurora.org>
People keep trying to use these in Android kernels, and they should not
be used, use the correct, real, symbol name instead.
Turn off a number of things in the allmodconfig builds that were using
these symbols to not break the build. That was for build-testing only,
no functional changes.
Bug: 157965270
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I13bf351b3ae59fa6dfed7bd41dfff8c8d521e3a4
Previously, uic_cmd->cmd_active is cleared after completion has been raised
so that we can tell completion timeout happened due to kernel scheduling,
which is for debugging purposes. It is more important, however, to increase
the chance that UIC cmd survives from a completion timeout. So, this change
clears uic_cmd->cmd_active before calling complete().
Change-Id: I99254ac4e3b16dc6b905b5ed5248d53f9c9fc3af
Signed-off-by: Can Guo <cang@codeaurora.org>
This change is added to stop_tx during port shutdown.
Leaving TX sequencer active after port shutdown resulting
in unexpected behaviour because we expect TX sequencer
and DMA engine to go IDLE after port close.
In some cases TX remains active and trying to send invalid
TX zero bytes over TX line. Hence stop TX during port close.
Change-Id: I5ac15726bee16d2cc4de96dcd64e5c1d2b743908
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
rpmh-rsc driver is fairly core to system and should not be removable
once its probed. However it allows to unbind driver from sysfs using
below command which results into a crash on sc7180.
echo 18200000.rsc > /sys/bus/platform/drivers/rpmh/unbind
Lets prevent unbind at runtime by setting suppress_bind_attrs flag.
Change-Id: I7a8679dd4d8f3118b4f1d091f8d42ca1fde9b8f0
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Link: https://lore.kernel.org/r/1592808805-2437-1-git-send-email-mkshah@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
clang is much newer now, it should be building properly.
Bug: 157965270
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibdab0e4d91aeb90dc24a5d8894f05370c2fd34f1
This resolves an issue on arm32 where assigning 1 << 32 to
a size_t causes integer overflow.
Change-Id: Ic6f94873dd6939df9418c111e188418d67bfa6e3
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
If extra iterations are desired, the user can repeat the test as necessary.
Removing this from the kernel function helps the test to run faster, and
also cleans up the indentation level.
Change-Id: Ia643c3aa642dcecaa4f646330bf14d52d491c0e3
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Prepare for future changes to enable CONFIG_IOMMU_DMA by
defining the necessary arch hooks.
Change-Id: Ic21d5fc752d86d34a7384c339a02087e4e40182f
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Add compatible for shima in case PDC is compiled as module.
Change-Id: Ifa4c14a85f815a5ae1e12d623117dbf1e842c605
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
RPMSG unifies various transports that provide IPC to a remote proc.
Some of these transports require some set of side band signalling in
order to meet the specifications of the protocol they implement.
The GLINK native transport supports the tty serial signals to start
communication with modems that expect to receive the DTR serial signal.
Extend the rpmsg core with an interface to send and receive sideband
signals for the transports that need it.
Bug: 161128971
Link: https://lore.kernel.org/lkml/1593182819-30747-2-git-send-email-deesin@codeaurora.org/
Change-Id: I54539d8ddce1bfaec9016c2bec9b5a1372601995
Signed-off-by: Chris Lew <clew@codeaurora.org>
Some targets need to set the MSI address size same as the
PCIe data size(bytes) that PCIe core will halt for each write
transaction. Hence add a property to pass the exponent (base 2)
value for the size. Not setting this value same as PCIe core
write halt size results into a deadlock on system bus.
Change-Id: Ic94bb9330ac0a78ab273991d786fa2233f9383a6
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
It's possible that a touch event may happen before the first kgsl
instance is opened, which triggers the first boot sequence. This sequence
must happen before touch event can trigger a power on sequence.
Change-Id: I21af7865f4b02408d4f00814b4af6c9b9e8f5545
Signed-off-by: Harshdeep Dhatt <hdhatt@codeaurora.org>
Add DMADEVICES=y to the x86 gki_defconfig to fix this warning for x86
builds:
arch/x86/configs/gki_defconfig:361:warning: unexpected data: CONFIG_DMADEVICES=y
WARNING: unmet direct dependencies detected for DMA_VIRTUAL_CHANNELS
Depends on [n]: DMADEVICES [=n]
Selected by [y]:
- GKI_HIDDEN_SND_SOC_CONFIGS [=y]
WARNING: unmet direct dependencies detected for DMA_VIRTUAL_CHANNELS
Depends on [n]: DMADEVICES [=n]
Selected by [y]:
- GKI_HIDDEN_SND_SOC_CONFIGS [=y]
Fixes: dd17237d72 ("ANDROID: gki: build-in DMA_VIRTUAL_CHANNELS")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I6b1613255ca7488748abfbd7e6f626c6e8a000d5
This reverts commit 1c54d0d9c4 which is
commit f79a732a8325dfbd570d87f1435019d7e5501c6d upstream as it breaks
the ABI for sound drivers and we don't need the change in the android
trees at this point in time.
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia2e874e50aa4a233fe6edca3f20781060aaa3248
Changes in 5.4.52
KVM: s390: reduce number of IO pins to 1
spi: spi-fsl-dspi: Adding shutdown hook
spi: spi-fsl-dspi: Fix lockup if device is removed during SPI transfer
regmap: fix alignment issue
perf/x86/rapl: Move RAPL support to common x86 code
perf/x86/rapl: Fix RAPL config variable bug
ARM: dts: omap4-droid4: Fix spi configuration and increase rate
drm/ttm: Fix dma_fence refcnt leak when adding move fence
drm/tegra: hub: Do not enable orphaned window group
gpu: host1x: Detach driver on unregister
drm: mcde: Fix display initialization problem
ASoC: SOF: Intel: add PCI ID for CometLake-S
ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL
spi: spidev: fix a race between spidev_release and spidev_remove
spi: spidev: fix a potential use-after-free in spidev_release()
net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy
net: ethernet: mvneta: Add 2500BaseX support for SoCs without comphy
ixgbe: protect ring accesses with READ- and WRITE_ONCE
i40e: protect ring accesses with READ- and WRITE_ONCE
ibmvnic: continue to init in CRQ reset returns H_CLOSED
powerpc/kvm/book3s64: Fix kernel crash with nested kvm & DEBUG_VIRTUAL
iommu/vt-d: Don't apply gfx quirks to untrusted devices
drm: panel-orientation-quirks: Add quirk for Asus T101HA panel
drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003
s390/kasan: fix early pgm check handler execution
cifs: update ctime and mtime during truncate
ARM: imx6: add missing put_device() call in imx6q_suspend_init()
scsi: mptscsih: Fix read sense data size
usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work
block: release bip in a right way in error path
nvme-rdma: assign completion vector correctly
x86/entry: Increase entry_stack size to a full page
sched/core: Check cpus_mask, not cpus_ptr in __set_cpus_allowed_ptr(), to fix mask corruption
net: qrtr: Fix an out of bounds read qrtr_endpoint_post()
gpio: pca953x: Override IRQ for one of the expanders on Galileo Gen 2
gpio: pca953x: Fix GPIO resource leak on Intel Galileo Gen 2
nl80211: don't return err unconditionally in nl80211_start_ap()
drm/mediatek: Check plane visibility in atomic_update
bpf, sockmap: RCU splat with redirect and strparser error or TLS
bpf, sockmap: RCU dereferenced psock may be used outside RCU block
netfilter: ipset: call ip_set_free() instead of kfree()
net: mvneta: fix use of state->speed
net: cxgb4: fix return error value in t4_prep_fw
IB/sa: Resolv use-after-free in ib_nl_make_request()
net: dsa: microchip: set the correct number of ports
netfilter: conntrack: refetch conntrack after nf_conntrack_update()
perf report TUI: Fix segmentation fault in perf_evsel__hists_browse()
perf intel-pt: Fix recording PEBS-via-PT with registers
perf intel-pt: Fix PEBS sample for XMM registers
smsc95xx: check return value of smsc95xx_reset
smsc95xx: avoid memory leak in smsc95xx_bind
net: hns3: add a missing uninit debugfs when unload driver
net: hns3: fix use-after-free when doing self test
ALSA: compress: fix partial_drain completion state
RDMA/siw: Fix reporting vendor_part_id
arm64: kgdb: Fix single-step exception handling oops
nbd: Fix memory leak in nbd_add_socket
cxgb4: fix all-mask IP address comparison
IB/mlx5: Fix 50G per lane indication
qed: Populate nvm-file attributes while reading nvm config partition.
net/mlx5: Fix eeprom support for SFP module
net/mlx5e: Fix 50G per lane indication
bnxt_en: fix NULL dereference in case SR-IOV configuration fails
net: macb: fix wakeup test in runtime suspend/resume routines
net: macb: mark device wake capable when "magic-packet" property present
net: macb: fix call to pm_runtime in the suspend/resume functions
mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON()
mlxsw: pci: Fix use-after-free in case of failed devlink reload
IB/hfi1: Do not destroy hfi1_wq when the device is shut down
IB/hfi1: Do not destroy link_wq when the device is shut down
ALSA: opl3: fix infoleak in opl3
ALSA: hda - let hs_mic be picked ahead of hp_mic
ALSA: usb-audio: add quirk for MacroSilicon MS2109
ALSA: usb-audio: Add implicit feedback quirk for RTX6001
ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk subdevice id
ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC
ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC
ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC
KVM: arm64: Fix definition of PAGE_HYP_DEVICE
KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART
KVM: arm64: Annotate hyp NMI-related functions as __always_inline
KVM: x86: bit 8 of non-leaf PDPEs is not reserved
KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode
KVM: x86: Mark CR4.TSD as being possibly owned by the guest
KVM: arm64: Fix kvm_reset_vcpu() return code being incorrect with SVE
kallsyms: Refactor kallsyms_show_value() to take cred
module: Refactor section attr into bin attribute
module: Do not expose section addresses to non-CAP_SYSLOG
kprobes: Do not expose probe addresses to non-CAP_SYSLOG
bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
btrfs: fix fatal extent_buffer readahead vs releasepage race
btrfs: fix double put of block group with nocow
drm/radeon: fix double free
drm/amdgpu: don't do soft recovery if gpu_recovery=0
dm: use noio when sending kobject event
mmc: meson-gx: limit segments to 1 when dram-access-quirk is needed
ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
ARC: elf: use right ELF_ARCH
s390/setup: init jump labels before command line parsing
s390/mm: fix huge pte soft dirty copying
blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight()
dm writecache: reject asynchronous pmem devices
perf scripts python: export-to-postgresql.py: Fix struct.pack() int argument
perf scripts python: exported-sql-viewer.py: Fix zero id in call graph 'Find' result
perf scripts python: exported-sql-viewer.py: Fix zero id in call tree 'Find' result
perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result
pwm: jz4740: Fix build failure
s390: Change s390_kernel_write() return type to match memcpy()
s390/maccess: add no DAT mode to kernel_write
Linux 5.4.52
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib10c465a3556b5c55d6d6c2ec37b6061b32ca75f
[ Upstream commit d6df52e9996dcc2062c3d9c9123288468bb95b52 ]
To be able to patch kernel code before paging is initialized do plain
memcpy if DAT is off. This is required to enable early jump label
initialization.
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cb2cceaefb4c4dc28fc27ff1f1b2d258bfc10353 ]
s390_kernel_write()'s function type is almost identical to memcpy().
Change its return type to "void *" so they can be used interchangeably.
Cc: linux-s390@vger.kernel.org
Cc: heiko.carstens@de.ibm.com
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Miroslav Benes <mbenes@suse.cz>
Acked-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> # s390
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
When commit 9017dc4fbd59 ("pwm: jz4740: Enhance precision in calculation
of duty cycle") from v5.8-rc1 was backported to v5.4.x its dependency on
commit ce1f9cece057 ("pwm: jz4740: Use clocks from TCU driver") was not
noticed which made the pwm-jz4740 driver fail to build.
As ce1f9cece057 depends on still more rework, just backport a small part
of this commit to make the driver build again. (There is no dependency
on the functionality introduced in ce1f9cece057, just the rate variable
is needed.)
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3a3cf7c570a486b07d9a6e68a77548aea6a8421f upstream.
Using Python version 3.8.2 and PySide2 version 5.14.0, ctrl-F ('Find')
would not expand the tree to the result. Fix by using setExpanded().
Example:
$ perf record -e intel_pt//u uname
Linux
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.034 MB perf.data ]
$ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls
2020-06-26 15:32:14.928997 Creating database ...
2020-06-26 15:32:14.933971 Writing records...
2020-06-26 15:32:15.535251 Adding indexes
2020-06-26 15:32:15.542993 Dropping unused tables
2020-06-26 15:32:15.549716 Done
$ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db
Select: Reports -> Context-Sensitive Call Graph or Reports -> Call Tree
Press: Ctrl-F
Enter: main
Press: Enter
Before: line showing 'main' does not display
After: tree is expanded to line showing 'main'
Fixes: ebd70c7dc2 ("perf scripts python: exported-sql-viewer.py: Add ability to find symbols in the call-graph")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/20200629091955.17090-4-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 031c8d5edb1ddeb6d398f7942ce2a01a1a51ada9 upstream.
Using ctrl-F ('Find') would not find 'unknown' because it matches id
zero. Fix by excluding id zero from selection.
Example:
$ perf record -e intel_pt//u uname
Linux
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.034 MB perf.data ]
$ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls
2020-06-26 15:32:14.928997 Creating database ...
2020-06-26 15:32:14.933971 Writing records...
2020-06-26 15:32:15.535251 Adding indexes
2020-06-26 15:32:15.542993 Dropping unused tables
2020-06-26 15:32:15.549716 Done
$ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db
Select: Reports -> Call Tree
Press: Ctrl-F
Enter: unknown
Press: Enter
Before: displays 'unknown' not found
After: tree is expanded to line showing 'unknown'
Fixes: ae8b887c00 ("perf scripts python: exported-sql-viewer.py: Add call tree")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/20200629091955.17090-6-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 05a4fed69ff00a8bd83538684cb602a4636b07a7 upstream.
dm-multipath is the only user of blk_mq_queue_inflight(). When
dm-multipath calls blk_mq_queue_inflight() to check if it has
outstanding IO it can get a false negative. The reason for this is
blk_mq_rq_inflight() doesn't consider requests that are no longer
MQ_RQ_IN_FLIGHT but that are now MQ_RQ_COMPLETE (->complete isn't
called or finished yet) as "inflight".
This causes request-based dm-multipath's dm_wait_for_completion() to
return before all outstanding dm-multipath requests have actually
completed. This breaks DM multipath's suspend functionality because
blk-mq requests complete after DM's suspend has finished -- which
shouldn't happen.
Fix this by considering any request not in the MQ_RQ_IDLE state
(so either MQ_RQ_COMPLETE or MQ_RQ_IN_FLIGHT) as "inflight" in
blk_mq_rq_inflight().
Fixes: 3c94d83cb3 ("blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight()")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 528a9539348a0234375dfaa1ca5dbbb2f8f8e8d2 upstream.
If the pmd is soft dirty we must mark the pte as soft dirty (and not dirty).
This fixes some cases for guest migration with huge page backings.
Cc: <stable@vger.kernel.org> # 4.8
Fixes: bc29b7ac1d ("s390/mm: clean up pte/pmd encoding")
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 95e61b1b5d6394b53d147c0fcbe2ae70fbe09446 upstream.
Command line parameters might set static keys. This is true for s390 at
least since commit 6471384af2 ("mm: security: introduce init_on_alloc=1
and init_on_free=1 boot options"). To avoid the following WARN:
static_key_enable_cpuslocked(): static key 'init_on_alloc+0x0/0x40' used
before call to jump_label_init()
call jump_label_init() just before parse_early_param().
jump_label_init() is safe to call multiple times (x86 does that), doesn't
do any memory allocations and hence should be safe to call that early.
Fixes: 6471384af2 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
Cc: <stable@vger.kernel.org> # 5.3: d6df52e9996d: s390/maccess: add no DAT mode to kernel_write
Cc: <stable@vger.kernel.org> # 5.3
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 00fdec98d9881bf5173af09aebd353ab3b9ac729 upstream.
Trap handler for syscall tracing reads EFA (Exception Fault Address),
in case strace wants PC of trap instruction (EFA is not part of pt_regs
as of current code).
However this EFA read is racy as it happens after dropping to pure
kernel mode (re-enabling interrupts). A taken interrupt could
context-switch, trigger a different task's trap, clobbering EFA for this
execution context.
Fix this by reading EFA early, before re-enabling interrupts. A slight
side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler.
The trap handler is common to both ARCompact and ARCv2 builds too.
This just came out of code rework/review and no real problem was reported
but is clearly a potential problem specially for strace.
Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 27a5e7d36d383970affae801d77141deafd536a8 upstream.
The actual max_segs computation leads to failure while using the broadcom
sdio brcmfmac/bcmsdh driver, since the driver tries to make usage of
scatter gather.
But with the dram-access-quirk we use a 1,5K SRAM bounce buffer, and the
max_segs current value of 3 leads to max transfers to 4,5k, which doesn't
work.
This patch sets max_segs to 1 to better describe the hardware limitation,
and fix the SDIO functionality with the brcmfmac/bcmsdh driver on Amlogic
G12A/G12B SoCs on boards like SEI510 or Khadas VIM3.
Reported-by: Art Nikpal <art@khadas.com>
Reported-by: Christian Hewitt <christianshewitt@gmail.com>
Fixes: acdc8e71d9 ("mmc: meson-gx: add dram-access-quirk")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200608084458.32014-1-narmstrong@baylibre.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6958c1c640af8c3f40fa8a2eee3b5b905d95b677 upstream.
kobject_uevent may allocate memory and it may be called while there are dm
devices suspended. The allocation may recurse into a suspended device,
causing a deadlock. We must set the noio flag when sending a uevent.
The observed deadlock was reported here:
https://www.redhat.com/archives/dm-devel/2020-March/msg00025.html
Reported-by: Khazhismel Kumykov <khazhy@google.com>
Reported-by: Tahsin Erdogan <tahsin@google.com>
Reported-by: Gabriel Krisman Bertazi <krisman@collabora.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f4892c327a8e5df7ce16cab40897daf90baf6bec upstream.
It's impossible to debug shader hangs with soft recovery.
Signed-off-by: Marek Olšák <marek.olsak@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 41855a898650803e24b284173354cc3e44d07725 upstream.
clang static analysis flags this error
drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
kfree(rdev->pm.dpm.ps[i].ps_priv);
^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
kfree(rdev->pm.dpm.ps);
^~~~~~~~~~~~~~~~~~~~~~
problem is reported in ci_dpm_fini, with these code blocks.
for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
kfree(rdev->pm.dpm.ps[i].ps_priv);
}
kfree(rdev->pm.dpm.ps);
The first free happens in ci_parse_power_table where it cleans up locally
on a failure. ci_dpm_fini also does a cleanup.
ret = ci_parse_power_table(rdev);
if (ret) {
ci_dpm_fini(rdev);
return ret;
}
So remove the cleanup in ci_parse_power_table and
move the num_ps calculation to inside the loop so ci_dpm_fini
will know how many array elements to free.
Fixes: cc8dbbb4f6 ("drm/radeon: add dpm support for CI dGPUs (v2)")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 230ed397435e85b54f055c524fcb267ae2ce3bc4 upstream.
While debugging a patch that I wrote I was hitting use-after-free panics
when accessing block groups on unmount. This turned out to be because
in the nocow case if we bail out of doing the nocow for whatever reason
we need to call btrfs_dec_nocow_writers() if we called the inc. This
puts our block group, but a few error cases does
if (nocow) {
btrfs_dec_nocow_writers();
goto error;
}
unfortunately, error is
error:
if (nocow)
btrfs_dec_nocow_writers();
so we get a double put on our block group. Fix this by dropping the
error cases calling of btrfs_dec_nocow_writers(), as it's handled at the
error label now.
Fixes: 762bf09893 ("btrfs: improve error handling in run_delalloc_nocow")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6bf9cd2eed9aee6d742bb9296c994a91f5316949 upstream.
Under somewhat convoluted conditions, it is possible to attempt to
release an extent_buffer that is under io, which triggers a BUG_ON in
btrfs_release_extent_buffer_pages.
This relies on a few different factors. First, extent_buffer reads done
as readahead for searching use WAIT_NONE, so they free the local extent
buffer reference while the io is outstanding. However, they should still
be protected by TREE_REF. However, if the system is doing signficant
reclaim, and simultaneously heavily accessing the extent_buffers, it is
possible for releasepage to race with two concurrent readahead attempts
in a way that leaves TREE_REF unset when the readahead extent buffer is
released.
Essentially, if two tasks race to allocate a new extent_buffer, but the
winner who attempts the first io is rebuffed by a page being locked
(likely by the reclaim itself) then the loser will still go ahead with
issuing the readahead. The loser's call to find_extent_buffer must also
race with the reclaim task reading the extent_buffer's refcount as 1 in
a way that allows the reclaim to re-clear the TREE_REF checked by
find_extent_buffer.
The following represents an example execution demonstrating the race:
CPU0 CPU1 CPU2
reada_for_search reada_for_search
readahead_tree_block readahead_tree_block
find_create_tree_block find_create_tree_block
alloc_extent_buffer alloc_extent_buffer
find_extent_buffer // not found
allocates eb
lock pages
associate pages to eb
insert eb into radix tree
set TREE_REF, refs == 2
unlock pages
read_extent_buffer_pages // WAIT_NONE
not uptodate (brand new eb)
lock_page
if !trylock_page
goto unlock_exit // not an error
free_extent_buffer
release_extent_buffer
atomic_dec_and_test refs to 1
find_extent_buffer // found
try_release_extent_buffer
take refs_lock
reads refs == 1; no io
atomic_inc_not_zero refs to 2
mark_buffer_accessed
check_buffer_tree_ref
// not STALE, won't take refs_lock
refs == 2; TREE_REF set // no action
read_extent_buffer_pages // WAIT_NONE
clear TREE_REF
release_extent_buffer
atomic_dec_and_test refs to 1
unlock_page
still not uptodate (CPU1 read failed on trylock_page)
locks pages
set io_pages > 0
submit io
return
free_extent_buffer
release_extent_buffer
dec refs to 0
delete from radix tree
btrfs_release_extent_buffer_pages
BUG_ON(io_pages > 0)!!!
We observe this at a very low rate in production and were also able to
reproduce it in a test environment by introducing some spurious delays
and by introducing probabilistic trylock_page failures.
To fix it, we apply check_tree_ref at a point where it could not
possibly be unset by a competing task: after io_pages has been
incremented. All the codepaths that clear TREE_REF check for io, so they
would not be able to clear it after this point until the io is done.
Stack trace, for reference:
[1417839.424739] ------------[ cut here ]------------
[1417839.435328] kernel BUG at fs/btrfs/extent_io.c:4841!
[1417839.447024] invalid opcode: 0000 [#1] SMP
[1417839.502972] RIP: 0010:btrfs_release_extent_buffer_pages+0x20/0x1f0
[1417839.517008] Code: ed e9 ...
[1417839.558895] RSP: 0018:ffffc90020bcf798 EFLAGS: 00010202
[1417839.570816] RAX: 0000000000000002 RBX: ffff888102d6def0 RCX: 0000000000000028
[1417839.586962] RDX: 0000000000000002 RSI: ffff8887f0296482 RDI: ffff888102d6def0
[1417839.603108] RBP: ffff88885664a000 R08: 0000000000000046 R09: 0000000000000238
[1417839.619255] R10: 0000000000000028 R11: ffff88885664af68 R12: 0000000000000000
[1417839.635402] R13: 0000000000000000 R14: ffff88875f573ad0 R15: ffff888797aafd90
[1417839.651549] FS: 00007f5a844fa700(0000) GS:ffff88885f680000(0000) knlGS:0000000000000000
[1417839.669810] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1417839.682887] CR2: 00007f7884541fe0 CR3: 000000049f609002 CR4: 00000000003606e0
[1417839.699037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[1417839.715187] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[1417839.731320] Call Trace:
[1417839.737103] release_extent_buffer+0x39/0x90
[1417839.746913] read_block_for_search.isra.38+0x2a3/0x370
[1417839.758645] btrfs_search_slot+0x260/0x9b0
[1417839.768054] btrfs_lookup_file_extent+0x4a/0x70
[1417839.778427] btrfs_get_extent+0x15f/0x830
[1417839.787665] ? submit_extent_page+0xc4/0x1c0
[1417839.797474] ? __do_readpage+0x299/0x7a0
[1417839.806515] __do_readpage+0x33b/0x7a0
[1417839.815171] ? btrfs_releasepage+0x70/0x70
[1417839.824597] extent_readpages+0x28f/0x400
[1417839.833836] read_pages+0x6a/0x1c0
[1417839.841729] ? startup_64+0x2/0x30
[1417839.849624] __do_page_cache_readahead+0x13c/0x1a0
[1417839.860590] filemap_fault+0x6c7/0x990
[1417839.869252] ? xas_load+0x8/0x80
[1417839.876756] ? xas_find+0x150/0x190
[1417839.884839] ? filemap_map_pages+0x295/0x3b0
[1417839.894652] __do_fault+0x32/0x110
[1417839.902540] __handle_mm_fault+0xacd/0x1000
[1417839.912156] handle_mm_fault+0xaa/0x1c0
[1417839.921004] __do_page_fault+0x242/0x4b0
[1417839.930044] ? page_fault+0x8/0x30
[1417839.937933] page_fault+0x1e/0x30
[1417839.945631] RIP: 0033:0x33c4bae
[1417839.952927] Code: Bad RIP value.
[1417839.960411] RSP: 002b:00007f5a844f7350 EFLAGS: 00010206
[1417839.972331] RAX: 000000000000006e RBX: 1614b3ff6a50398a RCX: 0000000000000000
[1417839.988477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[1417840.004626] RBP: 00007f5a844f7420 R08: 000000000000006e R09: 00007f5a94aeccb8
[1417840.020784] R10: 00007f5a844f7350 R11: 0000000000000000 R12: 00007f5a94aecc79
[1417840.036932] R13: 00007f5a94aecc78 R14: 00007f5a94aecc90 R15: 00007f5a94aecc40
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit b5c8896bc1 which is
commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
It is being reverted upstream, just hasn't made it there yet and is
causing lots of problems.
Reported-by: Hans de Goede <hdegoede@redhat.com>
Cc: Qiujun Huang <hqjagain@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 63960260457a02af2a6cb35d75e6bdb17299c882 upstream.
When evaluating access control over kallsyms visibility, credentials at
open() time need to be used, not the "current" creds (though in BPF's
case, this has likely always been the same). Plumb access to associated
file->f_cred down through bpf_dump_raw_ok() and its callers now that
kallsysm_show_value() has been refactored to take struct cred.
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 7105e828c0 ("bpf: allow for correlation of maps and helpers in dump")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 60f7bb66b88b649433bf700acfc60c3f24953871 upstream.
The kprobe show() functions were using "current"'s creds instead
of the file opener's creds for kallsyms visibility. Fix to use
seq_file->file->f_cred.
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 81365a947d ("kprobes: Show address of kprobes if kallsyms does")
Fixes: ffb9bd68eb ("kprobes: Show blacklist addresses as same as kallsyms does")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ed66f991bb19d94cae5d38f77de81f96aac7813f upstream.
In order to gain access to the open file's f_cred for kallsym visibility
permission checks, refactor the module section attributes to use the
bin_attribute instead of attribute interface. Additionally removes the
redundant "name" struct member.
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 160251842cd35a75edfb0a1d76afa3eb674ff40a upstream.
In order to perform future tests against the cred saved during open(),
switch kallsyms_show_value() to operate on a cred, and have all current
callers pass current_cred(). This makes it very obvious where callers
are checking the wrong credential in their "read" contexts. These will
be fixed in the coming patches.
Additionally switch return value to bool, since it is always used as a
direct permission check, not a 0-on-success, negative-on-error style
function return.
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If SVE is enabled then 'ret' can be assigned the return value of
kvm_vcpu_enable_sve() which may be 0 causing future "goto out" sites to
erroneously return 0 on failure rather than -EINVAL as expected.
Remove the initialisation of 'ret' and make setting the return value
explicit to avoid this situation in the future.
Fixes: 9a3cdf26e3 ("KVM: arm64/sve: Allow userspace to enable SVE for vcpus")
Cc: stable@vger.kernel.org
Reported-by: James Morse <james.morse@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20200617105456.28245-1-steven.price@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
