Commit graph android_kernel_motorola_sm6375/kernel
Author SHA1 Message Date
Vincent Guittot
be192b51bf UPSTREAM: sched/fair: Prefer prev cpu in asymmetric wakeup path
During fast wakeup path, scheduler always check whether local or prev
cpus are good candidates for the task before looking for other cpus in
the domain. With commit b7a331615d25 ("sched/fair: Add asymmetric CPU
capacity wakeup scan") the heterogenous system gains a dedicated path
but doesn't try to reuse prev cpu whenever possible. If the previous
cpu is idle and belong to the LLC domain, we should check it 1st
before looking for another cpu because it stays one of the best
candidate and this also stabilizes task placement on the system.

This change aligns asymmetric path behavior with symmetric one and reduces
cases where the task migrates across all cpus of the sd_asym_cpucapacity
domains at wakeup.

This change does not impact normal EAS mode but only the overloaded case or
when EAS is not used.

- On hikey960 with performance governor (EAS disable)

./perf bench sched pipe -T -l 50000
             mainline           w/ patch
ops/sec        149313(+/-0.28%)   182587(+/- 0.40) +22%

- On hikey with performance governor

./perf bench sched pipe -T -l 50000
             mainline           w/ patch
ops/sec         47721(+/-0.76%)    47899(+/- 0.56) +0.4%

According to test on hikey, the patch doesn't impact symmetric system
compared to current implementation (only tested on arm64)

Also read the uclamped value of task's utilization at most twice instead
instead each time we compare task's utilization with cpu's capacity.

Fixes: b7a331615d25 ("sched/fair: Add asymmetric CPU capacity wakeup scan")
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20201029161824.26389-1-vincent.guittot@linaro.org
(cherry picked from commit b4c9c9f15649c98a5b45408919d1ff4fd7f5531c)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: Icaba6ae29d5bd23f87ca5492b778869be9e0d9c9
2021-05-03 20:55:31 -07:00
Masahiro Yamada
48ffcbf0b9 FROMGIT: kbuild: update config_data.gz only when the content of .config is changed
If the timestamp of the .config file is updated, config_data.gz is
regenerated, then vmlinux is re-linked. This occurs even if the content
of the .config has not changed at all.

This issue was mitigated by commit 67424f61f8 ("kconfig: do not write
.config if the content is the same"); Kconfig does not update the
.config when it ends up with the identical configuration.

The issue is remaining when the .config is created by *_defconfig with
some config fragment(s) applied on top.

This is typical for powerpc and mips, where several *_defconfig targets
are constructed by using merge_config.sh.

One workaround is to have the copy of the .config. The filechk rule
updates the copy, kernel/config_data, by checking the content instead
of the timestamp.

With this commit, the second run with the same configuration avoids
the needless rebuilds.

  $ make ARCH=mips defconfig all
   [ snip ]
  $ make ARCH=mips defconfig all
  *** Default configuration is based on target '32r2el_defconfig'
  Using ./arch/mips/configs/generic_defconfig as base
  Merging arch/mips/configs/generic/32r2.config
  Merging arch/mips/configs/generic/el.config
  Merging ./arch/mips/configs/generic/board-boston.config
  Merging ./arch/mips/configs/generic/board-ni169445.config
  Merging ./arch/mips/configs/generic/board-ocelot.config
  Merging ./arch/mips/configs/generic/board-ranchu.config
  Merging ./arch/mips/configs/generic/board-sead-3.config
  Merging ./arch/mips/configs/generic/board-xilfpga.config
  #
  # configuration written to .config
  #
    SYNC    include/config/auto.conf
    CALL    scripts/checksyscalls.sh
    CALL    scripts/atomic/check-atomics.sh
    CHK     include/generated/compile.h
    CHK     include/generated/autoksyms.h

Reported-by: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>

Bug: 179648610
(cherry picked from commit b33976d90d1ea7652fff662dcc2234f352346a33
 https://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git
 kbuild)
[eberman: Fixed minor conflicts in kernel/.gitignore]
Change-Id: I8c93147c8d5a48d0f5e9abf855870b10c1a24efc
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2021-04-28 12:57:52 -07:00
Matthias Maennich
9b465a062d ANDROID: Add OWNERS files referring to the respective android-mainline OWNERS
This was generated with
  $ build/synchronize_owners common-mainline/ android-mainline common11-5.4/

Bug: 184248201
Signed-off-by: Matthias Maennich <maennich@google.com>
Change-Id: I5e56eb34fcbb5a2a013dd03bc9dcc4f159fb90de
2021-04-01 13:45:14 +00:00
Frankie Chang
7285ca6e97 ANDROID: Add vendor hooks when syscall prctl finished
Add vendor hook when syscall prctl finished for vendor-specific tuning.

Bug: 181819699

Signed-off-by: Frankie Chang <frankie.chang@mediatek.com>
Change-Id: Ica42d80ab4b540045330e9c5b211e0e814eed0ff
(cherry picked from commit 6904f0001e4ec3c637539c18969e46755eaa01f4)
2021-03-09 21:57:07 +00:00
Frankie Chang
4b22a63233 ANDROID: cgroup: Add vendor hook to the cgroup
Add a vendor hook after attaching a task to a cgroup to 
recognize the group_id for performance tuning

Bug: 181917687

Signed-off-by: Frankie Chang <frankie.chang@mediatek.com>
Change-Id: I603afa3d893dd575a7dcb97f83bd9eacb8315bab
(cherry picked from commit bed1e2a75b0000d99a00177272b93e5c8430308b)
2021-03-09 21:56:56 +00:00
Frankie Chang
66da798d24 ANDROID: sched: move vendor hook to check scheduling nice value
move hook to collect scheduling information and apply vendor's
tuning before task's scheduling priority is changed

Bug: 163431711

Signed-off-by: Frankie Chang <frankie.chang@mediatek.com>
Change-Id: I61a7ab663316c0fbcb28d1b6e523649a6374b492
(cherry picked from commit 5cf5bc7523bd5608590de487de896c1026161a18)
2021-03-08 09:31:36 +00:00
Greg Kroah-Hartman
9394e52285 Merge tag 'android11-5.4.86_r00' from 'android11-5.4-lts' into 'android11-5.4'
This merges the 5.4.86 upstream LTS release into the android11-5.4
branch so that all devices can get the needed important security and
other bugfixes that are in here.  All devices must upgrade to remain
properly secure from known issues.

Bug: 180469075
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1041e0d08d55a3eb2e0f49b7d2384960f48d9b11
2021-02-17 16:57:46 +01:00
Maciej Żenczykowski
0934349866 BACKPORT: bpf: add bpf_ktime_get_boot_ns()
On a device like a cellphone which is constantly suspending
and resuming CLOCK_MONOTONIC is not particularly useful for
keeping track of or reacting to external network events.
Instead you want to use CLOCK_BOOTTIME.

Hence add bpf_ktime_get_boot_ns() as a mirror of bpf_ktime_get_ns()
based around CLOCK_BOOTTIME instead of CLOCK_MONOTONIC.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
(cherry picked from commit 71d19214776e61b33da48f7c1b46e522c7f78221)
Change-Id: Ifd62c410dcc5112fd1a473a7e1f70231ca514bc0
2021-02-12 01:58:59 -08:00
Thomas Gleixner
904fb159c9 UPSTREAM: futex: Handle faults correctly for PI futexes
commit 34b1a1ce1458f50ef27c54e28eb9b1947012907a upstream

fixup_pi_state_owner() tries to ensure that the state of the rtmutex,
pi_state and the user space value related to the PI futex are consistent
before returning to user space. In case that the user space value update
faults and the fault cannot be resolved by faulting the page in via
fault_in_user_writeable() the function returns with -EFAULT and leaves
the rtmutex and pi_state owner state inconsistent.

A subsequent futex_unlock_pi() operates on the inconsistent pi_state and
releases the rtmutex despite not owning it which can corrupt the RB tree of
the rtmutex and cause a subsequent kernel stack use after free.

It was suggested to loop forever in fixup_pi_state_owner() if the fault
cannot be resolved, but that results in runaway tasks which is especially
undesired when the problem happens due to a programming error and not due
to malice.

As the user space value cannot be fixed up, the proper solution is to make
the rtmutex and the pi_state consistent so both have the same owner. This
leaves the user space value out of sync. Any subsequent operation on the
futex will fail because the 10th rule of PI futexes (pi_state owner and
user space value are consistent) has been violated.

As a consequence this removes the inept attempts of 'fixing' the situation
in case that the current task owns the rtmutex when returning with an
unresolvable fault by unlocking the rtmutex which left pi_state::owner and
rtmutex::owner out of sync in a different and only slightly less dangerous
way.

Fixes: 1b7558e457 ("futexes: fix fault handling in futex_lock_pi")
Reported-by: gzobqq@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 34b1a1ce1458f50ef27c54e28eb9b1947012907a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iabd44dad5d4b8385b8a20e44d18308708cc3b701
2021-01-29 13:16:10 +01:00
Thomas Gleixner
dddad86240 UPSTREAM: futex: Simplify fixup_pi_state_owner()
commit f2dac39d93987f7de1e20b3988c8685523247ae2 upstream

Too many gotos already and an upcoming fix would make it even more
unreadable.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f2dac39d93987f7de1e20b3988c8685523247ae2)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a97587c0f696d4f4b849f7f106990a5587fa402
2021-01-29 13:16:01 +01:00
Thomas Gleixner
d245cfa173 UPSTREAM: futex: Use pi_state_update_owner() in put_pi_state()
commit 6ccc84f917d33312eb2846bd7b567639f585ad6d upstream

No point in open coding it. This way it gains the extra sanity checks.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6ccc84f917d33312eb2846bd7b567639f585ad6d)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic34513518cd4996b3eb4cb82b669d727be522597
2021-01-29 13:15:51 +01:00
Thomas Gleixner
cfe591bb90 UPSTREAM: rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
commit 2156ac1934166d6deb6cd0f6ffc4c1076ec63697 upstream

Nothing uses the argument. Remove it as preparation to use
pi_state_update_owner().

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2156ac1934166d6deb6cd0f6ffc4c1076ec63697)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I126088d93c5f05db654e508dfd4195e5c1696164
2021-01-29 13:15:42 +01:00
Thomas Gleixner
a60fba3000 UPSTREAM: futex: Provide and use pi_state_update_owner()
commit c5cade200ab9a2a3be9e7f32a752c8d86b502ec7 upstream

Updating pi_state::owner is done at several places with the same
code. Provide a function for it and use that at the obvious places.

This is also a preparation for a bug fix to avoid yet another copy of the
same code or alternatively introducing a completely unpenetratable mess of
gotos.

Originally-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c5cade200ab9a2a3be9e7f32a752c8d86b502ec7)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I17a67806a035338a55b27eea673d707fc4d8c529
2021-01-29 13:15:27 +01:00
Thomas Gleixner
97500641e2 UPSTREAM: futex: Replace pointless printk in fixup_owner()
commit 04b79c55201f02ffd675e1231d731365e335c307 upstream

If that unexpected case of inconsistent arguments ever happens then the
futex state is left completely inconsistent and the printk is not really
helpful. Replace it with a warning and make the state consistent.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 04b79c55201f02ffd675e1231d731365e335c307)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I32bd64130d9414f65155ecd80646d01eb4374a60
2021-01-29 13:15:18 +01:00
Thomas Gleixner
3a0f91fd81 UPSTREAM: futex: Ensure the correct return value from futex_lock_pi()
commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream

In case that futex_lock_pi() was aborted by a signal or a timeout and the
task returned without acquiring the rtmutex, but is the designated owner of
the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to
establish consistent state. In that case it invokes fixup_pi_state_owner()
which in turn tries to acquire the rtmutex again. If that succeeds then it
does not propagate this success to fixup_owner() and futex_lock_pi()
returns -EINTR or -ETIMEOUT despite having the futex locked.

Return success from fixup_pi_state_owner() in all cases where the current
task owns the rtmutex and therefore the futex and propagate it correctly
through fixup_owner(). Fixup the other callsite which does not expect a
positive return value.

Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6dfb7407620fdf8293edbfbe54463f0c8ff63a57
2021-01-29 13:15:05 +01:00
Dan Carpenter
364ec3d27d UPSTREAM: futex: Don't enable IRQs unconditionally in put_pi_state()
commit 1e106aa3509b86738769775969822ffc1ec21bf4 upstream.

The exit_pi_state_list() function calls put_pi_state() with IRQs disabled
and is not expecting that IRQs will be enabled inside the function.

Use the _irqsave() variant so that IRQs are restored to the original state
instead of being enabled unconditionally.

Fixes: 153fbd1226 ("futex: Fix more put_pi_state() vs. exit_pi_state_list() races")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106085205.GA1159983@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2192d905df)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I10bc011b54ffc6d66c0a499ecebfa5b2d96d58ce
2021-01-29 13:13:00 +01:00
Mike Galbraith
6f8f2dc71c UPSTREAM: futex: Handle transient "ownerless" rtmutex state correctly
commit 9f5d1c336a10c0d24e83e40b4c1b9539f7dba627 upstream.

Gratian managed to trigger the BUG_ON(!newowner) in fixup_pi_state_owner().
This is one possible chain of events leading to this:

Task Prio       Operation
T1   120	lock(F)
T2   120	lock(F)   -> blocks (top waiter)
T3   50 (RT)	lock(F)   -> boosts T1 and blocks (new top waiter)
XX   		timeout/  -> wakes T2
		signal
T1   50		unlock(F) -> wakes T3 (rtmutex->owner == NULL, waiter bit is set)
T2   120	cleanup   -> try_to_take_mutex() fails because T3 is the top waiter
     			     and the lower priority T2 cannot steal the lock.
     			  -> fixup_pi_state_owner() sees newowner == NULL -> BUG_ON()

The comment states that this is invalid and rt_mutex_real_owner() must
return a non NULL owner when the trylock failed, but in case of a queued
and woken up waiter rt_mutex_real_owner() == NULL is a valid transient
state. The higher priority waiter has simply not yet managed to take over
the rtmutex.

The BUG_ON() is therefore wrong and this is just another retry condition in
fixup_pi_state_owner().

Drop the locks, so that T3 can make progress, and then try the fixup again.

Gratian provided a great analysis, traces and a reproducer. The analysis is
to the point, but it confused the hell out of that tglx dude who had to
page in all the futex horrors again. Condensed version is above.

[ tglx: Wrote comment and changelog ]

Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Reported-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87a6w6x7bb.fsf@ni.com
Link: https://lore.kernel.org/r/87sg9pkvf7.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2716e78a64)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9ab0878641624448cacb1951506b5accb4c92a00
2021-01-29 13:12:13 +01:00
Mateusz Nosek
4fe499637b UPSTREAM: futex: Fix incorrect should_fail_futex() handling
[ Upstream commit 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 ]

If should_futex_fail() returns true in futex_wake_pi(), then the 'ret'
variable is set to -EFAULT and then immediately overwritten. So the failure
injection is non-functional.

Fix it by actually leaving the function and returning -EFAULT.

The Fixes tag is kinda blury because the initial commit which introduced
failure injection was already sloppy, but the below mentioned commit broke
it completely.

[ tglx: Massaged changelog ]

Fixes: 6b4f4bc9cb ("locking/futex: Allow low-level atomic operations to return -EAGAIN")
Signed-off-by: Mateusz Nosek <mateusznosek0@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20200927000858.24219-1-mateusznosek0@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2db7590371)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I22198b7a65630cb5649f3e889810783b147bfada
2021-01-29 13:12:05 +01:00
Yun Hsiang
b7f31af2f1 ANDROID: sched: add em_pd_energy vendor hook
We add a vendor hook for util to freq calculation in schedutil,
so we need to do corresponding change for energy calculation.

android_vh_em_pd_energy
	adjust energy calculation

Bug: 178021064

Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: Iae772cf07881602eea3f27aeb75fba753e7c2635
2021-01-21 10:32:49 +08:00
Yun Hsiang
68ecddcda8 ANDROID: schedutil: add vendor hook for adjusting util to freq calculation
Currently, the frequency is calculated by max freq * 1.25 * util / max cap.
Add a vendor hook to adjust the frequency when the calculation
overestimate.

android_vh_map_util_freq
	adjust util to freq calculation

Bug: 177845438

Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: I9aa9079f00af7d3380b19f2fe21b75cddd107d15
2021-01-19 19:02:47 +00:00
Greg Kroah-Hartman
d45416b62b This is the 5.4.86 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/sW9MACgkQONu9yGCS
 aT5SwBAAo6dgHqwmPfuf98/8oVeVqTxcmE7GpzpVRH2+yI7Zwk2ez29tAflcM7lT
 LKtR2WFGAxoCL4DUKXeO7Ubwpue5NoBIsJ8/dAYBesojps3WDaFGL55PvJLWwFJ7
 5gPtPzynITaqIC1JCFcrJ7OTp7REiCUZRc1CJXJINWAYL1VbEbH8pH904xfFcivy
 XnNyL9UiWp1lSB8oF3CRJOaK5M5gY1+wdCFaLVqQn306XDEM8PvZK4G3at/jXWgH
 jQjArdtC8M8NwjyTwtqW9JAMV+6CD0/HXk0QboTZg6yiaRrtUsfzMqJ1cvhKcQgO
 kLE3rwdnr3/MxuzSnGWbswflG2WCutoah58g0uN8H0nCiui5mKN6x5K+emgDZIoO
 ndDnh+/5OE247EK+3CGn/0N8i/fOymrLAnLL4wCXVdlQLMCalnL37ibdfGbAptXi
 N3GOGZ2iEglvTsEr5w0r86+AzNskm5EqA7mFGFiAyf9viR2xwYk3RrWf2ZyMRos2
 2S7mKcZmw7voDu2TIDIhqydToBKxmYI/mUn3mFFme1h3lwzM3zYG1aovVLfd5NkY
 Gx5E/CA/ut/3n0u/dXJ8SxEitBWkqImp5UdYcElQNxQoXnVU4yKmjf6dDL9Wqh+1
 ujCiaCUJd3PY0uXXIb6RWWGs2VaL4xiEnk+ZBm0VI9WEUWksSx0=
 =jnmv
 -----END PGP SIGNATURE-----

Merge 5.4.86 into android11-5.4-lts

Changes in 5.4.86
	ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator
	ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node
	pinctrl: merrifield: Set default bias in case no particular value given
	pinctrl: baytrail: Avoid clearing debounce value when turning it off
	ARM: dts: sun8i: v3s: fix GIC node memory range
	ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY
	ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp
	ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin
	PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
	gpio: zynq: fix reference leak in zynq_gpio functions
	gpio: mvebu: fix potential user-after-free on probe
	scsi: bnx2i: Requires MMU
	xsk: Fix xsk_poll()'s return type
	xsk: Replace datagram_poll by sock_poll_wait
	can: softing: softing_netdev_open(): fix error handling
	clk: renesas: r9a06g032: Drop __packed for portability
	block: Simplify REQ_OP_ZONE_RESET_ALL handling
	block: factor out requeue handling from dispatch code
	blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick
	pinctrl: aspeed: Fix GPIO requests on pass-through banks
	netfilter: x_tables: Switch synchronization to RCU
	netfilter: nft_compat: make sure xtables destructors have run
	netfilter: nft_dynset: fix timeouts later than 23 days
	afs: Fix memory leak when mounting with multiple source parameters
	Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()"
	gpio: eic-sprd: break loop when getting NULL device resource
	netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
	selftests/bpf/test_offload.py: Reset ethtool features after failed setting
	RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
	i40e: Refactor rx_bi accesses
	i40e: optimise prefetch page refcount
	i40e: avoid premature Rx buffer reuse
	ixgbe: avoid premature Rx buffer reuse
	selftests: fix poll error in udpgro.sh
	net: mvpp2: add mvpp2_phylink_to_port() helper
	drm/tegra: replace idr_init() by idr_init_base()
	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
	drm/tegra: sor: Disable clocks on error in tegra_sor_init()
	habanalabs: put devices before driver removal
	arm64: syscall: exit userspace before unmasking exceptions
	vxlan: Add needed_headroom for lower device
	vxlan: Copy needed_tailroom from lowerdev
	scsi: mpt3sas: Increase IOCInit request timeout to 30s
	dm table: Remove BUG_ON(in_interrupt())
	iwlwifi: pcie: add one missing entry for AX210
	drm/amd/display: Init clock value by current vbios CLKs
	perf/x86/intel: Check PEBS status correctly
	kbuild: avoid split lines in .mod files
	soc/tegra: fuse: Fix index bug in get_process_id
	usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
	USB: serial: option: add interface-number sanity check to flag handling
	USB: gadget: f_acm: add support for SuperSpeed Plus
	USB: gadget: f_midi: setup SuperSpeed Plus descriptors
	usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
	USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
	usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
	ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
	ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
	ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
	coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
	coresight: tmc-etr: Check if page is valid before dma_map_page()
	coresight: tmc-etr: Fix barrier packet insertion for perf buffer
	coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()
	scsi: megaraid_sas: Check user-provided offsets
	HID: i2c-hid: add Vero K147 to descriptor override
	serial_core: Check for port state when tty is in error state
	Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
	quota: Sanity-check quota file headers on load
	media: msi2500: assign SPI bus number dynamically
	crypto: af_alg - avoid undefined behavior accessing salg_name
	md: fix a warning caused by a race between concurrent md_ioctl()s
	drm/gma500: fix double free of gma_connector
	drm/aspeed: Fix Kconfig warning & subsequent build errors
	drm/mcde: Fix handling of platform_get_irq() error
	drm/tve200: Fix handling of platform_get_irq() error
	arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node
	arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node
	soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
	soc: mediatek: Check if power domains can be powered on at boot time
	soc: qcom: geni: More properly switch to DMA mode
	Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
	RDMA/bnxt_re: Set queue pair state when being queried
	rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
	selinux: fix error initialization in inode_doinit_with_dentry()
	ARM: dts: aspeed: s2600wf: Fix VGA memory region location
	RDMA/rxe: Compute PSN windows correctly
	x86/mm/ident_map: Check for errors from ident_pud_init()
	ARM: p2v: fix handling of LPAE translation in BE mode
	x86/apic: Fix x2apic enablement without interrupt remapping
	sched/deadline: Fix sched_dl_global_validate()
	sched: Reenable interrupts in do_sched_yield()
	drm/amdgpu: fix incorrect enum type
	crypto: talitos - Endianess in current_desc_hdr()
	crypto: talitos - Fix return type of current_desc_hdr()
	crypto: inside-secure - Fix sizeof() mismatch
	ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
	ARM: dts: aspeed: tiogapass: Remove vuart
	drm/amdgpu: fix build_coefficients() argument
	powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
	spi: img-spfi: fix reference leak in img_spfi_resume
	f2fs: call f2fs_get_meta_page_retry for nat page
	drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
	spi: spi-mem: fix reference leak in spi_mem_access_start
	ASoC: pcm: DRAIN support reactivation
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	spi: stm32: fix reference leak in stm32_spi_resume
	brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
	arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
	arm64: dts: exynos: Correct psci compatible used on Exynos7
	Bluetooth: Fix null pointer dereference in hci_event_packet()
	Bluetooth: hci_h5: fix memory leak in h5_close
	spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
	spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
	spi: tegra20-slink: fix reference leak in slink ops of tegra20
	spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
	spi: tegra114: fix reference leak in tegra spi ops
	spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
	mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
	selftest/bpf: Add missed ip6ip6 test back
	ASoC: wm8998: Fix PM disable depth imbalance on error
	spi: sprd: fix reference leak in sprd_spi_remove
	ASoC: arizona: Fix a wrong free in wm8997_probe
	RDMa/mthca: Work around -Wenum-conversion warning
	MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
	crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
	staging: greybus: codecs: Fix reference counter leak in error handling
	staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
	media: tm6000: Fix sizeof() mismatches
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()
	media: v4l2-fwnode: Return -EINVAL for invalid bus-type
	ASoC: meson: fix COMPILE_TEST error
	scsi: core: Fix VPD LUN ID designator priorities
	media: solo6x10: fix missing snd_card_free in error handling case
	video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
	drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
	Input: ads7846 - fix race that causes missing releases
	Input: ads7846 - fix integer overflow on Rt calculation
	Input: ads7846 - fix unaligned access on 7845
	usb/max3421: fix return error code in max3421_probe()
	spi: mxs: fix reference leak in mxs_spi_probe
	selftests/bpf: Fix broken riscv build
	powerpc: Avoid broken GCC __attribute__((optimize))
	powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
	EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
	crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
	crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
	spi: fix resource leak for drivers without .remove callback
	soc: ti: knav_qmss: fix reference leak in knav_queue_probe
	soc: ti: Fix reference imbalance in knav_dma_probe
	drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
	Input: omap4-keypad - fix runtime PM error handling
	clk: meson: Kconfig: fix dependency for G12A
	RDMA/cxgb4: Validate the number of CQEs
	memstick: fix a double-free bug in memstick_check
	ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
	ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
	mmc: pxamci: Fix error return code in pxamci_probe
	orinoco: Move context allocation after processing the skb
	qtnfmac: fix error return code in qtnf_pcie_probe()
	rsi: fix error return code in rsi_reset_card()
	cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
	dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
	arm64: tegra: Fix DT binding for IO High Voltage entry
	media: siano: fix memory leak of debugfs members in smsdvb_hotplug
	platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
	platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
	samples: bpf: Fix lwt_len_hist reusing previous BPF map
	media: imx214: Fix stop streaming
	mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
	media: max2175: fix max2175_set_csm_mode() error code
	slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
	ARM: dts: Remove non-existent i2c1 from 98dx3236
	arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
	arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
	power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
	power: supply: bq24190_charger: fix reference leak
	genirq/irqdomain: Don't try to free an interrupt that has no mapping
	arm64: dts: ls1028a: fix ENETC PTP clock input
	arm64: dts: qcom: c630: Polish i2c-hid devices
	PCI: Bounds-check command-line resource alignment requests
	PCI: Fix overflow in command-line resource alignment requests
	PCI: iproc: Fix out-of-bound array accesses
	arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
	arm64: dts: meson-sm1: fix typo in opp table
	soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()
	ARM: dts: at91: at91sam9rl: fix ADC triggers
	platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
	ath10k: Fix the parsing error in service available event
	ath10k: Fix an error handling path
	ath10k: Release some resources in an error handling path
	SUNRPC: rpc_wake_up() should wake up tasks in the correct order
	NFSv4.2: condition READDIR's mask for security label based on LSM state
	SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
	NFSv4: Fix the alignment of page data in the getdeviceinfo reply
	net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
	lockd: don't use interval-based rebinding over TCP
	NFS: switch nfsiod to be an UNBOUND workqueue.
	selftests/seccomp: Update kernel config
	vfio-pci: Use io_remap_pfn_range() for PCI IO memory
	hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable
	media: saa7146: fix array overflow in vidioc_s_audio()
	powerpc/perf: Fix crash with is_sier_available when pmu is not set
	powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
	clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path
	clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
	iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context
	ARM: dts: at91: sama5d2: map securam as device
	bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
	pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
	arm64: dts: rockchip: Fix UART pull-ups on rk3328
	memstick: r592: Fix error return in r592_probe()
	MIPS: Don't round up kernel sections size for memblock_add()
	net/mlx5: Properly convey driver version to firmware
	ASoC: jz4740-i2s: add missed checks for clk_get()
	dm ioctl: fix error return code in target_message
	phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
	clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne
	clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
	cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
	cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
	cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
	cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
	cpufreq: st: Add missing MODULE_DEVICE_TABLE
	cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
	cpufreq: loongson1: Add missing MODULE_ALIAS
	cpufreq: scpi: Add missing MODULE_ALIAS
	Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()
	Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()
	arm64: dts: meson: fix PHY deassert timing requirements
	ARM: dts: meson: fix PHY deassert timing requirements
	arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements
	scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
	scsi: pm80xx: Fix error return in pm8001_pci_probe()
	seq_buf: Avoid type mismatch for seq_buf_init
	scsi: fnic: Fix error return code in fnic_probe()
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
	powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
	powerpc/pseries/hibernation: remove redundant cacheinfo update
	drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
	ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
	powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
	usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
	usb: oxu210hp-hcd: Fix memory leak in oxu_create
	speakup: fix uninitialized flush_lock
	nfsd: Fix message level for normal termination
	nfs_common: need lock during iterate through the list
	x86/kprobes: Restore BTF if the single-stepping is cancelled
	platform/chrome: cros_ec_spi: Don't overwrite spi::mode
	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
	s390/cio: fix use-after-free in ccw_device_destroy_console
	iwlwifi: mvm: hook up missing RX handlers
	erofs: avoid using generic_block_bmap
	can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit
	RDMA/core: Do not indicate device ready when device enablement fails
	remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
	remoteproc: qcom: fix reference leak in adsp_start
	remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
	clk: tegra: Fix duplicated SE clock entry
	mtd: rawnand: gpmi: fix reference count leak in gpmi ops
	mtd: rawnand: meson: Fix a resource leak in init
	mtd: rawnand: gpmi: Fix the random DMA timeout issue
	extcon: max77693: Fix modalias string
	crypto: atmel-i2c - select CONFIG_BITREVERSE
	mac80211: don't set set TDLS STA bandwidth wider than possible
	ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
	irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
	watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
	watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
	watchdog: sprd: remove watchdog disable from resume fail path
	watchdog: sprd: check busy bit before new loading rather than after that
	watchdog: Fix potential dereferencing of null pointer
	ubifs: Fix error return code in ubifs_init_authentication()
	um: Monitor error events in IRQ controller
	um: tty: Fix handling of close in tty lines
	um: chan_xterm: Fix fd leak
	sunrpc: fix xs_read_xdr_buf for partial pages receive
	RDMA/cma: Don't overwrite sgid_attr after device is released
	nfc: s3fwrn5: Release the nfc firmware
	powerpc/ps3: use dma_mapping_error()
	sparc: fix handling of page table constructor failure
	mm: don't wake kswapd prematurely when watermark boosting is disabled
	checkpatch: fix unescaped left brace
	lan743x: fix rx_napi_poll/interrupt ping-pong
	net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
	net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
	net: korina: fix return value
	libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
	watchdog: qcom: Avoid context switch in restart handler
	watchdog: coh901327: add COMMON_CLK dependency
	clk: ti: Fix memleak in ti_fapll_synth_setup
	pwm: zx: Add missing cleanup in error path
	pwm: lp3943: Dynamically allocate PWM chip base
	perf record: Fix memory leak when using '--user-regs=?' to list registers
	qlcnic: Fix error code in probe
	virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
	virtio_net: Fix error code in probe()
	virtio_ring: Fix two use after free bugs
	clk: at91: sam9x60: remove atmel,osc-bypass support
	clk: s2mps11: Fix a resource leak in error handling paths in the probe function
	clk: sunxi-ng: Make sure divider tables have sentinel
	kconfig: fix return value of do_error_if()
	perf probe: Fix memory leak when synthesizing SDT probes
	ARM: sunxi: Add machine match for the Allwinner V3 SoC
	cfg80211: initialize rekey_data
	fix namespaced fscaps when !CONFIG_SECURITY
	lwt: Disable BH too in run_lwt_bpf()
	drm/amd/display: Prevent bandwidth overflow
	drm/amdkfd: Fix leak in dmabuf import
	Input: cros_ec_keyb - send 'scancodes' in addition to key events
	initramfs: fix clang build failure
	Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
	vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU
	media: gspca: Fix memory leak in probe
	media: sunxi-cir: ensure IR is handled when it is continuous
	media: netup_unidvb: Don't leak SPI master in probe error path
	media: ipu3-cio2: Remove traces of returned buffers
	media: ipu3-cio2: Return actual subdev format
	media: ipu3-cio2: Serialise access to pad format
	media: ipu3-cio2: Validate mbus format in setting subdev format
	media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
	Input: cyapa_gen6 - fix out-of-bounds stack access
	ALSA: hda/ca0132 - Change Input Source enum strings.
	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
	Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
	ACPI: PNP: compare the string length in the matching_id()
	ALSA: hda: Fix regressions on clear and reconfig sysfs
	ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
	ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
	ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
	ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
	ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
	ALSA: pcm: oss: Fix a few more UBSAN fixes
	ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
	ALSA: hda/realtek: Add quirk for MSI-GP73
	ALSA: hda/realtek: Apply jack fixup for Quanta NL3
	ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
	ALSA: usb-audio: Disable sample read check if firmware doesn't give back
	ALSA: core: memalloc: add page alignment for iram
	s390/smp: perform initial CPU reset also for SMT siblings
	s390/kexec_file: fix diag308 subcode when loading crash kernel
	s390/dasd: fix hanging device offline processing
	s390/dasd: prevent inconsistent LCU device data
	s390/dasd: fix list corruption of pavgroup group list
	s390/dasd: fix list corruption of lcu list
	binder: add flag to clear buffer on txn complete
	ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams
	staging: comedi: mf6x4: Fix AI end-of-conversion detection
	perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY
	perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
	powerpc/perf: Exclude kernel samples while counting events in user space.
	crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
	crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata
	EDAC/i10nm: Use readl() to access MMIO registers
	EDAC/amd64: Fix PCI component registration
	cpuset: fix race between hotplug work and later CPU offline
	USB: serial: mos7720: fix parallel-port state restore
	USB: serial: digi_acceleport: fix write-wakeup deadlocks
	USB: serial: keyspan_pda: fix dropped unthrottle interrupts
	USB: serial: keyspan_pda: fix write deadlock
	USB: serial: keyspan_pda: fix stalled writes
	USB: serial: keyspan_pda: fix write-wakeup use-after-free
	USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
	USB: serial: keyspan_pda: fix write unthrottling
	btrfs: do not shorten unpin len for caching block groups
	btrfs: trim: fix underflow in trim length to prevent access beyond device boundary
	ext4: fix a memory leak of ext4_free_data
	ext4: fix deadlock with fs freezing and EA inodes
	KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
	ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
	ARM: dts: at91: sama5d2: fix CAN message ram offset and size
	xprtrdma: Fix XDRBUF_SPARSE_PAGES support
	powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
	powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
	powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE
	powerpc/xmon: Change printk() to pr_cont()
	powerpc/8xx: Fix early debug when SMC1 is relocated
	powerpc/mm: Fix verification of MMU_FTR_TYPE_44x
	powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
	powerpc/powernv/memtrace: Don't leak kernel memory to user space
	powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
	ima: Don't modify file descriptor mode on the fly
	um: Remove use of asprinf in umid.c
	ceph: fix race in concurrent __ceph_remove_cap invocations
	SMB3: avoid confusing warning message on mount to Azure
	ubifs: wbuf: Don't leak kernel memory to flash
	jffs2: Fix GC exit abnormally
	jffs2: Fix ignoring mounting options problem during remounting
	jfs: Fix array index bounds check in dbAdjTree
	platform/x86: mlx-platform: remove an unused variable
	drm/amd/display: Fix memory leaks in S3 resume
	drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
	drm/i915: Fix mismatch between misplaced vma check and vma insert
	spi: pxa2xx: Fix use-after-free on unbind
	spi: spi-sh: Fix use-after-free on unbind
	spi: atmel-quadspi: Fix use-after-free on unbind
	spi: davinci: Fix use-after-free on unbind
	spi: fsl: fix use of spisel_boot signal on MPC8309
	spi: gpio: Don't leak SPI master in probe error path
	spi: mxic: Don't leak SPI master in probe error path
	spi: pic32: Don't leak DMA channels in probe error path
	spi: rb4xx: Don't leak SPI master in probe error path
	spi: sc18is602: Don't leak SPI master in probe error path
	spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
	spi: synquacer: Disable clock in probe error path
	spi: mt7621: Disable clock in probe error path
	spi: mt7621: Don't leak SPI master in probe error path
	spi: atmel-quadspi: Disable clock in probe error path
	spi: atmel-quadspi: Fix AHB memory accesses
	soc: qcom: smp2p: Safely acquire spinlock without IRQs
	mtd: spinand: Fix OOB read
	mtd: parser: cmdline: Fix parsing of part-names with colons
	mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
	mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments
	scsi: qla2xxx: Fix crash during driver load on big endian machines
	scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
	scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
	iio: buffer: Fix demux update
	iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
	iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
	iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
	iio:magnetometer:mag3110: Fix alignment and data leak issues.
	iio:pressure:mpl3115: Force alignment of buffer
	iio:imu:bmi160: Fix too large a buffer.
	iio:adc:ti-ads124s08: Fix buffer being too long.
	iio:adc:ti-ads124s08: Fix alignment and data leak issues.
	md/cluster: block reshape with remote resync job
	md/cluster: fix deadlock when node is doing resync job
	pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
	clk: ingenic: Fix divider calculation with div tables
	clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
	clk: tegra: Do not return 0 on failure
	device-dax/core: Fix memory leak when rmmod dax.ko
	dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
	xen-blkback: set ring->xenblkd to NULL after kthread_stop()
	xen/xenbus: Allow watches discard events before queueing
	xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
	xen/xenbus/xen_bus_type: Support will_handle watch callback
	xen/xenbus: Count pending messages for each watch
	xenbus/xenbus_backend: Disallow pending watch messages
	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
	platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
	PCI: Fix pci_slot_release() NULL pointer dereference
	regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
	rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
	Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
	x86/CPU/AMD: Save AMD NodeId as cpu_die_id
	Linux 5.4.86

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If271639b9a7c833718f8cfdfbacce5affe7f4189
2020-12-30 12:31:14 +01:00
Steven Rostedt (VMware)
6001db0272 Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
commit adab66b71abfe206a020f11e561f4df41f0b2aba upstream.

It was believed that metag was the only architecture that required the ring
buffer to keep 8 byte words aligned on 8 byte architectures, and with its
removal, it was assumed that the ring buffer code did not need to handle
this case. It appears that sparc64 also requires this.

The following was reported on a sparc64 boot up:

   kernel: futex hash table entries: 65536 (order: 9, 4194304 bytes, linear)
   kernel: Running postponed tracer tests:
   kernel: Testing tracer function:
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: PASSED

Need to put back the 64BIT aligned code for the ring buffer.

Link: https://lore.kernel.org/r/CADxRZqzXQRYgKc=y-KV=S_yHL+Y8Ay2mh5ezeZUnpRvg+syWKw@mail.gmail.com

Cc: stable@vger.kernel.org
Fixes: 86b3de60a0 ("ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS")
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:51:47 +01:00
Daniel Jordan
6eab3f646b cpuset: fix race between hotplug work and later CPU offline
commit 406100f3da08066c00105165db8520bbc7694a36 upstream.

One of our machines keeled over trying to rebuild the scheduler domains.
Mainline produces the same splat:

  BUG: unable to handle page fault for address: 0000607f820054db
  CPU: 2 PID: 149 Comm: kworker/1:1 Not tainted 5.10.0-rc1-master+ #6
  Workqueue: events cpuset_hotplug_workfn
  RIP: build_sched_domains
  Call Trace:
   partition_sched_domains_locked
   rebuild_sched_domains_locked
   cpuset_hotplug_workfn

It happens with cgroup2 and exclusive cpusets only.  This reproducer
triggers it on an 8-cpu vm and works most effectively with no
preexisting child cgroups:

  cd $UNIFIED_ROOT
  mkdir cg1
  echo 4-7 > cg1/cpuset.cpus
  echo root > cg1/cpuset.cpus.partition

  # with smt/control reading 'on',
  echo off > /sys/devices/system/cpu/smt/control

RIP maps to

  sd->shared = *per_cpu_ptr(sdd->sds, sd_id);

from sd_init().  sd_id is calculated earlier in the same function:

  cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
  sd_id = cpumask_first(sched_domain_span(sd));

tl->mask(cpu), which reads cpu_sibling_map on x86, returns an empty mask
and so cpumask_first() returns >= nr_cpu_ids, which leads to the bogus
value from per_cpu_ptr() above.

The problem is a race between cpuset_hotplug_workfn() and a later
offline of CPU N.  cpuset_hotplug_workfn() updates the effective masks
when N is still online, the offline clears N from cpu_sibling_map, and
then the worker uses the stale effective masks that still have N to
generate the scheduling domains, leading the worker to read
N's empty cpu_sibling_map in sd_init().

rebuild_sched_domains_locked() prevented the race during the cgroup2
cpuset series up until the Fixes commit changed its check.  Make the
check more robust so that it can detect an offline CPU in any exclusive
cpuset's effective mask, not just the top one.

Fixes: 0ccea8feb9 ("cpuset: Make generate_sched_domains() work with partition")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201112171711.639541-1-daniel.m.jordan@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:51:36 +01:00
Andrii Nakryiko
08e2271060 bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
[ Upstream commit 12cc126df82c96c89706aa207ad27c56f219047c ]

__module_address() needs to be called with preemption disabled or with
module_mutex taken. preempt_disable() is enough for read-only uses, which is
what this fix does. Also, module_put() does internal check for NULL, so drop
it as well.

Fixes: a38d1107f9 ("bpf: support raw tracepoints in modules")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201203204634.1325171-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:51:18 +01:00
Marc Zyngier
a85f3e7cb7 genirq/irqdomain: Don't try to free an interrupt that has no mapping
[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]

When an interrupt allocation fails for N interrupts, it is pretty
common for the error handling code to free the same number of interrupts,
no matter how many interrupts have actually been allocated.

This may result in the domain freeing code to be unexpectedly called
for interrupts that have no mapping in that domain. Things end pretty
badly.

Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
that thiss does not follow the hierarchy if no mapping exists for a given
interrupt.

Fixes: 6a6544e520 ("genirq/irqdomain: Remove auto-recursive hierarchy support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:51:14 +01:00
Thomas Gleixner
52f525f2bd sched: Reenable interrupts in do_sched_yield()
[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]

do_sched_yield() invokes schedule() with interrupts disabled which is
not allowed. This goes back to the pre git era to commit a6efb709806c
("[PATCH] irqlock patch 2.5.27-H6") in the history tree.

Reenable interrupts and remove the misleading comment which "explains" it.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:51:03 +01:00
Peng Liu
35975f2e83 sched/deadline: Fix sched_dl_global_validate()
[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]

When change sched_rt_{runtime, period}_us, we validate that the new
settings should at least accommodate the currently allocated -dl
bandwidth:

  sched_rt_handler()
    -->	sched_dl_bandwidth_validate()
	{
		new_bw = global_rt_runtime()/global_rt_period();

		for_each_possible_cpu(cpu) {
			dl_b = dl_bw_of(cpu);
			if (new_bw < dl_b->total_bw)    <-------
				ret = -EBUSY;
		}
	}

But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
dl_b->total_bw is the allocated bandwidth of the whole root domain.
Instead, we should compare dl_b->total_bw against "cpus*new_bw",
where 'cpus' is the number of CPUs of the root domain.

Also, below annotation(in kernel/sched/sched.h) implied implementation
only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
evolving till got merged(v9), but the annotation remains unchanged,
meaningless and misleading, update it.

* With respect to SMP, the bandwidth is given on a per-CPU basis,
* meaning that:
*  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
*  - dl_total_bw array contains, in the i-eth element, the currently
*    allocated bandwidth on the i-eth CPU.

[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/

Fixes: 332ac17ef5 ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:51:03 +01:00
Nicholas Piggin
9b6ebb202b kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]

powerpc/64s keeps a counter in the mm which counts bits set in
mm_cpumask as well as other things. This means it can't use generic code
to clear bits out of the mask and doesn't adjust the arch specific
counter.

Add an arch override that allows powerpc/64s to use
clear_tasks_mm_cpumask().

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:50:56 +01:00
Greg Kroah-Hartman
56fc69923f This is the 5.4.85 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/glK0ACgkQONu9yGCS
 aT5W7A/9Fosi7yNmr9UI/IjjcvDzy2ecA/8Je/WHx9Q5AGUvPhaO9hiciuic3vIQ
 hh8TgKl/8+ZHuiKGXi89G1S7VIeZrCqz55wBpWSgaPsZ9zJzHFh65aSIsoN+Rlmy
 FLHr7BKxchmNgvtVcoO8gpgV2NsxRmJ8+NKWXIRmVzBe5oyyLLOtVsN96htq8jrx
 IrqqtpjVSzlP2enEVPsC0Xw6piK5xaWriQS5W8S1y5awP6Dets+T8CWlBvuoaBCH
 KzISleJF/R5sP4U4+4j6OwEzzPUqxMnCsYrATUOcu/pGGqwRZCVtY4JhxccMCZw6
 Q5gsvbcVTrz3IFyhMI7KL28+YvAOeQ67zOim6ucztgNXDYCMbc+uTxCDRERPr5Pl
 oiCfW42X8Z3Alt8KugDhjh6XYmMVS3u5tOQEaNoPC1mv+WGMJy6Szsq+NgJfbeqC
 8Fszz/1MQtPBBk/wVOvtNybNy+0W4sBGaUq98TtrfnfZtsuM/FrJiCgXTB9pqGxH
 Bq6R8BUsGeFEWzDDe29BoFJBXGpZ8Ox0/LKmBM7z2jWBZldH6DC54LhWaQgsLAMO
 UPGVCtfKNQXnJ/0bO5RSgikD9iTQyFBs5nhreJcXMsTPxI/5wXEkw6MDrvYXLTHE
 C6H6TarzGwlUcicc+UYCVplSTy+4D1sGbH95Rz0cMJHRyojKl8E=
 =9HIQ
 -----END PGP SIGNATURE-----

Merge 5.4.85 into android11-5.4-lts

Changes in 5.4.85
	ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info()
	ipv4: fix error return code in rtm_to_fib_config()
	mac80211: mesh: fix mesh_pathtbl_init() error path
	net: bridge: vlan: fix error return code in __vlan_add()
	vrf: packets with lladdr src needs dst at input with orig_iif when needs strict
	net: hns3: remove a misused pragma packed
	udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments
	enetc: Fix reporting of h/w packet counters
	bridge: Fix a deadlock when enabling multicast snooping
	net: stmmac: free tx skb buffer in stmmac_resume()
	tcp: select sane initial rcvq_space.space for big MSS
	tcp: fix cwnd-limited bug for TSO deferral where we send nothing
	net/mlx4_en: Avoid scheduling restart task if it is already running
	lan743x: fix for potential NULL pointer dereference with bare card
	net/mlx4_en: Handle TX error CQE
	net: ll_temac: Fix potential NULL dereference in temac_probe()
	net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
	net: stmmac: delete the eee_ctrl_timer after napi disabled
	ktest.pl: If size of log is too big to email, email error message
	USB: dummy-hcd: Fix uninitialized array use in init()
	USB: add RESET_RESUME quirk for Snapscan 1212
	ALSA: usb-audio: Fix potential out-of-bounds shift
	ALSA: usb-audio: Fix control 'access overflow' errors from chmap
	xhci: Give USB2 ports time to enter U3 in bus suspend
	xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP
	USB: UAS: introduce a quirk to set no_write_same
	USB: sisusbvga: Make console support depend on BROKEN
	ALSA: pcm: oss: Fix potential out-of-bounds shift
	serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
	KVM: mmu: Fix SPTE encoding of MMIO generation upper half
	Revert "selftests/ftrace: check for do_sys_openat2 in user-memory test"
	membarrier: Explicitly sync remote cores when SYNC_CORE is requested
	x86/resctrl: Remove unused struct mbm_state::chunks_bw
	x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
	Linux 5.4.85

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0bdddb0770a6d417cb67dc8a977c583315091b01
2020-12-21 14:20:44 +01:00
Greg Kroah-Hartman
a4b874cbaa Merge branch 'android11-5.4' into 'android11-5.4-lts'
Sync up with android11-5.4 for the following commit:

be72a6b8ee ANDROID: ABI: add allowed list for Exynosauto SoC
ae8d097e36 ANDROID: ABI: update allowed list for exynosauto SoC
ed5c049cad ANDROID: sched: Export sched_setattr_nocheck
e0b1644a47 BACKPORT: dmabuf: fix NULL pointer dereference in dma_buf_release()
5d835560a3 ANDROID: mm/memblock: export memblock_end_of_DRAM

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4bfd4180294669cac51b22f9cc5db518b31b28be
2020-12-21 13:30:59 +01:00
Andy Lutomirski
c4f9094070 membarrier: Explicitly sync remote cores when SYNC_CORE is requested
commit 758c9373d84168dc7d039cf85a0e920046b17b41 upstream.

membarrier() does not explicitly sync_core() remote CPUs; instead, it
relies on the assumption that an IPI will result in a core sync.  On x86,
this may be true in practice, but it's not architecturally reliable.  In
particular, the SDM and APM do not appear to guarantee that interrupt
delivery is serializing.  While IRET does serialize, IPI return can
schedule, thereby switching to another task in the same mm that was
sleeping in a syscall.  The new task could then SYSRET back to usermode
without ever executing IRET.

Make this more robust by explicitly calling sync_core_before_usermode()
on remote cores.  (This also helps people who search the kernel tree for
instances of sync_core() and sync_core_before_usermode() -- one might be
surprised that the core membarrier code doesn't currently show up in a
such a search.)

Fixes: 70216e18e5 ("membarrier: Provide core serializing command, *_SYNC_CORE")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/776b448d5f7bd6b12690707f5ed67bcda7f1d427.1607058304.git.luto@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-21 13:27:07 +01:00
J. Avila
ed5c049cad ANDROID: sched: Export sched_setattr_nocheck
This symbol is needed for certain vendor modules which cannot rely on
only the sysfs interface for uclamp alone.

Bug: 170697030
Signed-off-by: J. Avila <elavila@google.com>
Change-Id: Ic904ade83a45d259cfc95501e6b81e6c5a0e90a0
(cherry picked from commit 0edac9cb95fb2fa292a4b25ac77b125cde28b674)
2020-12-15 19:05:06 +00:00
Greg Kroah-Hartman
d95c7807b5 ANDROID: GKI: bring back irq_create_mapping()
Upstream commit bb4c6910c8b4 ("genirq/irqdomain: Add an
irq_create_mapping_affinity() function") ended up removing the
irq_create_mapping() function and replacing it with an inline function.
That's fine, except that this function was one of our "must support" api
calls, so put it back as an exported function to preserve the ABI.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibb1c480c0ba4eb8b3d6c71cabf83467ee2d1f12b
2020-12-12 13:59:12 +01:00
Greg Kroah-Hartman
ae3e9564f7 This is the 5.4.83 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/TZOAACgkQONu9yGCS
 aT4Wtw/8DvcG+dIrMU4wRfD9eqtvfldNyHnyTQyEtlKkGEuAbukqQ3FG/sSxW7/P
 VWN3NviRDlc5dF+0KhGhknIHjE3Di8UsJ/8KNhmqNZOFeukNAkCWmwBgPgQ3EPki
 +9b5LmVZJkQIdzIvP4PyJfDirZrOZR0YInCKT/1bEu/uhzAvFSS2ix2IckXrW/4Z
 YeQjN8Kk322xe2yDpVAzvEiBYwVIrdr7ty+FRiebQ8np88EPoCzy/r0wvPT//3wQ
 1lh7zbihvQ1/kJqpnJWpbOCwi5fCD8YPChBGGqZD+hBqwlrqMb/Wt5Nk73g8XzjE
 pIOXyxmcxTmen3zcuon8XqLgqx6TEqObfXiFiJcPGy524F4GzNA9GvekaxXefxzg
 B2A0DdGhlcSRClpPUtwF+Zpp1qQIaiCpmoMLjznsN6Isvew08ENGUPBHMHV4XrB7
 XbByaBIDdGoukXHYv4sKdKpggqi2doWu7uY+M4nyNEtKI82Ct1YffBYXf8zhO6MT
 XGX3K2Gzpa6SExLDST6tqbATLhf6l34QokLp/fnqtkB+MhBWqfydhKVGVwqCqvqi
 W2GmgmciNT0uC95SYEqVG+Bl3ej5QK3Hgu60PUo6Up2FcaL5wWEJSkXn64fMLvOX
 /COnAwFOJfbGmbgwN6uEUYDXdjHRp2HcjnFTImRF83BmdNkhPXQ=
 =nQYB
 -----END PGP SIGNATURE-----

Merge 5.4.83 into android11-5.4-lts

Changes in 5.4.83
	pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
	pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
	Partially revert bpf: Zero-fill re-used per-cpu map element
	usb: gadget: f_fs: Use local copy of descriptors for userspace copy
	USB: serial: kl5kusb105: fix memleak on open
	USB: serial: ch341: add new Product ID for CH341A
	USB: serial: ch341: sort device-id entries
	USB: serial: option: add Fibocom NL668 variants
	USB: serial: option: add support for Thales Cinterion EXS82
	USB: serial: option: fix Quectel BG96 matching
	tty: Fix ->pgrp locking in tiocspgrp()
	tty: Fix ->session locking
	ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14
	ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
	ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294
	ALSA: hda/realtek - Add new codec supported for ALC897
	ALSA: hda/generic: Add option to enforce preferred_dacs pairs
	ftrace: Fix updating FTRACE_FL_TRAMP
	cifs: allow syscalls to be restarted in __smb_send_rqst()
	cifs: fix potential use-after-free in cifs_echo_request()
	i2c: imx: Don't generate STOP condition if arbitration has been lost
	thunderbolt: Fix use-after-free in remove_unplugged_switch()
	drm/i915/gt: Program mocs:63 for cache eviction on gen9
	scsi: mpt3sas: Fix ioctl timeout
	dm writecache: fix the maximum number of arguments
	powerpc/64s/powernv: Fix memory corruption when saving SLB entries on MCE
	genirq/irqdomain: Add an irq_create_mapping_affinity() function
	powerpc/pseries: Pass MSI affinity to irq_create_mapping()
	dm: fix bug with RCU locking in dm_blk_report_zones
	dm: remove invalid sparse __acquires and __releases annotations
	x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
	coredump: fix core_pattern parse error
	mm: list_lru: set shrinker map bit when child nr_items is not zero
	mm/swapfile: do not sleep with a spin lock held
	speakup: Reject setting the speakup line discipline outside of speakup
	i2c: imx: Fix reset of I2SR_IAL flag
	i2c: imx: Check for I2SR_IAL after every byte
	spi: bcm2835: Release the DMA channel if probe fails after dma_init
	iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
	tracing: Fix userstacktrace option for instances
	lib/syscall: fix syscall registers retrieval on 32-bit platforms
	can: af_can: can_rx_unregister(): remove WARN() statement from list operation sanity check
	gfs2: check for empty rgrp tree in gfs2_ri_update
	netfilter: ipset: prevent uninit-value in hash_ip6_add
	tipc: fix a deadlock when flushing scheduled work
	ASoC: wm_adsp: fix error return code in wm_adsp_load()
	rtw88: debug: Fix uninitialized memory in debugfs code
	i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
	dm writecache: remove BUG() and fail gracefully instead
	Input: i8042 - fix error return code in i8042_setup_aux()
	netfilter: nf_tables: avoid false-postive lockdep splat
	netfilter: nftables_offload: set address type in control dissector
	x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
	Revert "geneve: pull IP header before ECN decapsulation"
	Linux 5.4.83

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5753999d7c8f19f5b8b6f5f9e850c64744a257fc
2020-12-11 15:00:01 +01:00
Greg Kroah-Hartman
cd604f6e80 Merge branch 'android11-5.4' into 'android11-5.4-lts'
Sync up with android11-5.4 for the following commit:

c797384edc ANDROID: kthread: break dependency between worker->lock and task_struct->pi_lock

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib349d655a83eb074e859fb8bb69111a135d22861
2020-12-11 13:32:37 +01:00
Steven Rostedt (VMware)
f68f5bdfef tracing: Fix userstacktrace option for instances
commit bcee5278958802b40ee8b26679155a6d9231783e upstream.

When the instances were able to use their own options, the userstacktrace
option was left hardcoded for the top level. This made the instance
userstacktrace option bascially into a nop, and will confuse users that set
it, but nothing happens (I was confused when it happened to me!)

Cc: stable@vger.kernel.org
Fixes: 16270145ce ("tracing: Add trace options for core options to instances")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:23:32 +01:00
Laurent Vivier
1f72986fc9 genirq/irqdomain: Add an irq_create_mapping_affinity() function
commit bb4c6910c8b41623104c2e64a30615682689a54d upstream.

There is currently no way to convey the affinity of an interrupt
via irq_create_mapping(), which creates issues for devices that
expect that affinity to be managed by the kernel.

In order to sort this out, rename irq_create_mapping() to
irq_create_mapping_affinity() with an additional affinity parameter that
can be passed down to irq_domain_alloc_descs().

irq_create_mapping() is re-implemented as a wrapper around
irq_create_mapping_affinity().

No functional change.

Fixes: e75eafb9b0 ("genirq/msi: Switch to new irq spreading infrastructure")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kurz <groug@kaod.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126082852.1178497-2-lvivier@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:23:30 +01:00
Naveen N. Rao
205740ca4a ftrace: Fix updating FTRACE_FL_TRAMP
commit 4c75b0ff4e4bf7a45b5aef9639799719c28d0073 upstream.

On powerpc, kprobe-direct.tc triggered FTRACE_WARN_ON() in
ftrace_get_addr_new() followed by the below message:
  Bad trampoline accounting at: 000000004222522f (wake_up_process+0xc/0x20) (f0000001)

The set of steps leading to this involved:
- modprobe ftrace-direct-too
- enable_probe
- modprobe ftrace-direct
- rmmod ftrace-direct <-- trigger

The problem turned out to be that we were not updating flags in the
ftrace record properly. From the above message about the trampoline
accounting being bad, it can be seen that the ftrace record still has
FTRACE_FL_TRAMP set though ftrace-direct module is going away. This
happens because we are checking if any ftrace_ops has the
FTRACE_FL_TRAMP flag set _before_ updating the filter hash.

The fix for this is to look for any _other_ ftrace_ops that also needs
FTRACE_FL_TRAMP.

Link: https://lkml.kernel.org/r/56c113aa9c3e10c19144a36d9684c7882bf09af5.1606412433.git.naveen.n.rao@linux.vnet.ibm.com

Cc: stable@vger.kernel.org
Fixes: a124692b69 ("ftrace: Enable trampoline when rec count returns back to one")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:23:29 +01:00
Suren Baghdasaryan
c797384edc ANDROID: kthread: break dependency between worker->lock and task_struct->pi_lock
A number of kthread-related functions indirectly take task_struct->pi_lock
while holding worker->lock in the call chain like this:
    spin_lock(&worker->lock)
    kthread_insert_work
    wake_up_process
    try_to_wake_up
    raw_spin_lock_irqsave(&p->pi_lock, flags)

This lock dependency exists whenever kthread_insert_work is called either
directly or indirectly via __kthread_queue_delayed_work in the following
functions:
    kthread_queue_work
    kthread_delayed_work_timer_fn
    kthread_queue_delayed_work
    kthread_flush_work
    kthread_mod_delayed_work

This creates possibilities for circular dependencies like the one reported
at [1]. Break this lock dependency by moving task wakeup after worker->lock
has been released.

[1]: https://lore.kernel.org/lkml/CAJuCfpG4NkhpQvZjgXZ_3gm6Hf1QgN_eUOQ8iX9Cv1k9whLwSQ@mail.gmail.com

Reported-by: Ke Wang <ke.wang@unisoc.com>
Reported-by: Shakeel Butt <shakeelb@google.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Tested-by: Shakeel Butt <shakeelb@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>

Link: https://lkml.org/lkml/2020/5/4/1148
Cherry picked instead of commit 461daba06bdcb9c7a3f92b9bbd110e1f7d093ffc
as an alternative solution for the lockdep error that does not break KMI.
Bug: 174875976
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I2478847f66c85dca953846cd77955928d690c97c
2020-12-08 11:48:06 -08:00
Greg Kroah-Hartman
5a742c2b56 This is the 5.4.82 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/PSigACgkQONu9yGCS
 aT6bSw//eDCpWcnLDa1Rt4bOrnO82484ebr1PZeYPfca/3QVS59j8DsVOf6Xklmz
 z2ponI6SRFxZwO2SmXrfoiOhUVI9Kd3ohTH+LSo3ezpk0klamIf60L914RBc7QFE
 wmVgOPz5LwLxfkU5a148/H4rwLGlM9oBxVcCXpnLkN03Ul4JM/P6A/T3rFrX8ZkW
 3r4NYu3jOHgNz+irosW8zAea+jIf7ALg4Gch3ILwrbM4KSQiyXbAp0mJsY+li7HE
 BSa1RJHBXkqCwK/mWT4LWuJNf871T656kKr04/rxipRu2lEcGCPghO4DGba1mjqR
 NdnuMWBjoxetlRAbWOylWT+2ngQNx+E9hFrBxg1+js/mcHvfpeM4EuSK4YCnI7rO
 6r5JZqYdw7GGHqvy51JPLx1m+NMt8XhTp5+1vOIZhjtdNrcTMBz0kxIiGbvTwdlb
 BbO+LDjmBmQYwmTcadbBPPMRLKnvx5bbNtTAzdwkvYEC8ev5RfxebFO/StTbmVRd
 JIUKkwmNw803OjhMgs+dXVw0lX8C1nLSSROKHf4+lCGFhCDnDhos5DpKpfBIwXxP
 Xv0Uf1YA4ygFVId+kuJOoXWNBkzB6UOlKMxoU1YcuRwpZHFk8b+MvTAzaCbSSl3A
 nJT6CK3K3H6WSiF9PC8i85kFJbAJbwifjx904nGBekaqU0bgI+s=
 =Faec
 -----END PGP SIGNATURE-----

Merge 5.4.82 into android11-5.4-lts

Changes in 5.4.82
	devlink: Hold rtnl lock while reading netdev attributes
	ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
	net/af_iucv: set correct sk_protocol for child sockets
	net/tls: missing received data after fast remote close
	net/tls: Protect from calling tls_dev_del for TLS RX twice
	rose: Fix Null pointer dereference in rose_send_frame()
	sock: set sk_err to ee_errno on dequeue from errq
	tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control
	tun: honor IOCB_NOWAIT flag
	usbnet: ipheth: fix connectivity with iOS 14
	bonding: wait for sysfs kobject destruction before freeing struct slave
	staging/octeon: fix up merge error
	ima: extend boot_aggregate with kernel measurements
	sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list
	netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
	ipv4: Fix tos mask in inet_rtm_getroute()
	dt-bindings: net: correct interrupt flags in examples
	chelsio/chtls: fix panic during unload reload chtls
	ibmvnic: Ensure that SCRQ entry reads are correctly ordered
	ibmvnic: Fix TX completion error handling
	inet_ecn: Fix endianness of checksum update when setting ECT(1)
	geneve: pull IP header before ECN decapsulation
	net: ip6_gre: set dev->hard_header_len when using header_ops
	net/x25: prevent a couple of overflows
	cxgb3: fix error return code in t3_sge_alloc_qset()
	net: pasemi: fix error return code in pasemi_mac_open()
	vxlan: fix error return code in __vxlan_dev_create()
	chelsio/chtls: fix a double free in chtls_setkey()
	net: mvpp2: Fix error return code in mvpp2_open()
	net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl
	net: openvswitch: ensure LSE is pullable before reading it
	net/sched: act_mpls: ensure LSE is pullable before reading it
	net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering
	net/mlx5: Fix wrong address reclaim when command interface is down
	ALSA: usb-audio: US16x08: fix value count for level meters
	Input: xpad - support Ardwiino Controllers
	Input: i8042 - add ByteSpeed touchpad to noloop table
	tracing: Remove WARN_ON in start_thread()
	RDMA/i40iw: Address an mmap handler exploit in i40iw
	Linux 5.4.82

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie7c035895e3413f7a58012c372cfc64deb2e6081
2020-12-08 11:39:00 +01:00
Vasily Averin
07434172c5 tracing: Remove WARN_ON in start_thread()
commit 310e3a4b5a4fc718a72201c1e4cf5c64ac6f5442 upstream.

This patch reverts commit 978defee11 ("tracing: Do a WARN_ON()
 if start_thread() in hwlat is called when thread exists")

.start hook can be legally called several times if according
tracer is stopped

screen window 1
[root@localhost ~]# echo 1 > /sys/kernel/tracing/events/kmem/kfree/enable
[root@localhost ~]# echo 1 > /sys/kernel/tracing/options/pause-on-trace
[root@localhost ~]# less -F /sys/kernel/tracing/trace

screen window 2
[root@localhost ~]# cat /sys/kernel/debug/tracing/tracing_on
0
[root@localhost ~]# echo hwlat >  /sys/kernel/debug/tracing/current_tracer
[root@localhost ~]# echo 1 > /sys/kernel/debug/tracing/tracing_on
[root@localhost ~]# cat /sys/kernel/debug/tracing/tracing_on
0
[root@localhost ~]# echo 2 > /sys/kernel/debug/tracing/tracing_on

triggers warning in dmesg:
WARNING: CPU: 3 PID: 1403 at kernel/trace/trace_hwlat.c:371 hwlat_tracer_start+0xc9/0xd0

Link: https://lkml.kernel.org/r/bd4d3e70-400d-9c82-7b73-a2d695e86b58@virtuozzo.com

Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 978defee11 ("tracing: Do a WARN_ON() if start_thread() in hwlat is called when thread exists")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-08 10:40:28 +01:00
Vincent Guittot
294de8933a sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list
[ Upstream commit 39f23ce07b9355d05a64ae303ce20d1c4b92b957 ]

Although not exactly identical, unthrottle_cfs_rq() and enqueue_task_fair()
are quite close and follow the same sequence for enqueuing an entity in the
cfs hierarchy. Modify unthrottle_cfs_rq() to use the same pattern as
enqueue_task_fair(). This fixes a problem already faced with the latter and
add an optimization in the last for_each_sched_entity loop.

Fixes: fe61468b2cb (sched/fair: Fix enqueue_task_fair warning)
Reported-by Tao Zhou <zohooouoto@zoho.com.cn>
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Reviewed-by: Ben Segall <bsegall@google.com>
Link: https://lkml.kernel.org/r/20200513135528.4742-1-vincent.guittot@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-08 10:40:24 +01:00
Greg Kroah-Hartman
34098f9cce This is the 5.4.80 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+8/L0ACgkQONu9yGCS
 aT624w/+M3fyTWj45qssxAOYUbWH4OPzKjMTKq1qHOGTBGYcVLxmggDV5xziQs8B
 WiCUysdJsM9Xwe/a9+fy9X2FHk7KxILf02mYLVcwyLJLXCHsCXtvBeTf937h5SaI
 cIsR1e2LQ7s1mTnVmBs2DGDQcD6Y17f/FoTpBejOSB9O+MSBNoBhOR/aaDUzzLm1
 sfpQ3zpnF6iAo2KYITxq/QkyRyiCPMl1c+/ggLTYvrM15DGhnChPN9j1+X0TLdjz
 UuZakvX/UY9vnY6oWla7wybwUzZMfFqZtehvwFA4wqeZqXcJcb+nBpfpoT1Gp9bv
 cpz+8nmF0ER1eS6m1C/XqiTr3IqDOSAHfcu80HzJRC+dmcXjxyNj+AZyFhm+uCJS
 IyUi6+mFwCypg3II2QEMNYdeips4Qj051IPNl5gEteNC4GQqXef3JdR52qIDzsHe
 9xgQVFZjVDYpZ6AOkyjqzGJ0dy3a1f7GNIPxwe6DUnbkOkOB+Z5KhGFbEOp+yGoa
 3PUnVvtrTs07VkB0afwoj7xIyfowmjxCPSSXkfnYY2iJ6FYsfCm2x/RtM5tTvgT+
 E8W71RxsyRwhjC2Z85wi6PR59XTIJcw3oJvJkrvchCAsc3Z1L7wBtjyHdvouxo8+
 h/NlGOAisTiQFdT2IixgmTZaoxE7fQLDCJDMmgZT2qPJ1hn7Pbo=
 =Puge
 -----END PGP SIGNATURE-----

Merge 5.4.80 into android11-5.4-lts

Changes in 5.4.80
	ah6: fix error return code in ah6_input()
	atm: nicstar: Unmap DMA on send error
	bnxt_en: read EEPROM A2h address using page 0
	devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
	Exempt multicast addresses from five-second neighbor lifetime
	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
	ipv6: Fix error path to cancel the meseage
	lan743x: fix issue causing intermittent kernel log warnings
	lan743x: prevent entire kernel HANG on open, for some platforms
	mlxsw: core: Use variable timeout for EMAD retries
	net: b44: fix error return code in b44_init_one()
	net: bridge: add missing counters to ndo_get_stats64 callback
	net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
	net: ethernet: ti: cpsw: fix error return code in cpsw_probe()
	net: Have netpoll bring-up DSA management interface
	netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
	net: lantiq: Wait for the GPHY firmware to be ready
	net/mlx4_core: Fix init_hca fields offset
	net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()
	net/tls: fix corrupted data in recvmsg
	net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
	page_frag: Recover from memory pressure
	qed: fix error return code in qed_iwarp_ll2_start()
	qlcnic: fix error return code in qlcnic_83xx_restart_hw()
	sctp: change to hold/put transport for proto_unreach_timer
	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
	net/mlx5: Add handling of port type in rule deletion
	net/mlx5: Disable QoS when min_rates on all VFs are zero
	net: usb: qmi_wwan: Set DTR quirk for MR400
	net/ncsi: Fix netlink registration
	net: ftgmac100: Fix crash when removing driver
	pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
	scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
	selftests: kvm: Fix the segment descriptor layout to match the actual layout
	ACPI: button: Add DMI quirk for Medion Akoya E2228T
	arm64: errata: Fix handling of 1418040 with late CPU onlining
	arm64: psci: Avoid printing in cpu_psci_cpu_die()
	arm64: smp: Tell RCU about CPUs that fail to come online
	vfs: remove lockdep bogosity in __sb_start_write
	gfs2: fix possible reference leak in gfs2_check_blk_type
	hwmon: (pwm-fan) Fix RPM calculation
	arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
	arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
	arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node
	arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
	arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
	ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
	Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
	ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on Ethernet PHY
	arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
	Input: adxl34x - clean up a data type in adxl34x_probe()
	MIPS: export has_transparent_hugepage() for modules
	arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
	arm64: dts imx8mn: Remove non-existent USB OTG2
	arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
	swiotlb: using SIZE_MAX needs limits.h included
	arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point
	ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
	Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
	rfkill: Fix use-after-free in rfkill_resume()
	RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device()
	RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs
	perf lock: Don't free "lock_seq_stat" if read_count isn't zero
	tools, bpftool: Add missing close before bpftool net attach exit
	ip_tunnels: Set tunnel option flag when tunnel metadata is present
	can: af_can: prevent potential access of uninitialized member in can_rcv()
	can: af_can: prevent potential access of uninitialized member in canfd_rcv()
	can: dev: can_restart(): post buffer from the right context
	can: ti_hecc: Fix memleak in ti_hecc_probe
	can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
	can: peak_usb: fix potential integer overflow on shift of a int
	can: flexcan: fix failure handling of pm_runtime_get_sync()
	can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI
	can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init()
	can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration
	can: m_can: m_can_handle_state_change(): fix state change
	can: m_can: m_can_class_free_dev(): introduce new function
	can: m_can: m_can_stop(): set device to software init mode before closing
	ASoC: qcom: lpass-platform: Fix memory leak
	selftests/bpf: Fix error return code in run_getsockopt_test()
	MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
	drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
	net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
	bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made
	bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
	can: kvaser_pciefd: Fix KCAN bittiming limits
	can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
	iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
	iommu/vt-d: Avoid panic if iommu init fails in tboot system
	can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery
	can: m_can: process interrupt only when not runtime suspended
	xfs: fix the minrecs logic when dealing with inode root child blocks
	xfs: strengthen rmap record flags checking
	xfs: return corresponding errcode if xfs_initialize_perag() fail
	regulator: ti-abb: Fix array out of bound read access on the first transition
	fail_function: Remove a redundant mutex unlock
	xfs: revert "xfs: fix rmap key and record comparison functions"
	bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
	bpf, sockmap: On receive programs try to fast track SK_PASS ingress
	bpf, sockmap: Use truesize with sk_rmem_schedule()
	bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self
	efi/x86: Free efi_pgd with free_pages()
	libfs: fix error cast of negative value in simple_attr_write()
	HID: logitech-hidpp: Add PID for MX Anywhere 2
	HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad
	HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
	speakup: Do not let the line discipline be used several times
	ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
	ALSA: usb-audio: Add delay quirk for all Logitech USB devices
	ALSA: ctl: fix error path at adding user-defined element set
	ALSA: mixart: Fix mutex deadlock
	ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button
	ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
	tty: serial: imx: fix potential deadlock
	tty: serial: imx: keep console clocks always on
	HID: logitech-dj: Fix an error in mse_bluetooth_descriptor
	efivarfs: fix memory leak in efivarfs_create()
	staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
	iio: light: fix kconfig dependency bug for VCNL4035
	ext4: fix bogus warning in ext4_update_dx_flag()
	iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
	iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
	iio: adc: mediatek: fix unset field
	spi: lpspi: Fix use-after-free on unbind
	spi: Introduce device-managed SPI controller allocation
	spi: npcm-fiu: Don't leak SPI master in probe error path
	spi: bcm2835aux: Fix use-after-free on unbind
	regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
	regulator: fix memory leak with repeated set_machine_constraints()
	regulator: avoid resolve_supply() infinite recursion
	regulator: workaround self-referent regulators
	xtensa: fix TLBTEMP area placement
	xtensa: disable preemption around cache alias management calls
	mac80211: minstrel: remove deferred sampling code
	mac80211: minstrel: fix tx status processing corner case
	mac80211: free sta in sta_info_insert_finish() on errors
	s390/cpum_sf.c: fix file permission for cpum_sfb_size
	s390/dasd: fix null pointer dereference for ERP requests
	Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected
	drm/amd/display: Add missing pflip irq for dcn2.0
	drm/i915: Handle max_bpc==16
	mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers
	ptrace: Set PF_SUPERPRIV when checking capability
	seccomp: Set PF_SUPERPRIV when checking capability
	x86/microcode/intel: Check patch signature before saving microcode for early loading
	mm: memcg/slab: fix root memcg vmstats
	mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
	mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations
	sched/fair: Fix overutilized update in enqueue_task_fair()
	Linux 5.4.80

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I204365dd460792cd54f3fbb2db030a50b904a62f
2020-11-25 12:46:13 +01:00
Quentin Perret
a88f08e782 sched/fair: Fix overutilized update in enqueue_task_fair()
commit 8e1ac4299a6e8726de42310d9c1379f188140c71 upstream.

enqueue_task_fair() attempts to skip the overutilized update for new
tasks as their util_avg is not accurate yet. However, the flag we check
to do so is overwritten earlier on in the function, which makes the
condition pretty much a nop.

Fix this by saving the flag early on.

Fixes: 2802bf3cd9 ("sched/fair: Add over-utilization/tipping point indicator")
Reported-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20201112111201.2081902-1-qperret@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:29:24 +01:00
Mickaël Salaün
09652ebd0d seccomp: Set PF_SUPERPRIV when checking capability
commit fb14528e443646dd3fd02df4437fcf5265b66baa upstream.

Replace the use of security_capable(current_cred(), ...) with
ns_capable_noaudit() which set PF_SUPERPRIV.

Since commit 98f368e9e2 ("kernel: Add noaudit variant of
ns_capable()"), a new ns_capable_noaudit() helper is available.  Let's
use it!

Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Fixes: e2cfabdfd0 ("seccomp: add system call filtering using BPF")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-3-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:29:24 +01:00
Mickaël Salaün
fa9ccc1777 ptrace: Set PF_SUPERPRIV when checking capability
commit cf23705244c947151179f929774fabf71e239eee upstream.

Commit 69f594a389 ("ptrace: do not audit capability check when outputing
/proc/pid/stat") replaced the use of ns_capable() with
has_ns_capability{,_noaudit}() which doesn't set PF_SUPERPRIV.

Commit 6b3ad6649a4c ("ptrace: reintroduce usage of subjective credentials in
ptrace_has_cap()") replaced has_ns_capability{,_noaudit}() with
security_capable(), which doesn't set PF_SUPERPRIV neither.

Since commit 98f368e9e2 ("kernel: Add noaudit variant of ns_capable()"), a
new ns_capable_noaudit() helper is available.  Let's use it!

As a result, the signature of ptrace_has_cap() is restored to its original one.

Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: stable@vger.kernel.org
Fixes: 6b3ad6649a4c ("ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()")
Fixes: 69f594a389 ("ptrace: do not audit capability check when outputing /proc/pid/stat")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-2-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:29:24 +01:00
Luo Meng
989d275ac5 fail_function: Remove a redundant mutex unlock
[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ]

Fix a mutex_unlock() issue where before copy_from_user() is
not called mutex_locked.

Fixes: 4b1a29a7f5 ("error-injection: Support fault injection framework")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-24 13:29:18 +01:00
Will Deacon
54d11983c2 arm64: smp: Tell RCU about CPUs that fail to come online
[ Upstream commit 04e613ded8c26489b3e0f9101b44462f780d1a35 ]

Commit ce3d31ad3cac ("arm64/smp: Move rcu_cpu_starting() earlier") ensured
that RCU is informed early about incoming CPUs that might end up calling
into printk() before they are online. However, if such a CPU fails the
early CPU feature compatibility checks in check_local_cpu_capabilities(),
then it will be powered off or parked without informing RCU, leading to
an endless stream of stalls:

  | rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
  | rcu:	2-O...: (0 ticks this GP) idle=002/1/0x4000000000000000 softirq=0/0 fqs=2593
  | (detected by 0, t=5252 jiffies, g=9317, q=136)
  | Task dump for CPU 2:
  | task:swapper/2       state:R  running task     stack:    0 pid:    0 ppid:     1 flags:0x00000028
  | Call trace:
  | ret_from_fork+0x0/0x30

Ensure that the dying CPU invokes rcu_report_dead() prior to being powered
off or parked.

Cc: Qian Cai <cai@redhat.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: Qian Cai <cai@redhat.com>
Link: https://lore.kernel.org/r/20201105222242.GA8842@willie-the-truck
Link: https://lore.kernel.org/r/20201106103602.9849-3-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-24 13:29:01 +01:00
Greg Kroah-Hartman
118da4b0e4 This is the 5.4.78 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+1Zg0ACgkQONu9yGCS
 aT75KBAAqvo33a5xoTM+FQQRsRSKaRNOhCQooXEB1bJcas3y+yQ6ehmwCJ8/K1tC
 JilD+NQt6uuwH2f2cLrH0e4EQcvno390qF/wOCF377bUnKklsxydyaLSLhGYTqR9
 5u/vZVf/QoWZc6BvDwPWNo/NwuRPgJ+sVjuFvtt08l0pGQou26WGujl6ElJKBiLV
 SbbRDlx/f8cJa/oqN8TL/V/VDqJfVLcv6hFRvf44newSUJK05LgCVoM76WEcSQLj
 GYrtCNwffJtnCUzUr/SctNymsgmjj65df6tKmS0vntWH5kTBnCKK/Mnly38gQbeB
 nvci1siOUjnnrkBhydKixO4Q6OZmrbuM0g3vXmW5/Az7HjRcX84BRu+yE7aArE3/
 GMAIO/D1Wj9Dhxs59cu12IWxRaljkT+5FsZYV55TgcRMmWHq/YzBYFSW15fZ9xEw
 ehel9m5ou+HqVtz+bR+ar3v6M2bhedJ0fFvXnbN2OhMwHsEUTuYqfTb7k/21dUwE
 P5k8qGGcYKE1q1gb/Dp3p/hDBjr5h4Mg7z7S8diGsVv3klgrtttgqkOo79JfTESz
 BS5vsF9yS0k23xemCl3jZ41X9uReXnE3lvEeuDBDdYvHPwnjyzPeUN5jgN6abQm7
 CTxp0oPIFW+O8MV+vgF1joK6ykbK8rJRjIUcfzHeI6oKt+HQBJY=
 =gimO
 -----END PGP SIGNATURE-----

Merge 5.4.78 into android11-5.4-lts

Changes in 5.4.78
	drm/i915/gem: Flush coherency domains on first set-domain-ioctl
	time: Prevent undefined behaviour in timespec64_to_ns()
	nbd: don't update block size after device is started
	KVM: arm64: Force PTE mapping on fault resulting in a device mapping
	PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0
	usb: dwc3: gadget: Continue to process pending requests
	usb: dwc3: gadget: Reclaim extra TRBs after request completion
	btrfs: tracepoints: output proper root owner for trace_find_free_extent()
	btrfs: sysfs: init devices outside of the chunk_mutex
	btrfs: reschedule when cloning lots of extents
	ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
	genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
	hv_balloon: disable warning when floor reached
	net: xfrm: fix a race condition during allocing spi
	ASoC: codecs: wcd9335: Set digital gain range correctly
	xfs: set xefi_discard when creating a deferred agfl free log intent item
	netfilter: use actual socket sk rather than skb sk when routing harder
	netfilter: nf_tables: missing validation from the abort path
	netfilter: ipset: Update byte and packet counters regardless of whether they match
	powerpc/eeh_cache: Fix a possible debugfs deadlock
	perf trace: Fix segfault when trying to trace events by cgroup
	perf tools: Add missing swap for ino_generation
	ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
	iommu/vt-d: Fix a bug for PDP check in prq_event_thread
	afs: Fix warning due to unadvanced marshalling pointer
	can: rx-offload: don't call kfree_skb() from IRQ context
	can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
	can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
	can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
	can: j1939: swap addr and pgn in the send example
	can: j1939: j1939_sk_bind(): return failure if netdev is down
	can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
	can: xilinx_can: handle failure cases of pm_runtime_get_sync
	can: peak_usb: add range checking in decode operations
	can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
	can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
	can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
	can: flexcan: flexcan_remove(): disable wakeup completely
	xfs: flush new eof page on truncate to avoid post-eof corruption
	xfs: fix scrub flagging rtinherit even if there is no rt device
	tpm: efi: Don't create binary_bios_measurements file for an empty log
	random32: make prandom_u32() output unpredictable
	KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return SMCCC_RET_NOT_REQUIRED
	KVM: x86: don't expose MSR_IA32_UMWAIT_CONTROL unconditionally
	ath9k_htc: Use appropriate rs_datalen type
	ASoC: qcom: sdm845: set driver name correctly
	ASoC: cs42l51: manage mclk shutdown delay
	usb: dwc3: pci: add support for the Intel Alder Lake-S
	opp: Reduce the size of critical section in _opp_table_kref_release()
	usb: gadget: goku_udc: fix potential crashes in probe
	selftests/ftrace: check for do_sys_openat2 in user-memory test
	selftests: pidfd: fix compilation errors due to wait.h
	ALSA: hda: Separate runtime and system suspend
	ALSA: hda: Reinstate runtime_allow() for all hda controllers
	gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
	gfs2: Add missing truncate_inode_pages_final for sd_aspace
	gfs2: check for live vs. read-only file system in gfs2_fitrim
	scsi: hpsa: Fix memory leak in hpsa_init_one()
	drm/amdgpu: perform srbm soft reset always on SDMA resume
	drm/amd/pm: perform SMC reset on suspend/hibernation
	drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
	mac80211: fix use of skb payload instead of header
	cfg80211: initialize wdev data earlier
	cfg80211: regulatory: Fix inconsistent format argument
	tracing: Fix the checking of stackidx in __ftrace_trace_stack
	scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
	scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
	nvme: introduce nvme_sync_io_queues
	nvme-rdma: avoid race between time out and tear down
	nvme-tcp: avoid race between time out and tear down
	nvme-rdma: avoid repeated request completion
	nvme-tcp: avoid repeated request completion
	iommu/amd: Increase interrupt remapping table limit to 512 entries
	s390/smp: move rcu_cpu_starting() earlier
	vfio: platform: fix reference leak in vfio_platform_open
	vfio/pci: Bypass IGD init in case of -ENODEV
	i2c: mediatek: move dma reset before i2c reset
	amd/amdgpu: Disable VCN DPG mode for Picasso
	selftests: proc: fix warning: _GNU_SOURCE redefined
	riscv: Set text_offset correctly for M-Mode
	i2c: sh_mobile: implement atomic transfers
	tpm_tis: Disable interrupts on ThinkPad T490s
	spi: bcm2835: remove use of uninitialized gpio flags variable
	tick/common: Touch watchdog in tick_unfreeze() on all CPUs
	mfd: sprd: Add wakeup capability for PMIC IRQ
	pinctrl: intel: Set default bias in case no particular value given
	ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
	pinctrl: aspeed: Fix GPI only function problem.
	net/mlx5: Fix deletion of duplicate rules
	SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
	bpf: Zero-fill re-used per-cpu map element
	nbd: fix a block_device refcount leak in nbd_release
	igc: Fix returning wrong statistics
	xfs: fix flags argument to rmap lookup when converting shared file rmaps
	xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
	xfs: fix rmap key and record comparison functions
	xfs: fix brainos in the refcount scrubber's rmap fragment processor
	lan743x: fix "BUG: invalid wait context" when setting rx mode
	xfs: fix a missing unlock on error in xfs_fs_map_blocks
	of/address: Fix of_node memory leak in of_dma_is_coherent
	cosa: Add missing kfree in error path of cosa_write
	vrf: Fix fast path output packet handling with async Netfilter rules
	perf: Fix get_recursion_context()
	erofs: derive atime instead of leaving it empty
	ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
	ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
	btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
	btrfs: fix min reserved size calculation in merge_reloc_root
	btrfs: dev-replace: fail mount if we don't have replace item with target device
	KVM: arm64: Don't hide ID registers from userspace
	thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services()
	thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
	uio: Fix use-after-free in uio_unregister_device()
	usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
	xhci: hisilicon: fix refercence leak in xhci_histb_probe
	virtio: virtio_console: fix DMA memory allocation for rproc serial
	mei: protect mei_cl_mtu from null dereference
	futex: Don't enable IRQs unconditionally in put_pi_state()
	jbd2: fix up sparse warnings in checkpoint code
	mm/slub: fix panic in slab_alloc_node()
	Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
	reboot: fix overflow parsing reboot cpu number
	ocfs2: initialize ip_next_orphan
	btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
	selinux: Fix error return code in sel_ib_pkey_sid_slow()
	gpio: pcie-idio-24: Fix irq mask when masking
	gpio: pcie-idio-24: Fix IRQ Enable Register value
	gpio: pcie-idio-24: Enable PEX8311 interrupts
	mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs
	mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
	don't dump the threads that had been already exiting when zapped.
	drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
	pinctrl: amd: use higher precision for 512 RtcClk
	pinctrl: amd: fix incorrect way to disable debounce filter
	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
	IPv6: Set SIT tunnel hard_header_len to zero
	net/af_iucv: fix null pointer dereference on shutdown
	net: udp: fix UDP header access on Fast/frag0 UDP GRO
	net: Update window_clamp if SOCK_RCVBUF is set
	net/x25: Fix null-ptr-deref in x25_connect
	tipc: fix memory leak in tipc_topsrv_start()
	r8169: fix potential skb double free in an error path
	drm/i915: Correctly set SFC capability for video engines
	powerpc/603: Always fault when _PAGE_ACCESSED is not set
	x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
	perf scripting python: Avoid declaring function pointers with a visibility attribute
	perf/core: Fix race in the perf_mmap_close() function
	net: sch_generic: fix the missing new qdisc assignment bug
	Convert trailing spaces and periods in path components
	Linux 5.4.78

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iac77690a370f99dc3518ab5bd4660fc31d0832c0
2020-11-19 08:52:52 +01:00
Jiri Olsa
c5cf5c7b58 perf/core: Fix race in the perf_mmap_close() function
commit f91072ed1b7283b13ca57fcfbece5a3b92726143 upstream.

There's a possible race in perf_mmap_close() when checking ring buffer's
mmap_count refcount value. The problem is that the mmap_count check is
not atomic because we call atomic_dec() and atomic_read() separately.

  perf_mmap_close:
  ...
   atomic_dec(&rb->mmap_count);
   ...
   if (atomic_read(&rb->mmap_count))
      goto out_put;

   <ring buffer detach>
   free_uid

out_put:
  ring_buffer_put(rb); /* could be last */

The race can happen when we have two (or more) events sharing same ring
buffer and they go through atomic_dec() and then they both see 0 as refcount
value later in atomic_read(). Then both will go on and execute code which
is meant to be run just once.

The code that detaches ring buffer is probably fine to be executed more
than once, but the problem is in calling free_uid(), which will later on
demonstrate in related crashes and refcount warnings, like:

  refcount_t: addition on 0; use-after-free.
  ...
  RIP: 0010:refcount_warn_saturate+0x6d/0xf
  ...
  Call Trace:
  prepare_creds+0x190/0x1e0
  copy_creds+0x35/0x172
  copy_process+0x471/0x1a80
  _do_fork+0x83/0x3a0
  __do_sys_wait4+0x83/0x90
  __do_sys_clone+0x85/0xa0
  do_syscall_64+0x5b/0x1e0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Using atomic decrease and check instead of separated calls.

Tested-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Wade Mealing <wmealing@redhat.com>
Fixes: 9bb5d40cd9 ("perf: Fix mmap() accounting hole");
Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava
[sudip: used ring_buffer]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:20:33 +01:00