Commit graph android_kernel_motorola_sm6375/drivers/md
Author SHA1 Message Date
Greg Kroah-Hartman
a9372c6b57 This is the 5.4.33 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6ZbdIACgkQONu9yGCS
 aT5Jqw/7BZ639nTAAmz809yOF1JBhvBptRg9tBKYAfw62DzfZe5s9IZA6znIt0f0
 nlluLvnhHlDSpgycHNkFry5AkiCUpRQW6NY681xITm918w3BxsKX2pfCawojIOSw
 YBaTWoWqNFQQWlC18L1CWJmIvIktSCHXBMTVDpnvRv7sw5A4Oe/zarzVDNb0A6OJ
 ThaR7LAKJrUEDDLuCOuB/IrYCOpOzg2SkViFmlo4wmmhvCSi8PXvf3royrSFXxM/
 Y1bs67Hu/uqeHl8Y2RaMZpXf1aW9F31sooca4GD+UnVoWppjIOKRyuGLTrXKv7pw
 /goIzlE8wfJz5K0iQ4UcbXwwdY81L9UlMdVsmIWHHgxMjSp1J5mfQ5TLUC/VK3UO
 Ll9tCYBwH4FjzxNRJq7if8TDAfgPzyhw4BMchgXZWzW1oasl51T2uEye3KgFXQSb
 u6TwCx4KGS0w/Q81SKis83Pb0unHGanJOSCZxI1B44raf0ruCBpTYUc713pfegWT
 46YtwoorAK8N+GpFQA1tsTJvVclqCF5bHVE19TMvXV4UX/VTPtbIAUE7vnvcxcqO
 uh0b9Jfmd6Fcgh7VZQCH7CUYnsyJmGqj2kycB1p+T8UB6H+PCeuQBZBl8sJnf8oj
 d5NIzB7WWXBQuEG5XuPtxg6+ARMPEIpd2exEVn9ZOv5qhesBo04=
 =pjAq
 -----END PGP SIGNATURE-----

Merge 5.4.33 into android-5.4-stable

Changes in 5.4.33
	ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage
	bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
	ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode
	bpf: Fix deadlock with rq_lock in bpf_send_signal()
	iwlwifi: mvm: Fix rate scale NSS configuration
	Input: tm2-touchkey - add support for Coreriver TC360 variant
	soc: fsl: dpio: register dpio irq handlers after dpio create
	rxrpc: Abstract out the calculation of whether there's Tx space
	rxrpc: Fix call interruptibility handling
	net: stmmac: platform: Fix misleading interrupt error msg
	net: vxge: fix wrong __VA_ARGS__ usage
	hinic: fix a bug of waitting for IO stopped
	hinic: fix the bug of clearing event queue
	hinic: fix out-of-order excution in arm cpu
	hinic: fix wrong para of wait_for_completion_timeout
	hinic: fix wrong value of MIN_SKB_LEN
	selftests/net: add definition for SOL_DCCP to fix compilation errors for old libc
	cxgb4/ptp: pass the sign of offset delta in FW CMD
	drm/scheduler: fix rare NULL ptr race
	cfg80211: Do not warn on same channel at the end of CSA
	qlcnic: Fix bad kzalloc null test
	i2c: st: fix missing struct parameter description
	i2c: pca-platform: Use platform_irq_get_optional
	media: rc: add keymap for Videostrong KII Pro
	cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL
	staging: wilc1000: avoid double unlocking of 'wilc->hif_cs' mutex
	media: venus: hfi_parser: Ignore HEVC encoding for V1
	firmware: arm_sdei: fix double-lock on hibernate with shared events
	null_blk: Fix the null_add_dev() error path
	null_blk: Handle null_add_dev() failures properly
	null_blk: fix spurious IO errors after failed past-wp access
	media: imx: imx7_mipi_csis: Power off the source when stopping streaming
	media: imx: imx7-media-csi: Fix video field handling
	xhci: bail out early if driver can't accress host in resume
	ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()
	x86: Don't let pgprot_modify() change the page encryption bit
	dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
	block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
	debugfs: Check module state before warning in {full/open}_proxy_open()
	irqchip/versatile-fpga: Handle chained IRQs properly
	time/sched_clock: Expire timer in hardirq context
	media: allegro: fix type of gop_length in channel_create message
	sched: Avoid scale real weight down to zero
	selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
	PCI/switchtec: Fix init_completion race condition with poll_wait()
	block, bfq: move forward the getting of an extra ref in bfq_bfqq_move
	media: i2c: video-i2c: fix build errors due to 'imply hwmon'
	libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
	pstore/platform: fix potential mem leak if pstore_init_fs failed
	gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty
	gfs2: Don't demote a glock until its revokes are written
	cpufreq: imx6q: fix error handling
	x86/boot: Use unsigned comparison for addresses
	efi/x86: Ignore the memory attributes table on i386
	genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
	block: Fix use-after-free issue accessing struct io_cq
	media: i2c: ov5695: Fix power on and off sequences
	usb: dwc3: core: add support for disabling SS instances in park mode
	irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
	md: check arrays is suspended in mddev_detach before call quiesce operations
	firmware: fix a double abort case with fw_load_sysfs_fallback
	spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion
	locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
	block, bfq: fix use-after-free in bfq_idle_slice_timer_body
	btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued
	btrfs: remove a BUG_ON() from merge_reloc_roots()
	btrfs: restart relocate_tree_blocks properly
	btrfs: track reloc roots based on their commit root bytenr
	ASoC: fix regwmask
	ASoC: dapm: connect virtual mux with default value
	ASoC: dpcm: allow start or stop during pause for backend
	ASoC: topology: use name_prefix for new kcontrol
	usb: gadget: f_fs: Fix use after free issue as part of queue failure
	usb: gadget: composite: Inform controller driver of self-powered
	ALSA: usb-audio: Add mixer workaround for TRX40 and co
	ALSA: hda: Add driver blacklist
	ALSA: hda: Fix potential access overflow in beep helper
	ALSA: ice1724: Fix invalid access for enumerated ctl items
	ALSA: pcm: oss: Fix regression by buffer overflow fix
	ALSA: hda/realtek: Enable mute LED on an HP system
	ALSA: hda/realtek - a fake key event is triggered by running shutup
	ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
	ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
	ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
	ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
	ALSA: hda/realtek - Add quirk for MSI GL63
	media: venus: firmware: Ignore secure call error on first resume
	media: hantro: Read be32 words starting at every fourth byte
	media: ti-vpe: cal: fix disable_irqs to only the intended target
	media: ti-vpe: cal: fix a kernel oops when unloading module
	seccomp: Add missing compat_ioctl for notify
	acpi/x86: ignore unspecified bit positions in the ACPI global lock field
	ACPICA: Allow acpi_any_gpe_status_set() to skip one GPE
	ACPI: PM: s2idle: Refine active GPEs check
	thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
	nvmet-tcp: fix maxh2cdata icresp parameter
	nvme-fc: Revert "add module to ops template to allow module references"
	efi/x86: Add TPM related EFI tables to unencrypted mapping checks
	PCI: pciehp: Fix indefinite wait on sysfs requests
	PCI/ASPM: Clear the correct bits when enabling L1 substates
	PCI: Add boot interrupt quirk mechanism for Xeon chipsets
	PCI: qcom: Fix the fixup of PCI_VENDOR_ID_QCOM
	PCI: endpoint: Fix for concurrent memory allocation in OB address region
	sched/fair: Fix enqueue_task_fair warning
	tpm: Don't make log failures fatal
	tpm: tpm1_bios_measurements_next should increase position index
	tpm: tpm2_bios_measurements_next should increase position index
	KEYS: reaching the keys quotas correctly
	cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
	genirq/debugfs: Add missing sanity checks to interrupt injection
	irqchip/versatile-fpga: Apply clear-mask earlier
	io_uring: remove bogus RLIMIT_NOFILE check in file registration
	pstore: pstore_ftrace_seq_next should increase position index
	MIPS/tlbex: Fix LDDIR usage in setup_pw() for Loongson-3
	MIPS: OCTEON: irq: Fix potential NULL pointer dereference
	PM / Domains: Allow no domain-idle-states DT property in genpd when parsing
	PM: sleep: wakeup: Skip wakeup_source_sysfs_remove() if device is not there
	ath9k: Handle txpower changes even when TPC is disabled
	signal: Extend exec_id to 64bits
	x86/tsc_msr: Use named struct initializers
	x86/tsc_msr: Fix MSR_FSB_FREQ mask for Cherry Trail devices
	x86/tsc_msr: Make MSR derived TSC frequency more accurate
	x86/entry/32: Add missing ASM_CLAC to general_protection entry
	platform/x86: asus-wmi: Support laptops where the first battery is named BATT
	KVM: nVMX: Properly handle userspace interrupt window request
	KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
	KVM: s390: vsie: Fix delivery of addressing exceptions
	KVM: x86: Allocate new rmap and large page tracking when moving memslot
	KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
	KVM: x86: Gracefully handle __vmalloc() failure during VM allocation
	KVM: VMX: Add a trampoline to fix VMREAD error handling
	KVM: VMX: fix crash cleanup when KVM wasn't used
	smb3: fix performance regression with setting mtime
	CIFS: Fix bug which the return value by asynchronous read is error
	mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers
	mtd: spinand: Do not erase the block before writing a bad block marker
	btrfs: Don't submit any btree write bio if the fs has errors
	Btrfs: fix crash during unmount due to race with delayed inode workers
	btrfs: reloc: clean dirty subvols if we fail to start a transaction
	btrfs: set update the uuid generation as soon as possible
	btrfs: drop block from cache on error in relocation
	btrfs: fix missing file extent item for hole after ranged fsync
	btrfs: unset reloc control if we fail to recover
	btrfs: fix missing semaphore unlock in btrfs_sync_file
	btrfs: use nofs allocations for running delayed items
	remoteproc: qcom_q6v5_mss: Don't reassign mpss region on shutdown
	remoteproc: qcom_q6v5_mss: Reload the mba region on coredump
	remoteproc: Fix NULL pointer dereference in rproc_virtio_notify
	crypto: rng - Fix a refcounting bug in crypto_rng_reset()
	crypto: mxs-dcp - fix scatterlist linearization for hash
	erofs: correct the remaining shrink objects
	io_uring: honor original task RLIMIT_FSIZE
	mmc: sdhci-of-esdhc: fix esdhc_reset() for different controller versions
	powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init()
	tools: gpio: Fix out-of-tree build regression
	net: qualcomm: rmnet: Allow configuration updates to existing devices
	arm64: dts: allwinner: h6: Fix PMU compatible
	sched/core: Remove duplicate assignment in sched_tick_remote()
	arm64: dts: allwinner: h5: Fix PMU compatible
	mm, memcg: do not high throttle allocators based on wraparound
	dm writecache: add cond_resched to avoid CPU hangs
	dm integrity: fix a crash with unusually large tag size
	dm verity fec: fix memory leak in verity_fec_dtr
	dm clone: Add overflow check for number of regions
	dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions()
	XArray: Fix xas_pause for large multi-index entries
	xarray: Fix early termination of xas_for_each_marked
	crypto: caam/qi2 - fix chacha20 data size error
	crypto: caam - update xts sector size for large input length
	crypto: ccree - protect against empty or NULL scatterlists
	crypto: ccree - only try to map auth tag if needed
	crypto: ccree - dec auth tag size from cryptlen map
	scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
	scsi: ufs: fix Auto-Hibern8 error detection
	scsi: lpfc: Fix lpfc_io_buf resource leak in lpfc_get_scsi_buf_s4 error path
	ARM: dts: exynos: Fix polarity of the LCD SPI bus on UniversalC210 board
	arm64: dts: ti: k3-am65: Add clocks to dwc3 nodes
	arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
	selftests: vm: drop dependencies on page flags from mlock2 tests
	selftests/vm: fix map_hugetlb length used for testing read and write
	selftests/powerpc: Add tlbie_test in .gitignore
	vfio: platform: Switch to platform_get_irq_optional()
	drm/i915/gem: Flush all the reloc_gpu batch
	drm/etnaviv: rework perfmon query infrastructure
	drm: Remove PageReserved manipulation from drm_pci_alloc
	drm/amdgpu/powerplay: using the FCLK DPM table to set the MCLK
	drm/amdgpu: unify fw_write_wait for new gfx9 asics
	powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable
	nfsd: fsnotify on rmdir under nfsd/clients/
	NFS: Fix use-after-free issues in nfs_pageio_add_request()
	NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
	ext4: fix a data race at inode->i_blocks
	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
	ocfs2: no need try to truncate file beyond i_size
	perf tools: Support Python 3.8+ in Makefile
	s390/diag: fix display of diagnose call statistics
	Input: i8042 - add Acer Aspire 5738z to nomux list
	ftrace/kprobe: Show the maxactive number on kprobe_events
	clk: ingenic/jz4770: Exit with error if CGU init failed
	clk: ingenic/TCU: Fix round_rate returning error
	kmod: make request_module() return an error when autoloading is disabled
	cpufreq: powernv: Fix use-after-free
	hfsplus: fix crash and filesystem corruption when deleting files
	libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
	ipmi: fix hung processes in __get_guid()
	xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
	powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
	powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
	powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
	powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
	powerpc/64: Setup a paca before parsing device tree etc.
	powerpc/xive: Fix xmon support on the PowerNV platform
	powerpc/kprobes: Ignore traps that happened in real mode
	powerpc/64: Prevent stack protection in early boot
	scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
	powerpc: Make setjmp/longjmp signature standard
	arm64: Always force a branch protection mode when the compiler has one
	dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
	dm clone: replace spin_lock_irqsave with spin_lock_irq
	dm clone: Fix handling of partial region discards
	dm clone: Add missing casts to prevent overflows and data corruption
	scsi: lpfc: Add registration for CPU Offline/Online events
	scsi: lpfc: Fix Fabric hostname registration if system hostname changes
	scsi: lpfc: Fix configuration of BB credit recovery in service parameters
	scsi: lpfc: Fix broken Credit Recovery after driver load
	Revert "drm/dp_mst: Remove VCPI while disabling topology mgr"
	drm/dp_mst: Fix clearing payload state on topology disable
	drm/amdgpu: fix gfx hang during suspend with video playback (v2)
	drm/i915/icl+: Don't enable DDI IO power on a TypeC port in TBT mode
	powerpc/kasan: Fix kasan_remap_early_shadow_ro()
	mmc: sdhci: Convert sdhci_set_timeout_irq() to non-static
	mmc: sdhci: Refactor sdhci_set_timeout()
	bpf: Fix tnum constraints for 32-bit comparisons
	mfd: dln2: Fix sanity checking for endpoints
	efi/x86: Fix the deletion of variables in mixed mode
	ASoC: stm32: sai: Add missing cleanup
	scsi: lpfc: fix inlining of lpfc_sli4_cleanup_poll_list()
	Linux 5.4.33

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6c37e2c64801a572781c46fc5883bcc74e6a7a1a
2020-04-17 11:26:58 +02:00
Nikos Tsironis
33344a7661 dm clone: Add missing casts to prevent overflows and data corruption
[ Upstream commit 9fc06ff56845cc5ccafec52f545fc2e08d22f849 ]

Add missing casts when converting from regions to sectors.

In case BITS_PER_LONG == 32, the lack of the appropriate casts can lead
to overflows and miscalculation of the device sector.

As a result, we could end up discarding and/or copying the wrong parts
of the device, thus corrupting the device's data.

Fixes: 7431b7835f ("dm: add clone target")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:24 +02:00
Nikos Tsironis
2d7eb7ee36 dm clone: Fix handling of partial region discards
[ Upstream commit 4b5142905d4ff58a4b93f7c8eaa7ba829c0a53c9 ]

There is a bug in the way dm-clone handles discards, which can lead to
discarding the wrong blocks or trying to discard blocks beyond the end
of the device.

This could lead to data corruption, if the destination device indeed
discards the underlying blocks, i.e., if the discard operation results
in the original contents of a block to be lost.

The root of the problem is the code that calculates the range of regions
covered by a discard request and decides which regions to discard.

Since dm-clone handles the device in units of regions, we don't discard
parts of a region, only whole regions.

The range is calculated as:

    rs = dm_sector_div_up(bio->bi_iter.bi_sector, clone->region_size);
    re = bio_end_sector(bio) >> clone->region_shift;

, where 'rs' is the first region to discard and (re - rs) is the number
of regions to discard.

The bug manifests when we try to discard part of a single region, i.e.,
when we try to discard a block with size < region_size, and the discard
request both starts at an offset with respect to the beginning of that
region and ends before the end of the region.

The root cause is the following comparison:

  if (rs == re)
    // skip discard and complete original bio immediately

, which doesn't take into account that 'rs' might be greater than 're'.

Thus, we then issue a discard request for the wrong blocks, instead of
skipping the discard all together.

Fix the check to also take into account the above case, so we don't end
up discarding the wrong blocks.

Also, add some range checks to dm_clone_set_region_hydrated() and
dm_clone_cond_set_range(), which update dm-clone's region bitmap.

Note that the aforementioned bug doesn't cause invalid memory accesses,
because dm_clone_is_range_hydrated() returns True for this case, so the
checks are just precautionary.

Fixes: 7431b7835f ("dm: add clone target")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:24 +02:00
Mikulas Patocka
dcf2f00b08 dm clone: replace spin_lock_irqsave with spin_lock_irq
[ Upstream commit 6ca43ed8376a51afec790dd484a51804ade4352a ]

If we are in a place where it is known that interrupts are enabled,
functions spin_lock_irq/spin_unlock_irq should be used instead of
spin_lock_irqsave/spin_unlock_irqrestore.

spin_lock_irq and spin_unlock_irq are faster because they don't need to
push and pop the flags register.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:23 +02:00
Bob Liu
fddfa591da dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
[ Upstream commit b8fdd090376a7a46d17db316638fe54b965c2fb0 ]

zmd->nr_rnd_zones was increased twice by mistake. The other place it
is increased in dmz_init_zone() is the only one needed:

1131                 zmd->nr_useable_zones++;
1132                 if (dmz_is_rnd(zone)) {
1133                         zmd->nr_rnd_zones++;
					^^^
Fixes: 3b1a94c88b ("dm zoned: drive-managed zoned block device target")
Cc: stable@vger.kernel.org
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:23 +02:00
Nikos Tsironis
a1ffc47f22 dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions()
commit 81d5553d1288c2ec0390f02f84d71ca0f0f9f137 upstream.

dm_clone_nr_of_hydrated_regions() returns the number of regions that
have been hydrated so far. In order to do so it employs bitmap_weight().

Until now, the return type of dm_clone_nr_of_hydrated_regions() was
unsigned long.

Because bitmap_weight() returns an int, in case BITS_PER_LONG == 64 and
the return value of bitmap_weight() is 2^31 (the maximum allowed number
of regions for a device), the result is sign extended from 32 bits to 64
bits and an incorrect value is displayed, in the status output of
dm-clone, as the number of hydrated regions.

Fix this by having dm_clone_nr_of_hydrated_regions() return an unsigned
int.

Fixes: 7431b7835f ("dm: add clone target")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:18 +02:00
Nikos Tsironis
996f8f1ba7 dm clone: Add overflow check for number of regions
commit cd481c12269b4d276f1a52eda0ebd419079bfe3a upstream.

Add overflow check for clone->nr_regions variable, which holds the
number of regions of the target.

The overflow can occur with sufficiently large devices, if BITS_PER_LONG
== 32. E.g., if the region size is 8 sectors (4K), the overflow would
occur for device sizes > 34359738360 sectors (~16TB).

This could result in multiple device sectors wrongly mapping to the same
region number, due to the truncation from 64 bits to 32 bits, which
would lead to data corruption.

Fixes: 7431b7835f ("dm: add clone target")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:17 +02:00
Shetty, Harshini X (EXT-Sony Mobile)
2e70305934 dm verity fec: fix memory leak in verity_fec_dtr
commit 75fa601934fda23d2f15bf44b09c2401942d8e15 upstream.

Fix below kmemleak detected in verity_fec_ctr. output_pool is
allocated for each dm-verity-fec device. But it is not freed when
dm-table for the verity target is removed. Hence free the output
mempool in destructor function verity_fec_dtr.

unreferenced object 0xffffffffa574d000 (size 4096):
  comm "init", pid 1667, jiffies 4294894890 (age 307.168s)
  hex dump (first 32 bytes):
    8e 36 00 98 66 a8 0b 9b 00 00 00 00 00 00 00 00  .6..f...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000060e82407>] __kmalloc+0x2b4/0x340
    [<00000000dd99488f>] mempool_kmalloc+0x18/0x20
    [<000000002560172b>] mempool_init_node+0x98/0x118
    [<000000006c3574d2>] mempool_init+0x14/0x20
    [<0000000008cb266e>] verity_fec_ctr+0x388/0x3b0
    [<000000000887261b>] verity_ctr+0x87c/0x8d0
    [<000000002b1e1c62>] dm_table_add_target+0x174/0x348
    [<000000002ad89eda>] table_load+0xe4/0x328
    [<000000001f06f5e9>] dm_ctl_ioctl+0x3b4/0x5a0
    [<00000000bee5fbb7>] do_vfs_ioctl+0x5dc/0x928
    [<00000000b475b8f5>] __arm64_sys_ioctl+0x70/0x98
    [<000000005361e2e8>] el0_svc_common+0xa0/0x158
    [<000000001374818f>] el0_svc_handler+0x6c/0x88
    [<000000003364e9f4>] el0_svc+0x8/0xc
    [<000000009d84cec9>] 0xffffffffffffffff

Fixes: a739ff3f54 ("dm verity: add support for forward error correction")
Depends-on: 6f1c819c21 ("dm: convert to bioset_init()/mempool_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Harshini Shetty <harshini.x.shetty@sony.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:17 +02:00
Mikulas Patocka
833309f3fb dm integrity: fix a crash with unusually large tag size
commit b93b6643e9b5a7f260b931e97f56ffa3fa65e26d upstream.

If the user specifies tag size larger than HASH_MAX_DIGESTSIZE,
there's a crash in integrity_metadata().

Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:17 +02:00
Mikulas Patocka
bef0d2f5fd dm writecache: add cond_resched to avoid CPU hangs
commit 1edaa447d958bec24c6a79685a5790d98976fd16 upstream.

Initializing a dm-writecache device can take a long time when the
persistent memory device is large.  Add cond_resched() to a few loops
to avoid warnings that the CPU is stuck.

Cc: stable@vger.kernel.org # v4.18+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:17 +02:00
Guoqing Jiang
2d29a61a14 md: check arrays is suspended in mddev_detach before call quiesce operations
[ Upstream commit 6b40bec3b13278d21fa6c1ae7a0bdf2e550eed5f ]

Don't call quiesce(1) and quiesce(0) if array is already suspended,
otherwise in level_store, the array is writable after mddev_detach
in below part though the intention is to make array writable after
resume.

	mddev_suspend(mddev);
	mddev_detach(mddev);
	...
	mddev_resume(mddev);

And it also causes calltrace as follows in [1].

[48005.653834] WARNING: CPU: 1 PID: 45380 at kernel/kthread.c:510 kthread_park+0x77/0x90
[...]
[48005.653976] CPU: 1 PID: 45380 Comm: mdadm Tainted: G           OE     5.4.10-arch1-1 #1
[48005.653979] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4105-ITX, BIOS P1.40 08/06/2018
[48005.653984] RIP: 0010:kthread_park+0x77/0x90
[48005.654015] Call Trace:
[48005.654039]  r5l_quiesce+0x3c/0x70 [raid456]
[48005.654052]  raid5_quiesce+0x228/0x2e0 [raid456]
[48005.654073]  mddev_detach+0x30/0x70 [md_mod]
[48005.654090]  level_store+0x202/0x670 [md_mod]
[48005.654099]  ? security_capable+0x40/0x60
[48005.654114]  md_attr_store+0x7b/0xc0 [md_mod]
[48005.654123]  kernfs_fop_write+0xce/0x1b0
[48005.654132]  vfs_write+0xb6/0x1a0
[48005.654138]  ksys_write+0x67/0xe0
[48005.654146]  do_syscall_64+0x4e/0x140
[48005.654155]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[48005.654161] RIP: 0033:0x7fa0c8737497

[1]: https://bugzilla.kernel.org/show_bug.cgi?id=206161

Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:04 +02:00
Greg Kroah-Hartman
33717ea779 This is the 5.4.31 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6NeIEACgkQONu9yGCS
 aT6MYhAAl32aRPkceCidQx1xxOtwPHj/to5aKlqlJZL83wUHtyKI7QYZ6/xE4nAO
 hT668KM//KKg3UYeuAizfVUIQk703iDZvfQtffkZ1GP9WtyTWq0Iv4nZm7ohzUNH
 rTTyF+g1DJwewn+9qpkW2hqUviSsu6dGzIgmmO82M1Egu6Dcc03DxMIlUO+2fCLC
 j9R1vDeyzigmrO7o5lHngor3Re1TI5uLTonNZTdlhJIe7qc9z3aajoucGG4QcwuO
 99k08F64dwXK+JV2SJQ+E0NBQlwbYLer0HTCyO6xTGT90WfH6tDYDM7zi4UT42qi
 UwDhChmxr3ezffuNnNttIt+xt3PTuCjBJOgMSt1F1jb7IA0a1H2GOTUJUBn4S8ol
 ocTqpHymDJEgJ1fBjLHbN+ZZrsCeTgWyBu/FL71Pw5CtoY+Z/EsN64XBrbO4uMB8
 rB48d+TksikLLZ/qBja0bSXUUh2wVdBZ5EbjcPTetqmeOmvl5xGLxRks0HT62BuD
 BAT3nJ3rOMgc7INK2WJL3QlGqnJLXKu3wPtbq29ADfgLnbOt8WAPs4KooZKZpeh2
 fkiLUQ2UEFkEOiXjmh/JAHR8mUVa7NXbb0IILDpMW9vZINT69gFeXs43RRcZ1O+8
 G369xEweZg0T30sj1KLOLzgxP/K1EPXdq1FvvByUynsRuCFBVk8=
 =Bu2+
 -----END PGP SIGNATURE-----

Merge 5.4.31 into android-5.4

Changes in 5.4.31
	nvme-rdma: Avoid double freeing of async event data
	kconfig: introduce m32-flag and m64-flag
	drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
	drm/bochs: downgrade pci_request_region failure from error to warning
	initramfs: restore default compression behavior
	drm/amdgpu: fix typo for vcn1 idle check
	tools/power turbostat: Fix gcc build warnings
	tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
	tools/power turbostat: Fix 32-bit capabilities warning
	net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow
	XArray: Fix xa_find_next for large multi-index entries
	padata: fix uninitialized return value in padata_replace()
	brcmfmac: abort and release host after error
	misc: rtsx: set correct pcr_ops for rts522A
	misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices
	misc: pci_endpoint_test: Avoid using module parameter to determine irqtype
	PCI: sysfs: Revert "rescan" file renames
	coresight: do not use the BIT() macro in the UAPI header
	mei: me: add cedar fork device ids
	nvmem: check for NULL reg_read and reg_write before dereferencing
	extcon: axp288: Add wakeup support
	power: supply: axp288_charger: Add special handling for HP Pavilion x2 10
	Revert "dm: always call blk_queue_split() in dm_process_bio()"
	ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard
	soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
	net/mlx5e: kTLS, Fix wrong value in record tracker enum
	iwlwifi: consider HE capability when setting LDPC
	iwlwifi: yoyo: don't add TLV offset when reading FIFOs
	iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
	rxrpc: Fix sendmsg(MSG_WAITALL) handling
	IB/hfi1: Ensure pq is not left on waitlist
	tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
	watchdog: iTCO_wdt: Export vendorsupport
	watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional
	i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
	net: Fix Tx hash bound checking
	padata: always acquire cpu_hotplug_lock before pinst->lock
	mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
	Linux 5.4.31

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9c87409ae13ad2da7a90be98586a85904a5cdb33
2020-04-08 13:00:39 +02:00
Mike Snitzer
2892100bc8 Revert "dm: always call blk_queue_split() in dm_process_bio()"
commit 120c9257f5f19e5d1e87efcbb5531b7cd81b7d74 upstream.

This reverts commit effd58c95f.

blk_queue_split() is causing excessive IO splitting -- because
blk_max_size_offset() depends on 'chunk_sectors' limit being set and
if it isn't (as is the case for DM targets!) it falls back to
splitting on a 'max_sectors' boundary regardless of offset.

"Fix" this by reverting back to _not_ using blk_queue_split() in
dm_process_bio() for normal IO (reads and writes).  Long-term fix is
still TBD but it should focus on training blk_max_size_offset() to
call into a DM provided hook (to call DM's max_io_len()).

Test results from simple misaligned IO test on 4-way dm-striped device
with chunksize of 128K and stripesize of 512K:

xfs_io -d -c 'pread -b 2m 224s 4072s' /dev/mapper/stripe_dev

before this revert:

253,0   21        1     0.000000000  2206  Q   R 224 + 4072 [xfs_io]
253,0   21        2     0.000008267  2206  X   R 224 / 480 [xfs_io]
253,0   21        3     0.000010530  2206  X   R 224 / 256 [xfs_io]
253,0   21        4     0.000027022  2206  X   R 480 / 736 [xfs_io]
253,0   21        5     0.000028751  2206  X   R 480 / 512 [xfs_io]
253,0   21        6     0.000033323  2206  X   R 736 / 992 [xfs_io]
253,0   21        7     0.000035130  2206  X   R 736 / 768 [xfs_io]
253,0   21        8     0.000039146  2206  X   R 992 / 1248 [xfs_io]
253,0   21        9     0.000040734  2206  X   R 992 / 1024 [xfs_io]
253,0   21       10     0.000044694  2206  X   R 1248 / 1504 [xfs_io]
253,0   21       11     0.000046422  2206  X   R 1248 / 1280 [xfs_io]
253,0   21       12     0.000050376  2206  X   R 1504 / 1760 [xfs_io]
253,0   21       13     0.000051974  2206  X   R 1504 / 1536 [xfs_io]
253,0   21       14     0.000055881  2206  X   R 1760 / 2016 [xfs_io]
253,0   21       15     0.000057462  2206  X   R 1760 / 1792 [xfs_io]
253,0   21       16     0.000060999  2206  X   R 2016 / 2272 [xfs_io]
253,0   21       17     0.000062489  2206  X   R 2016 / 2048 [xfs_io]
253,0   21       18     0.000066133  2206  X   R 2272 / 2528 [xfs_io]
253,0   21       19     0.000067507  2206  X   R 2272 / 2304 [xfs_io]
253,0   21       20     0.000071136  2206  X   R 2528 / 2784 [xfs_io]
253,0   21       21     0.000072764  2206  X   R 2528 / 2560 [xfs_io]
253,0   21       22     0.000076185  2206  X   R 2784 / 3040 [xfs_io]
253,0   21       23     0.000077486  2206  X   R 2784 / 2816 [xfs_io]
253,0   21       24     0.000080885  2206  X   R 3040 / 3296 [xfs_io]
253,0   21       25     0.000082316  2206  X   R 3040 / 3072 [xfs_io]
253,0   21       26     0.000085788  2206  X   R 3296 / 3552 [xfs_io]
253,0   21       27     0.000087096  2206  X   R 3296 / 3328 [xfs_io]
253,0   21       28     0.000093469  2206  X   R 3552 / 3808 [xfs_io]
253,0   21       29     0.000095186  2206  X   R 3552 / 3584 [xfs_io]
253,0   21       30     0.000099228  2206  X   R 3808 / 4064 [xfs_io]
253,0   21       31     0.000101062  2206  X   R 3808 / 3840 [xfs_io]
253,0   21       32     0.000104956  2206  X   R 4064 / 4096 [xfs_io]
253,0   21       33     0.001138823     0  C   R 4096 + 200 [0]

after this revert:

253,0   18        1     0.000000000  4430  Q   R 224 + 3896 [xfs_io]
253,0   18        2     0.000018359  4430  X   R 224 / 256 [xfs_io]
253,0   18        3     0.000028898  4430  X   R 256 / 512 [xfs_io]
253,0   18        4     0.000033535  4430  X   R 512 / 768 [xfs_io]
253,0   18        5     0.000065684  4430  X   R 768 / 1024 [xfs_io]
253,0   18        6     0.000091695  4430  X   R 1024 / 1280 [xfs_io]
253,0   18        7     0.000098494  4430  X   R 1280 / 1536 [xfs_io]
253,0   18        8     0.000114069  4430  X   R 1536 / 1792 [xfs_io]
253,0   18        9     0.000129483  4430  X   R 1792 / 2048 [xfs_io]
253,0   18       10     0.000136759  4430  X   R 2048 / 2304 [xfs_io]
253,0   18       11     0.000152412  4430  X   R 2304 / 2560 [xfs_io]
253,0   18       12     0.000160758  4430  X   R 2560 / 2816 [xfs_io]
253,0   18       13     0.000183385  4430  X   R 2816 / 3072 [xfs_io]
253,0   18       14     0.000190797  4430  X   R 3072 / 3328 [xfs_io]
253,0   18       15     0.000197667  4430  X   R 3328 / 3584 [xfs_io]
253,0   18       16     0.000218751  4430  X   R 3584 / 3840 [xfs_io]
253,0   18       17     0.000226005  4430  X   R 3840 / 4096 [xfs_io]
253,0   18       18     0.000250404  4430  Q   R 4120 + 176 [xfs_io]
253,0   18       19     0.000847708     0  C   R 4096 + 24 [0]
253,0   18       20     0.000855783     0  C   R 4120 + 176 [0]

Fixes: effd58c95f ("dm: always call blk_queue_split() in dm_process_bio()")
Cc: stable@vger.kernel.org
Reported-by: Andreas Gruenbacher <agruenba@redhat.com>
Tested-by: Barry Marson <bmarson@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-08 09:08:43 +02:00
Eric Biggers
0367acdde3 ANDROID: block: require drivers to declare supported crypto key type(s)
We need a way to tell which type of keys the inline crypto hardware
supports (standard, wrapped, or both), so that fallbacks can be used
when needed (either blk-crypto-fallback, or fscrypt fs-layer crypto).

We can't simply assume that

    keyslot_mgmt_ll_ops::derive_raw_secret == NULL

means only standard keys are supported and that

    keyslot_mgmt_ll_ops::derive_raw_secret != NULL

means that only wrapped keys are supported, because device-mapper
devices always implement this method.  Also, hardware might support both
types of keys.

Therefore, add a field keyslot_manager::features which contains a
bitmask of flags which indicate the supported types of keys.  Drivers
will need to fill this in.  This patch makes the UFS standard crypto
code set BLK_CRYPTO_FEATURE_STANDARD_KEYS, but UFS variant drivers may
need to set BLK_CRYPTO_FEATURE_WRAPPED_KEYS instead.

Then, make keyslot_manager_crypto_mode_supported() take the key type
into account.

Bug: 137270441
Bug: 151100202
Test: 'atest vts_kernel_encryption_test' on Pixel 4 with the
      inline crypto patches backported, and also on Cuttlefish.
Change-Id: Ied846c2767c1fd2f438792dcfd3649157e68b005
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-04-07 17:58:49 +00:00
Dylan Chang
9503d046c9 ANDROID: dm-bow: Fix free_show value is incorrect
Fix free_show value is incorrect

Change-Id: If7f36a64afa600c980ee8a25393f8716a6ffd474
Signed-off-by: Dylan Chang <dylan.chang@oneplus.com>
Bug: 152116739
(cherry picked from commit feff0b2236497c0651baa7f59ea50c2377fff053)
Signed-off-by: Paul Lawrence <paullawrence@google.com>
2020-03-26 19:06:44 +00:00
Greg Kroah-Hartman
2341be6d9d This is the 5.4.28 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl57B4gACgkQONu9yGCS
 aT6KWQ//ToF4D+fDl1Muf4xuT83HnXe1yA1XFlyC54ZmEaxGFnFMSAgAvitBR7HC
 GEczXlvYbbVJl646ynTmX/LFz2d+V0i2zGv2QKN3xfd8GtDrAq/s+Ffhneaskk1k
 gKkIUzOyBq0nEAq5vXbCT4LbQDYGLw8BxxvurLim/YywSy5sfnw+hKkYE7cVVSOa
 rTIdt5qnuL4pxD8VeCAakoU6SajoxfFqS8pX79LC1UPY+++OaVcJjyJvM4APw0Kr
 e2E1BaeZxxCyY57pQY2oqhjG3cCfIcmfln19JRzMCVNo9+J3MEjZI5EUqP/Zcjwz
 1V5FHqDmqMGfA9cn+CexDk79bTKW5+YOyYMEG2RJjV5alWJtvv3Wj6dRPVPpBhnJ
 O627IuIVGMsHuiEbjziKczaTtYYU5GTpJF+7COH0Jnud0q1w3/RjaJXspnb2Yozh
 L9BFqc4aonD+AyW2NXTxuuvc3hnD2YSVgLectm7LF/TbM2YFJVu4tounelFsGG6I
 CPH2VF0Tn+yNR2iWf8igvopvYPCjv+QFGXU6kFGxQxLQFTnXHqoO2sPF4awXx7Hv
 XF8LrJzPwissX5BbPyhUSIl0FEcmQi6UzSN1/6fpxVq+092OGVacMWpZvwqjUOV/
 3k/OrmcYsu7i2UUbms47YHAK0PRkL2ogKgxgcSO4aNZ7MfkXkm8=
 =kp1m
 -----END PGP SIGNATURE-----

Merge 5.4.28 into android-5.4

Changes in 5.4.28
	locks: fix a potential use-after-free problem when wakeup a waiter
	locks: reinstate locks_delete_block optimization
	spi: spi-omap2-mcspi: Support probe deferral for DMA channels
	drm/mediatek: Find the cursor plane instead of hard coding it
	phy: ti: gmii-sel: fix set of copy-paste errors
	phy: ti: gmii-sel: do not fail in case of gmii
	ARM: dts: dra7-l4: mark timer13-16 as pwm capable
	spi: qup: call spi_qup_pm_resume_runtime before suspending
	powerpc: Include .BTF section
	cifs: fix potential mismatch of UNC paths
	cifs: add missing mount option to /proc/mounts
	ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
	spi: pxa2xx: Add CS control clock quirk
	spi/zynqmp: remove entry that causes a cs glitch
	drm/exynos: dsi: propagate error value and silence meaningless warning
	drm/exynos: dsi: fix workaround for the legacy clock name
	drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails
	drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition
	drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
	altera-stapl: altera_get_note: prevent write beyond end of 'key'
	dm bio record: save/restore bi_end_io and bi_integrity
	dm integrity: use dm_bio_record and dm_bio_restore
	riscv: avoid the PIC offset of static percpu data in module beyond 2G limits
	ASoC: stm32: sai: manage rebind issue
	spi: spi_register_controller(): free bus id on error paths
	riscv: Force flat memory model with no-mmu
	riscv: Fix range looking for kernel image memblock
	drm/amdgpu: clean wptr on wb when gpu recovery
	drm/amd/display: Clear link settings on MST disable connector
	drm/amd/display: fix dcc swath size calculations on dcn1
	xenbus: req->body should be updated before req->state
	xenbus: req->err should be updated before req->state
	block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group()
	parse-maintainers: Mark as executable
	binderfs: use refcount for binder control devices too
	Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present"
	USB: Disable LPM on WD19's Realtek Hub
	usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
	USB: serial: option: add ME910G1 ECM composition 0x110b
	usb: host: xhci-plat: add a shutdown
	USB: serial: pl2303: add device-id for HP LD381
	usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
	usb: typec: ucsi: displayport: Fix NULL pointer dereference
	usb: typec: ucsi: displayport: Fix a potential race during registration
	USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
	USB: cdc-acm: fix rounding error in TIOCSSERIAL
	ALSA: line6: Fix endless MIDI read loop
	ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662
	ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662
	ALSA: seq: virmidi: Fix running status after receiving sysex
	ALSA: seq: oss: Fix running status after receiving sysex
	ALSA: pcm: oss: Avoid plugin buffer overflow
	ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
	tty: fix compat TIOCGSERIAL leaking uninitialized memory
	tty: fix compat TIOCGSERIAL checking wrong function ptr
	iio: chemical: sps30: fix missing triggered buffer dependency
	iio: st_sensors: remap SMO8840 to LIS2DH12
	iio: trigger: stm32-timer: disable master mode when stopping
	iio: accel: adxl372: Set iio_chan BE
	iio: magnetometer: ak8974: Fix negative raw values in sysfs
	iio: adc: stm32-dfsdm: fix sleep in atomic context
	iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
	iio: light: vcnl4000: update sampling periods for vcnl4200
	iio: light: vcnl4000: update sampling periods for vcnl4040
	mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
	mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
	mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
	CIFS: fiemap: do not return EINVAL if get nothing
	kbuild: Disable -Wpointer-to-enum-cast
	staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
	staging: greybus: loopback_test: fix poll-mask build breakage
	staging/speakup: fix get_word non-space look-ahead
	intel_th: msu: Fix the unexpected state warning
	intel_th: Fix user-visible error codes
	intel_th: pci: Add Elkhart Lake CPU support
	modpost: move the namespace field in Module.symvers last
	rtc: max8907: add missing select REGMAP_IRQ
	arm64: compat: Fix syscall number of compat_clock_getres
	xhci: Do not open code __print_symbolic() in xhci trace events
	btrfs: fix log context list corruption after rename whiteout error
	drm/amd/amdgpu: Fix GPR read from debugfs (v2)
	drm/lease: fix WARNING in idr_destroy
	stm class: sys-t: Fix the use of time_after()
	memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
	mm, memcg: fix corruption on 64-bit divisor in memory.high throttling
	mm, memcg: throttle allocators based on ancestral memory.high
	mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case
	mm: do not allow MADV_PAGEOUT for CoW pages
	epoll: fix possible lost wakeup on epoll_ctl() path
	mm: slub: be more careful about the double cmpxchg of freelist
	mm, slub: prevent kmalloc_node crashes and memory leaks
	page-flags: fix a crash at SetPageError(THP_SWAP)
	x86/mm: split vmalloc_sync_all()
	futex: Fix inode life-time issue
	futex: Unbreak futex hashing
	ALSA: hda/realtek: Fix pop noise on ALC225
	arm64: smp: fix smp_send_stop() behaviour
	arm64: smp: fix crash_smp_send_stop() behaviour
	nvmet-tcp: set MSG_MORE only if we actually have more to send
	drm/bridge: dw-hdmi: fix AVI frame colorimetry
	staging: greybus: loopback_test: fix potential path truncation
	staging: greybus: loopback_test: fix potential path truncations
	Linux 5.4.28

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5d9d15d6236d8ab7374205c6ceda7efa7a9abb70
2020-03-25 16:12:11 +01:00
Mike Snitzer
1804cdf99f dm integrity: use dm_bio_record and dm_bio_restore
[ Upstream commit 248aa2645aa7fc9175d1107c2593cc90d4af5a4e ]

In cases where dec_in_flight() has to requeue the integrity_bio_wait
work to transfer the rest of the data, the bio's __bi_remaining might
already have been decremented to 0, e.g.: if bio passed to underlying
data device was split via blk_queue_split().

Use dm_bio_{record,restore} rather than effectively open-coding them in
dm-integrity -- these methods now manage __bi_remaining too.

Depends-on: f7f0b057a9c1 ("dm bio record: save/restore bi_end_io and bi_integrity")
Reported-by: Daniel Glöckner <dg@emlix.com>
Suggested-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-25 08:25:48 +01:00
Mike Snitzer
2e7e6de9ae dm bio record: save/restore bi_end_io and bi_integrity
[ Upstream commit 1b17159e52bb31f982f82a6278acd7fab1d3f67b ]

Also, save/restore __bi_remaining in case the bio was used in a
BIO_CHAIN (e.g. due to blk_queue_split).

Suggested-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-25 08:25:48 +01:00
Greg Kroah-Hartman
6d52041543 This is the 5.4.25 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5qJSMACgkQONu9yGCS
 aT6/Dw//Usg9m0cBB4Ip4fYxI0EVz8BgnVe9KSdt+71gM63QCOi1ZeTS0NDMUtO0
 MTsQSudUpfntrT8QHCmBwCZ5LlAAZvxDS9UOqnhkWbqNY5jGmUhH5u28RJL28dp2
 8wJY6zZKg+pfOWXd81slW86uN27QZvURNEthT81sN2ucxe5DXV1gs87FILSdMpXm
 I0Z3LpUoZDjpONeA6WTZqkDNA0J7Z9QjULx9/4LFi/gc0q1ApWC7FV1A9gpQHaBa
 w4kDWJCGqq3mNx8Hi9BHau50VUHX5tuKvpn9RcmSl9BBba25pE5h0EVIGo8Dlq+9
 T9hkVR5iXeMbFERnLm5iR0DjFHog/mOgAgUHSTTXB3BcdgIKWwUcc2gCcr2Y7KIK
 CD7l+kX1nWUk4yYre7zXiG/vO9ilYgeboc8C5Qdq3XR6zaO90+8NUbCOpa2+6yEF
 H7kugstb6l+iCJ1k8YJd0ORGOobl68+P79TLxAOFnkNGJRzuAoXmBH+xkqAugz1H
 YKKAbE+MzW75sre7PxU1g1uPOHxfMfd5e3uRtUU5OETJv0A2kTte8ay5rqLNbe7H
 QYqdfwTr2oFssnWKW5d/KdSopD5A/31/Kjkmzl6ED2xaLMEpA7zyed5p+G/Beu5s
 dkPlteya8wCQ1W/KtDJRhbCauoG/NyCKIeoQitHBJwMapcEo8ZU=
 =rDP8
 -----END PGP SIGNATURE-----

Merge 5.4.25 into android-5.4

Changes in 5.4.25
	block, bfq: get extra ref to prevent a queue from being freed during a group move
	block, bfq: do not insert oom queue into position tree
	ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
	net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
	net: stmmac: fix notifier registration
	dm thin metadata: fix lockdep complaint
	RDMA/core: Fix pkey and port assignment in get_new_pps
	RDMA/core: Fix use of logical OR in get_new_pps
	kbuild: fix 'No such file or directory' warning when cleaning
	kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
	blktrace: fix dereference after null check
	ALSA: hda: do not override bus codec_mask in link_get()
	serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
	selftests: fix too long argument
	usb: gadget: composite: Support more than 500mA MaxPower
	usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
	usb: gadget: serial: fix Tx stall after buffer overflow
	habanalabs: halt the engines before hard-reset
	habanalabs: do not halt CoreSight during hard reset
	habanalabs: patched cb equals user cb in device memset
	drm/msm/mdp5: rate limit pp done timeout warnings
	drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
	drm/modes: Make sure to parse valid rotation value from cmdline
	drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters
	scsi: megaraid_sas: silence a warning
	drm/msm/dsi: save pll state before dsi host is powered off
	drm/msm/dsi/pll: call vco set rate explicitly
	selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing
	selftests: forwarding: vxlan_bridge_1d: fix tos value
	net: atlantic: check rpc result and wait for rpc address
	net: ks8851-ml: Remove 8-bit bus accessors
	net: ks8851-ml: Fix 16-bit data access
	net: ks8851-ml: Fix 16-bit IO operation
	net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt()
	watchdog: da9062: do not ping the hw during stop()
	s390/cio: cio_ignore_proc_seq_next should increase position index
	s390: make 'install' not depend on vmlinux
	efi: Only print errors about failing to get certs if EFI vars are found
	net/mlx5: DR, Fix matching on vport gvmi
	iommu/amd: Disable IOMMU on Stoney Ridge systems
	nvme/pci: Add sleep quirk for Samsung and Toshiba drives
	nvme-pci: Use single IRQ vector for old Apple models
	x86/boot/compressed: Don't declare __force_order in kaslr_64.c
	s390/qdio: fill SL with absolute addresses
	nvme: Fix uninitialized-variable warning
	ice: Don't tell the OS that link is going down
	x86/xen: Distribute switch variables for initialization
	net: thunderx: workaround BGX TX Underflow issue
	csky/mm: Fixup export invalid_pte_table symbol
	csky: Set regs->usp to kernel sp, when the exception is from kernel
	csky/smp: Fixup boot failed when CONFIG_SMP
	csky: Fixup ftrace modify panic
	csky: Fixup compile warning for three unimplemented syscalls
	arch/csky: fix some Kconfig typos
	selftests: forwarding: vxlan_bridge_1d: use more proper tos value
	firmware: imx: scu: Ensure sequential TX
	binder: prevent UAF for binderfs devices
	binder: prevent UAF for binderfs devices II
	ALSA: hda/realtek - Add Headset Mic supported
	ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1
	ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master
	ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
	cifs: don't leak -EAGAIN for stat() during reconnect
	cifs: fix rename() by ensuring source handle opened with DELETE bit
	usb: storage: Add quirk for Samsung Fit flash
	usb: quirks: add NO_LPM quirk for Logitech Screen Share
	usb: dwc3: gadget: Update chain bit correctly when using sg list
	usb: cdns3: gadget: link trb should point to next request
	usb: cdns3: gadget: toggle cycle bit before reset endpoint
	usb: core: hub: fix unhandled return by employing a void function
	usb: core: hub: do error out if usb_autopm_get_interface() fails
	usb: core: port: do error out if usb_autopm_get_interface() fails
	vgacon: Fix a UAF in vgacon_invert_region
	mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
	mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()
	mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
	fat: fix uninit-memory access for partial initialized inode
	btrfs: fix RAID direct I/O reads with alternate csums
	arm64: dts: socfpga: agilex: Fix gmac compatible
	arm: dts: dra76x: Fix mmc3 max-frequency
	tty:serial:mvebu-uart:fix a wrong return
	tty: serial: fsl_lpuart: free IDs allocated by IDA
	serial: 8250_exar: add support for ACCES cards
	vt: selection, close sel_buffer race
	vt: selection, push console lock down
	vt: selection, push sel_lock up
	media: hantro: Fix broken media controller links
	media: mc-entity.c: use & to check pad flags, not ==
	media: vicodec: process all 4 components for RGB32 formats
	media: v4l2-mem2mem.c: fix broken links
	perf intel-pt: Fix endless record after being terminated
	perf intel-bts: Fix endless record after being terminated
	perf cs-etm: Fix endless record after being terminated
	perf arm-spe: Fix endless record after being terminated
	spi: spidev: Fix CS polarity if GPIO descriptors are used
	x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
	s390/pci: Fix unexpected write combine on resource
	s390/mm: fix panic in gup_fast on large pud
	dmaengine: imx-sdma: fix context cache
	dmaengine: imx-sdma: Fix the event id check to include RX event for UART6
	dmaengine: tegra-apb: Fix use-after-free
	dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
	dm integrity: fix recalculation when moving from journal mode to bitmap mode
	dm integrity: fix a deadlock due to offloading to an incorrect workqueue
	dm integrity: fix invalid table returned due to argument count mismatch
	dm cache: fix a crash due to incorrect work item cancelling
	dm: report suspended device during destroy
	dm writecache: verify watermark during resume
	dm zoned: Fix reference counter initial value of chunk works
	dm: fix congested_fn for request-based device
	arm64: dts: meson-sm1-sei610: add missing interrupt-names
	ARM: dts: ls1021a: Restore MDIO compatible to gianfar
	spi: bcm63xx-hsspi: Really keep pll clk enabled
	drm/virtio: make resource id workaround runtime switchable.
	drm/virtio: fix resource id creation race
	ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
	ASoC: topology: Fix memleak in soc_tplg_manifest_load()
	ASoC: SOF: Fix snd_sof_ipc_stream_posn()
	ASoC: intel: skl: Fix pin debug prints
	ASoC: intel: skl: Fix possible buffer overflow in debug outputs
	powerpc: define helpers to get L1 icache sizes
	powerpc: Convert flush_icache_range & friends to C
	powerpc/mm: Fix missing KUAP disable in flush_coherent_icache()
	ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
	ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
	ASoC: Intel: Skylake: Fix available clock counter incrementation
	ASoC: dapm: Correct DAPM handling of active widgets during shutdown
	spi: atmel-quadspi: fix possible MMIO window size overrun
	drm/panfrost: Don't try to map on error faults
	drm: kirin: Revert "Fix for hikey620 display offset problem"
	drm/sun4i: Add separate DE3 VI layer formats
	drm/sun4i: Fix DE2 VI layer format support
	drm/sun4i: de2/de3: Remove unsupported VI layer formats
	drm/i915: Program MBUS with rmw during initialization
	drm/i915/selftests: Fix return in assert_mmap_offset()
	phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
	phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
	ARM: dts: imx6: phycore-som: fix emmc supply
	arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY
	firmware: imx: misc: Align imx sc msg structs to 4
	firmware: imx: scu-pd: Align imx sc msg structs to 4
	firmware: imx: Align imx_sc_msg_req_cpu_start to 4
	soc: imx-scu: Align imx sc msg structs to 4
	Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
	RDMA/rw: Fix error flow during RDMA context initialization
	RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
	RDMA/siw: Fix failure handling during device creation
	RDMA/iwcm: Fix iwcm work deallocation
	RDMA/core: Fix protection fault in ib_mr_pool_destroy
	regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling
	RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
	IB/hfi1, qib: Ensure RCU is locked when accessing list
	ARM: imx: build v7_cpu_resume() unconditionally
	ARM: dts: am437x-idk-evm: Fix incorrect OPP node names
	ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source
	ARM: dts: imx7-colibri: Fix frequency for sd/mmc
	hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
	dma-buf: free dmabuf->name in dma_buf_release()
	dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
	arm64: dts: meson: fix gxm-khadas-vim2 wifi
	bus: ti-sysc: Fix 1-wire reset quirk
	EDAC/synopsys: Do not print an error with back-to-back snprintf() calls
	powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
	efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper
	efi/x86: Handle by-ref arguments covering multiple pages in mixed mode
	efi: READ_ONCE rng seed size before munmap
	block, bfq: get a ref to a group when adding it to a service tree
	block, bfq: remove ifdefs from around gets/puts of bfq groups
	csky: Implement copy_thread_tls
	drm/virtio: module_param_named() requires linux/moduleparam.h
	Linux 5.4.25

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8ba29f273c7a2b02bfa54593f7a9087c34607cd5
2020-03-12 17:09:04 +01:00
Hou Tao
2a767bab5a dm: fix congested_fn for request-based device
commit 974f51e8633f0f3f33e8f86bbb5ae66758aa63c7 upstream.

We neither assign congested_fn for requested-based blk-mq device nor
implement it correctly. So fix both.

Also, remove incorrect comment from dm_init_normal_md_queue and rename
it to dm_init_congested_fn.

Fixes: 4aa9c692e0 ("bdi: separate out congested state into a separate struct")
Cc: stable@vger.kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:24 +01:00
Shin'ichiro Kawasaki
5c929bcb7a dm zoned: Fix reference counter initial value of chunk works
commit ee63634bae02e13c8c0df1209a6a0ca5326f3189 upstream.

Dm-zoned initializes reference counters of new chunk works with zero
value and refcount_inc() is called to increment the counter. However, the
refcount_inc() function handles the addition to zero value as an error
and triggers the warning as follows:

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 7 PID: 1506 at lib/refcount.c:25 refcount_warn_saturate+0x68/0xf0
...
CPU: 7 PID: 1506 Comm: systemd-udevd Not tainted 5.4.0+ #134
...
Call Trace:
 dmz_map+0x2d2/0x350 [dm_zoned]
 __map_bio+0x42/0x1a0
 __split_and_process_non_flush+0x14a/0x1b0
 __split_and_process_bio+0x83/0x240
 ? kmem_cache_alloc+0x165/0x220
 dm_process_bio+0x90/0x230
 ? generic_make_request_checks+0x2e7/0x680
 dm_make_request+0x3e/0xb0
 generic_make_request+0xcf/0x320
 ? memcg_drain_all_list_lrus+0x1c0/0x1c0
 submit_bio+0x3c/0x160
 ? guard_bio_eod+0x2c/0x130
 mpage_readpages+0x182/0x1d0
 ? bdev_evict_inode+0xf0/0xf0
 read_pages+0x6b/0x1b0
 __do_page_cache_readahead+0x1ba/0x1d0
 force_page_cache_readahead+0x93/0x100
 generic_file_read_iter+0x83a/0xe40
 ? __seccomp_filter+0x7b/0x670
 new_sync_read+0x12a/0x1c0
 vfs_read+0x9d/0x150
 ksys_read+0x5f/0xe0
 do_syscall_64+0x5b/0x180
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
...

After this warning, following refcount API calls for the counter all fail
to change the counter value.

Fix this by setting the initial reference counter value not zero but one
for the new chunk works. Instead, do not call refcount_inc() via
dmz_get_chunk_work() for the new chunks works.

The failure was observed with linux version 5.4 with CONFIG_REFCOUNT_FULL
enabled. Refcount rework was merged to linux version 5.5 by the
commit 168829ad09ca ("Merge branch 'locking-core-for-linus' of
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip"). After this
commit, CONFIG_REFCOUNT_FULL was removed and the failure was observed
regardless of kernel configuration.

Linux version 4.20 merged the commit 092b564876 ("dm zoned: target: use
refcount_t for dm zoned reference counters"). Before this commit, dm
zoned used atomic_t APIs which does not check addition to zero, then this
fix is not necessary.

Fixes: 092b564876 ("dm zoned: target: use refcount_t for dm zoned reference counters")
Cc: stable@vger.kernel.org # 5.4+
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:24 +01:00
Mikulas Patocka
7b753d805e dm writecache: verify watermark during resume
commit 41c526c5af46d4c4dab7f72c99000b7fac0b9702 upstream.

Verify the watermark upon resume - so that if the target is reloaded
with lower watermark, it will start the cleanup process immediately.

Fixes: 48debafe4f ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:24 +01:00
Mikulas Patocka
86543852e4 dm: report suspended device during destroy
commit adc0daad366b62ca1bce3e2958a40b0b71a8b8b3 upstream.

The function dm_suspended returns true if the target is suspended.
However, when the target is being suspended during unload, it returns
false.

An example where this is a problem: the test "!dm_suspended(wc->ti)" in
writecache_writeback is not sufficient, because dm_suspended returns
zero while writecache_suspend is in progress.  As is, without an
enhanced dm_suspended, simply switching from flush_workqueue to
drain_workqueue still emits warnings:
workqueue writecache-writeback: drain_workqueue() isn't complete after 10 tries
workqueue writecache-writeback: drain_workqueue() isn't complete after 100 tries
workqueue writecache-writeback: drain_workqueue() isn't complete after 200 tries
workqueue writecache-writeback: drain_workqueue() isn't complete after 300 tries
workqueue writecache-writeback: drain_workqueue() isn't complete after 400 tries

writecache_suspend calls flush_workqueue(wc->writeback_wq) - this function
flushes the current work. However, the workqueue may re-queue itself and
flush_workqueue doesn't wait for re-queued works to finish. Because of
this - the function writecache_writeback continues execution after the
device was suspended and then concurrently with writecache_dtr, causing
a crash in writecache_writeback.

We must use drain_workqueue - that waits until the work and all re-queued
works finish.

As a prereq for switching to drain_workqueue, this commit fixes
dm_suspended to return true after the presuspend hook and before the
postsuspend hook - just like during a normal suspend. It allows
simplifying the dm-integrity and dm-writecache targets so that they
don't have to maintain suspended flags on their own.

With this change use of drain_workqueue() can be used effectively.  This
change was tested with the lvm2 testsuite and cryptsetup testsuite and
the are no regressions.

Fixes: 48debafe4f ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18+
Reported-by: Corey Marthaler <cmarthal@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:23 +01:00
Mikulas Patocka
e600edc7d8 dm cache: fix a crash due to incorrect work item cancelling
commit 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 upstream.

The crash can be reproduced by running the lvm2 testsuite test
lvconvert-thin-external-cache.sh for several minutes, e.g.:
  while :; do make check T=shell/lvconvert-thin-external-cache.sh; done

The crash happens in this call chain:
do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset
-> memset -> __memset -- which accesses an invalid pointer in the vmalloc
area.

The work entry on the workqueue is executed even after the bitmap was
freed. The problem is that cancel_delayed_work doesn't wait for the
running work item to finish, so the work item can continue running and
re-submitting itself even after cache_postsuspend. In order to make sure
that the work item won't be running, we must use cancel_delayed_work_sync.

Also, change flush_workqueue to drain_workqueue, so that if some work item
submits itself or another work item, we are properly waiting for both of
them.

Fixes: c6b4fcbad0 ("dm: add cache target")
Cc: stable@vger.kernel.org # v3.9
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:23 +01:00
Mikulas Patocka
a7ab1264e8 dm integrity: fix invalid table returned due to argument count mismatch
commit 7fc2e47f40dd77ab1fcbda6db89614a0173d89c7 upstream.

If the flag SB_FLAG_RECALCULATE is present in the superblock, but it was
not specified on the command line (i.e. ic->recalculate_flag is false),
dm-integrity would return invalid table line - the reported number of
arguments would not match the real number.

Fixes: 468dfca38b ("dm integrity: add a bitmap mode")
Cc: stable@vger.kernel.org # v5.2+
Reported-by: Ondrej Kozina <okozina@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:23 +01:00
Mikulas Patocka
f9d3591532 dm integrity: fix a deadlock due to offloading to an incorrect workqueue
commit 53770f0ec5fd417429775ba006bc4abe14002335 upstream.

If we need to perform synchronous I/O in dm_integrity_map_continue(),
we must make sure that we are not in the map function - in order to
avoid the deadlock due to bio queuing in generic_make_request. To
avoid the deadlock, we offload the request to metadata_wq.

However, metadata_wq also processes metadata updates for write requests.
If there are too many requests that get offloaded to metadata_wq at the
beginning of dm_integrity_map_continue, the workqueue metadata_wq
becomes clogged and the system is incapable of processing any metadata
updates.

This causes a deadlock because all the requests that need to do metadata
updates wait for metadata_wq to proceed and metadata_wq waits inside
wait_and_add_new_range until some existing request releases its range
lock (which doesn't happen because the range lock is released after
metadata update).

In order to fix the deadlock, we create a new workqueue offload_wq and
offload requests to it - so that processing of offload_wq is independent
from processing of metadata_wq.

Fixes: 7eada909bf ("dm: add integrity target")
Cc: stable@vger.kernel.org # v4.12+
Reported-by: Heinz Mauelshagen <heinzm@redhat.com>
Tested-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:23 +01:00
Mikulas Patocka
5b3f03f6e2 dm integrity: fix recalculation when moving from journal mode to bitmap mode
commit d5bdf66108419cdb39da361b58ded661c29ff66e upstream.

If we resume a device in bitmap mode and the on-disk format is in journal
mode, we must recalculate anything above ic->sb->recalc_sector. Otherwise,
there would be non-recalculated blocks which would cause I/O errors.

Fixes: 468dfca38b ("dm integrity: add a bitmap mode")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12 13:00:23 +01:00
Theodore Ts'o
9d729f5aa0 dm thin metadata: fix lockdep complaint
[ Upstream commit 3918e0667bbac99400b44fa5aef3f8be2eeada4a ]

[ 3934.173244] ======================================================
[ 3934.179572] WARNING: possible circular locking dependency detected
[ 3934.185884] 5.4.21-xfstests #1 Not tainted
[ 3934.190151] ------------------------------------------------------
[ 3934.196673] dmsetup/8897 is trying to acquire lock:
[ 3934.201688] ffffffffbce82b18 (shrinker_rwsem){++++}, at: unregister_shrinker+0x22/0x80
[ 3934.210268]
               but task is already holding lock:
[ 3934.216489] ffff92a10cc5e1d0 (&pmd->root_lock){++++}, at: dm_pool_metadata_close+0xba/0x120
[ 3934.225083]
               which lock already depends on the new lock.

[ 3934.564165] Chain exists of:
                 shrinker_rwsem --> &journal->j_checkpoint_mutex --> &pmd->root_lock

For a more detailed lockdep report, please see:

	https://lore.kernel.org/r/20200220234519.GA620489@mit.edu

We shouldn't need to hold the lock while are just tearing down and
freeing the whole metadata pool structure.

Fixes: 44d8ebf436399a4 ("dm thin metadata: use pool locking at end of dm_pool_metadata_close")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-12 13:00:09 +01:00
Barani Muthukumaran
0dccdc03e0 ANDROID: dm: Add wrapped key support in dm-default-key
To prevent keys from being compromised if an attacker acquires read
access to kernel memory, some inline encryption hardware supports
protecting the keys in hardware without software having access to or the
ability to set the plaintext keys.  Instead, software only sees "wrapped
keys", which may differ on every boot.  The keys can be initially
generated either by software (in which case they need to be imported to
hardware to be wrapped), or directly by the hardware.

Add support for this type of hardware by allowing keys to be flagged as
hardware-wrapped. When used, dm-default-key will pass the wrapped key
to the inline encryption hardware to encryption metadata. The hardware
will internally unwrap the key and derive the metadata encryption key.

Bug: 147209885

Test: Validate metadata encryption & FBE with wrapped keys.

Change-Id: I8078b116dab9e04d7f3f15f29f11823185ea5d50
Signed-off-by: Barani Muthukumaran <bmuthuku@codeaurora.org>
2020-02-25 19:28:24 +00:00
Barani Muthukumaran
a1423568e2 ANDROID: dm: add support for passing through derive_raw_secret
Update the device-mapper core to support exposing the inline crypto
support of wrapped keys through the device-mapper device.

derive_raw_secret in keyslot manager is used to derive the software
raw secret from the given wrapped keyblob using the underlying blk
device. Given that the raw_secret is the same for a given wrapped
keyblob the call exits when the first underlying blk-device suceeds.

Bug: 147209885

Test: Validated FBE with wrappedkey_v0 when /data is mounted on a
      dm device.

Change-Id: Ia49ed61613607f8b82f2be0615e5b6d2f7533859
Signed-off-by: Barani Muthukumaran <bmuthuku@codeaurora.org>
2020-02-25 19:28:10 +00:00
Barani Muthukumaran
3ab1972984 ANDROID: block: Prevent crypto fallback for wrapped keys
blk-crypto-fallback does not support wrapped keys, hence
prevent falling back when program_key fails. Add 'is_hw_wrapped'
flag to blk-crypto-key to mention if the key is wrapped
when the key is initialized.

Bug: 147209885

Test: Validate FBE, simulate a failure in the underlying blk
      device and ensure the call fails without falling back
      to blk-crypto-fallback.

Change-Id: I8bc301ca1ac9e55ba6ab622e8325486916b45c56
Signed-off-by: Barani Muthukumaran <bmuthuku@codeaurora.org>
2020-02-25 19:27:51 +00:00
Greg Kroah-Hartman
835bd1de9c This is the 5.4.22 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5TfSAACgkQONu9yGCS
 aT4I8w//SU+w9Tj8Crpt1BI7Lk2AiTGvyZtX0wGd53vzFKGy+Wi1Oba1ybB+xyYw
 UgMJJpoOgp9gTatRgjDl0vO/7U7vZckigPpog3pSW+xq2JW0kTWGS2z04hUjWKkG
 W4l3sAGwHRv7MTBbpjECDSHv+6x6ZqlWcVodpkHqLNmGxR0mYuiB6Zu8QuCu1bl0
 K0SAlt+yd0laUt2bU3wpEqBwGXHepz+IqsqcYp78sAeytT8ds9ZfPxKv98CvLlXs
 VLVr87UqZy3Hkl6IWKGrmdhWbTZE+3AyjKnxlA8PovA0ET5xO/IFPLHVhVX+or+5
 UFp/1qvacr+EIu8CKvftc2n1CflaRXIn/QNpwdemh94mi/2TqiXiqAUu1EiW56vg
 /PUH8G72Q26AiWSmD3WRr09ohTu4hfz6fIDKV60qmdVe4AUffLw0SnBEE0VFA3/S
 lVKZeXKkePeMlHcTyRDQ6+/y49yjfq2exdrjetypOwRa1emHxj/YsfdnEWYfwT53
 sikMLjP4XA7v5rsDr9LJTwQL/V/7euu1Hr3lSGpRv8vmePprvfmivTLcY5tgvOTC
 GZ51Em+CxJ+W4vCJKHuM7i0nUvf2Knn5lBidq4KsvLRUuZ31mSXSfSn4bW6Gl/Jm
 RZPDC71MqT/FMtfuQLlVNqIw2umC1buNa5SwZ8GhJG6za4gU4FU=
 =L+e0
 -----END PGP SIGNATURE-----

Merge 5.4.22 into android-5.4

Changes in 5.4.22
	core: Don't skip generic XDP program execution for cloned SKBs
	enic: prevent waking up stopped tx queues over watchdog reset
	net/smc: fix leak of kernel memory to user space
	net: dsa: tag_qca: Make sure there is headroom for tag
	net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
	net/sched: flower: add missing validation of TCA_FLOWER_FLAGS
	drm/gma500: Fixup fbdev stolen size usage evaluation
	ath10k: Fix qmi init error handling
	wil6210: fix break that is never reached because of zero'ing of a retry counter
	drm/qxl: Complete exception handling in qxl_device_init()
	rcu/nocb: Fix dump_tree hierarchy print always active
	rcu: Fix missed wakeup of exp_wq waiters
	rcu: Fix data-race due to atomic_t copy-by-value
	f2fs: preallocate DIO blocks when forcing buffered_io
	f2fs: call f2fs_balance_fs outside of locked page
	media: meson: add missing allocation failure check on new_buf
	clk: meson: pll: Fix by 0 division in __pll_params_to_rate()
	cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
	brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
	brcmfmac: Fix use after free in brcmf_sdio_readframes()
	PCI: Fix pci_add_dma_alias() bitmask size
	drm/amd/display: Map ODM memory correctly when doing ODM combine
	leds: pca963x: Fix open-drain initialization
	ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
	ALSA: ctl: allow TLV read operation for callback type of element in locked case
	gianfar: Fix TX timestamping with a stacked DSA driver
	pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
	printk: fix exclusive_console replaying
	drm/mipi_dbi: Fix off-by-one bugs in mipi_dbi_blank()
	drm/msm/adreno: fix zap vs no-zap handling
	pxa168fb: Fix the function used to release some memory in an error handling path
	media: ov5640: Fix check for PLL1 exceeding max allowed rate
	media: i2c: mt9v032: fix enum mbus codes and frame sizes
	media: sun4i-csi: Deal with DRAM offset
	media: sun4i-csi: Fix data sampling polarity handling
	media: sun4i-csi: Fix [HV]sync polarity handling
	clk: at91: sam9x60: fix programmable clock prescaler
	powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid PE number
	clk: meson: meson8b: make the CCF use the glitch-free mali mux
	gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
	iommu/vt-d: Fix off-by-one in PASID allocation
	x86/fpu: Deactivate FPU state after failure during state load
	char/random: silence a lockdep splat with printk()
	media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run()
	kernel/module: Fix memleak in module_add_modinfo_attrs()
	IB/core: Let IB core distribute cache update events
	pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
	efi/x86: Map the entire EFI vendor string before copying it
	MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
	sparc: Add .exit.data section.
	net: ethernet: ixp4xx: Standard module init
	raid6/test: fix a compilation error
	uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
	drm/amdgpu/sriov: workaround on rev_id for Navi12 under sriov
	spi: fsl-lpspi: fix only one cs-gpio working
	drm/nouveau/nouveau: fix incorrect sizeof on args.src an args.dst
	usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
	usb: dwc2: Fix IN FIFO allocation
	clocksource/drivers/bcm2835_timer: Fix memory leak of timer
	drm/amd/display: Clear state after exiting fixed active VRR state
	kselftest: Minimise dependency of get_size on C library interfaces
	jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
	ext4: fix deadlock allocating bio_post_read_ctx from mempool
	clk: ti: dra7: fix parent for gmac_clkctrl
	x86/sysfb: Fix check for bad VRAM size
	pwm: omap-dmtimer: Simplify error handling
	udf: Allow writing to 'Rewritable' partitions
	dmaengine: fsl-qdma: fix duplicated argument to &&
	wan/hdlc_x25: fix skb handling
	s390/pci: Fix possible deadlock in recover_store()
	powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
	tracing: Fix tracing_stat return values in error handling paths
	tracing: Fix very unlikely race of registering two stat tracers
	ARM: 8952/1: Disable kmemleak on XIP kernels
	ext4, jbd2: ensure panic when aborting with zero errno
	ath10k: Correct the DMA direction for management tx buffers
	rtw88: fix rate mask for 1SS chip
	brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
	selftests: settings: tests can be in subsubdirs
	rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed
	drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
	tracing: Simplify assignment parsing for hist triggers
	nbd: add a flush_workqueue in nbd_start_device
	KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
	Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker
	drivers/block/zram/zram_drv.c: fix error return codes not being returned in writeback_store
	block, bfq: do not plug I/O for bfq_queues with no proc refs
	kconfig: fix broken dependency in randconfig-generated .config
	clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq()
	clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
	drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode
	bpf, sockhash: Synchronize_rcu before free'ing map
	drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table
	ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start
	drm/amdgpu: Ensure ret is always initialized when using SOC15_WAIT_ON_RREG
	drm/panel: simple: Add Logic PD Type 28 display support
	arm64: dts: rockchip: Fix NanoPC-T4 cooling maps
	modules: lockdep: Suppress suspicious RCU usage warning
	ASoC: intel: sof_rt5682: Add quirk for number of HDMI DAI's
	ASoC: intel: sof_rt5682: Add support for tgl-max98357a-rt5682
	regulator: rk808: Lower log level on optional GPIOs being not available
	net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
	NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
	arm64: dts: allwinner: H6: Add PMU mode
	arm64: dts: allwinner: H5: Add PMU node
	arm: dts: allwinner: H3: Add PMU node
	opp: Free static OPPs on errors while adding them
	selinux: ensure we cleanup the internal AVC counters on error in avc_insert()
	arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
	padata: validate cpumask without removed CPU during offline
	clk: imx: Add correct failure handling for clk based helpers
	ARM: exynos_defconfig: Bring back explicitly wanted options
	ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
	ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
	bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
	PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
	media: cx23885: Add support for AVerMedia CE310B
	PCI: Add generic quirk for increasing D3hot delay
	PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
	Revert "nfp: abm: fix memory leak in nfp_abm_u32_knode_replace"
	gpu/drm: ingenic: Avoid null pointer deference in plane atomic update
	selftests/net: make so_txtime more robust to timer variance
	media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros
	reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
	samples/bpf: Set -fno-stack-protector when building BPF programs
	r8169: check that Realtek PHY driver module is loaded
	fore200e: Fix incorrect checks of NULL pointer dereference
	netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
	ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
	PCI: Add nr_devfns parameter to pci_add_dma_alias()
	PCI: Add DMA alias quirk for PLX PEX NTB
	b43legacy: Fix -Wcast-function-type
	ipw2x00: Fix -Wcast-function-type
	iwlegacy: Fix -Wcast-function-type
	rtlwifi: rtl_pci: Fix -Wcast-function-type
	orinoco: avoid assertion in case of NULL pointer
	drm/amdgpu: fix KIQ ring test fail in TDR of SRIOV
	clk: qcom: smd: Add missing bimc clock
	ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
	nfsd: Clone should commit src file metadata too
	scsi: ufs: Complete pending requests in host reset and restore path
	scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
	crypto: inside-secure - add unspecified HAS_IOMEM dependency
	drm/mediatek: handle events when enabling/disabling crtc
	clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks
	ARM: dts: r8a7779: Add device node for ARM global timer
	selinux: ensure we cleanup the internal AVC counters on error in avc_update()
	scsi: lpfc: Fix: Rework setting of fdmi symbolic node name registration
	arm64: dts: qcom: db845c: Enable ath10k 8bit host-cap quirk
	iommu/amd: Check feature support bit before accessing MSI capability registers
	iommu/amd: Only support x2APIC with IVHD type 11h/40h
	iommu/iova: Silence warnings under memory pressure
	clk: actually call the clock init before any other callback of the clock
	dmaengine: Store module owner in dma_device struct
	dmaengine: imx-sdma: Fix memory leak
	bpf: Print error message for bpftool cgroup show
	net: phy: realtek: add logging for the RGMII TX delay configuration
	crypto: chtls - Fixed memory leak
	x86/vdso: Provide missing include file
	PM / devfreq: exynos-ppmu: Fix excessive stack usage
	PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
	drm/fbdev: Fallback to non tiled mode if all tiles not present
	pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
	reset: uniphier: Add SCSSI reset control for each channel
	ASoC: soc-topology: fix endianness issues
	fbdev: fix numbering of fbcon options
	RDMA/rxe: Fix error type of mmap_offset
	clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
	ALSA: sh: Fix unused variable warnings
	clk: Use parent node pointer during registration if necessary
	clk: uniphier: Add SCSSI clock gate for each channel
	ALSA: hda/realtek - Apply mic mute LED quirk for Dell E7xx laptops, too
	ALSA: sh: Fix compile warning wrt const
	net: phy: fixed_phy: fix use-after-free when checking link GPIO
	tools lib api fs: Fix gcc9 stringop-truncation compilation error
	vfio/spapr/nvlink2: Skip unpinning pages on error exit
	ASoC: Intel: sof_rt5682: Ignore the speaker amp when there isn't one.
	ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch
	iommu/vt-d: Match CPU and IOMMU paging mode
	iommu/vt-d: Avoid sending invalid page response
	drm/amdkfd: Fix permissions of hang_hws
	mlx5: work around high stack usage with gcc
	RDMA/hns: Avoid printing address of mtt page
	drm: remove the newline for CRC source name.
	usb: dwc3: use proper initializers for property entries
	ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
	usbip: Fix unsafe unaligned pointer usage
	udf: Fix free space reporting for metadata and virtual partitions
	drm/mediatek: Add gamma property according to hardware capability
	staging: rtl8188: avoid excessive stack usage
	IB/hfi1: Add software counter for ctxt0 seq drop
	IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats
	soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
	efi/x86: Don't panic or BUG() on non-critical error conditions
	rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
	Input: edt-ft5x06 - work around first register access error
	bnxt: Detach page from page pool before sending up the stack
	x86/nmi: Remove irq_work from the long duration NMI handler
	wan: ixp4xx_hss: fix compile-testing on 64-bit
	clocksource: davinci: only enable clockevents once tim34 is initialized
	arm64: dts: rockchip: fix dwmmc clock name for px30
	arm64: dts: rockchip: add reg property to brcmf sub-nodes
	ARM: dts: rockchip: add reg property to brcmf sub node for rk3188-bqedison2qc
	ALSA: usb-audio: Add boot quirk for MOTU M Series
	ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
	raid6/test: fix a compilation warning
	tty: synclinkmp: Adjust indentation in several functions
	tty: synclink_gt: Adjust indentation in several functions
	misc: xilinx_sdfec: fix xsdfec_poll()'s return type
	visorbus: fix uninitialized variable access
	driver core: platform: Prevent resouce overflow from causing infinite loops
	driver core: Print device when resources present in really_probe()
	ASoC: SOF: Intel: hda-dai: fix compilation warning in pcm_prepare
	bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
	vme: bridges: reduce stack usage
	drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
	drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fw
	drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
	drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
	drm/nouveau/fault/gv100-: fix memory leak on module unload
	dm thin: don't allow changing data device during thin-pool reload
	gpiolib: Set lockdep class for hierarchical irq domains
	drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
	perf/imx_ddr: Fix cpu hotplug state cleanup
	usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
	kbuild: remove *.tmp file when filechk fails
	iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
	ALSA: usb-audio: unlock on error in probe
	f2fs: set I_LINKABLE early to avoid wrong access by vfs
	f2fs: free sysfs kobject
	scsi: ufs: pass device information to apply_dev_quirks
	scsi: ufs-mediatek: add apply_dev_quirks variant operation
	scsi: iscsi: Don't destroy session if there are outstanding connections
	crypto: essiv - fix AEAD capitalization and preposition use in help text
	ALSA: usb-audio: add implicit fb quirk for MOTU M Series
	RDMA/mlx5: Don't fake udata for kernel path
	arm64: lse: fix LSE atomics with LLVM's integrated assembler
	arm64: fix alternatives with LLVM's integrated assembler
	drm/amd/display: fixup DML dependencies
	EDAC/sifive: Fix return value check in ecc_register()
	KVM: PPC: Remove set but not used variable 'ra', 'rs', 'rt'
	arm64: dts: ti: k3-j721e-main: Add missing power-domains for smmu
	sched/core: Fix size of rq::uclamp initialization
	sched/topology: Assert non-NUMA topology masks don't (partially) overlap
	perf/x86/amd: Constrain Large Increment per Cycle events
	watchdog/softlockup: Enforce that timestamp is valid on boot
	debugobjects: Fix various data races
	ASoC: SOF: Intel: hda: Fix SKL dai count
	regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage
	f2fs: fix memleak of kobject
	x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
	pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional
	cmd64x: potential buffer overflow in cmd64x_program_timings()
	ide: serverworks: potential overflow in svwks_set_pio_mode()
	pwm: Remove set but not set variable 'pwm'
	btrfs: fix possible NULL-pointer dereference in integrity checks
	btrfs: safely advance counter when looking up bio csums
	btrfs: device stats, log when stats are zeroed
	module: avoid setting info->name early in case we can fall back to info->mod->name
	remoteproc: Initialize rproc_class before use
	regulator: core: Fix exported symbols to the exported GPL version
	irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove problems
	ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
	spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations
	kbuild: use -S instead of -E for precise cc-option test in Kconfig
	objtool: Fix ARCH=x86_64 build error
	x86/decoder: Add TEST opcode to Group3-2
	s390: adjust -mpacked-stack support check for clang 10
	s390/ftrace: generate traced function stack frame
	driver core: platform: fix u32 greater or equal to zero comparison
	bpf, btf: Always output invariant hit in pahole DWARF to BTF transform
	ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
	sunrpc: Fix potential leaks in sunrpc_cache_unhash()
	drm/nouveau/mmu: fix comptag memory leak
	powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
	media: uvcvideo: Add a quirk to force GEO GC6500 Camera bits-per-pixel value
	btrfs: separate definition of assertion failure handlers
	btrfs: Fix split-brain handling when changing FSID to metadata uuid
	bcache: cached_dev_free needs to put the sb page
	bcache: rework error unwinding in register_bcache
	bcache: fix use-after-free in register_bcache()
	iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
	alarmtimer: Make alarmtimer platform device child of RTC device
	selftests: bpf: Reset global state between reuseport test runs
	jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
	jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
	powerpc/pseries/lparcfg: Fix display of Maximum Memory
	selftests/eeh: Bump EEH wait time to 60s
	ARM: 8951/1: Fix Kexec compilation issue.
	ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82
	hostap: Adjust indentation in prism2_hostapd_add_sta
	rtw88: fix potential NULL skb access in TX ISR
	iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
	cifs: fix unitialized variable poential problem with network I/O cache lock patch
	cifs: Fix mount options set in automount
	cifs: fix NULL dereference in match_prepath
	bpf: map_seq_next should always increase position index
	powerpc/mm: Don't log user reads to 0xffffffff
	ceph: check availability of mds cluster on mount after wait timeout
	rbd: work around -Wuninitialized warning
	drm/amd/display: do not allocate display_mode_lib unnecessarily
	irqchip/gic-v3: Only provision redistributors that are enabled in ACPI
	drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
	char: hpet: Fix out-of-bounds read bug
	ftrace: fpid_next() should increase position index
	trigger_next should increase position index
	radeon: insert 10ms sleep in dce5_crtc_load_lut
	powerpc: Do not consider weak unresolved symbol relocations as bad
	btrfs: do not do delalloc reservation under page lock
	ocfs2: make local header paths relative to C files
	ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
	lib/scatterlist.c: adjust indentation in __sg_alloc_table
	reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
	bcache: fix memory corruption in bch_cache_accounting_clear()
	bcache: explicity type cast in bset_bkey_last()
	bcache: fix incorrect data type usage in btree_flush_write()
	irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
	nvmet: Pass lockdep expression to RCU lists
	nvme-pci: remove nvmeq->tags
	iwlwifi: mvm: Fix thermal zone registration
	iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta()
	asm-generic/tlb: add missing CONFIG symbol
	microblaze: Prevent the overflow of the start
	brd: check and limit max_part par
	drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
	drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
	NFS: Fix memory leaks
	help_next should increase position index
	i40e: Relax i40e_xsk_wakeup's return value when PF is busy
	cifs: log warning message (once) if out of disk space
	virtio_balloon: prevent pfn array overflow
	fuse: don't overflow LLONG_MAX with end offset
	mlxsw: spectrum_dpipe: Add missing error path
	s390/pci: Recover handle in clp_set_pci_fn()
	drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2)
	bcache: properly initialize 'path' and 'err' in register_bcache()
	rtc: Kconfig: select REGMAP_I2C when necessary
	Linux 5.4.22

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iaeb3945493ecc81a0ae90ef87b19ceb2caf48164
2020-02-24 09:16:10 +01:00
Coly Li
cea9007ebb bcache: properly initialize 'path' and 'err' in register_bcache()
[ Upstream commit 29cda393bcaad160c4bf3676ddd99855adafc72f ]

Patch "bcache: rework error unwinding in register_bcache" from
Christoph Hellwig changes the local variables 'path' and 'err'
in undefined initial state. If the code in register_bcache() jumps
to label 'out:' or 'out_module_put:' by goto, these two variables
might be reference with undefined value by the following line,

	out_module_put:
	        module_put(THIS_MODULE);
	out:
	        pr_info("error %s: %s", path, err);
	        return ret;

Therefore this patch initializes these two local variables properly
in register_bcache() to avoid such issue.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:37:03 +01:00
Coly Li
793137b051 bcache: fix incorrect data type usage in btree_flush_write()
[ Upstream commit d1c3cc34f5a78b38d2b809b289d912c3560545df ]

Dan Carpenter points out that from commit 2aa8c529387c ("bcache: avoid
unnecessary btree nodes flushing in btree_flush_write()"), there is a
incorrect data type usage which leads to the following static checker
warning:
	drivers/md/bcache/journal.c:444 btree_flush_write()
	warn: 'ref_nr' unsigned <= 0

drivers/md/bcache/journal.c
   422  static void btree_flush_write(struct cache_set *c)
   423  {
   424          struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
   425          unsigned int i, nr, ref_nr;
                                    ^^^^^^

   426          atomic_t *fifo_front_p, *now_fifo_front_p;
   427          size_t mask;
   428
   429          if (c->journal.btree_flushing)
   430                  return;
   431
   432          spin_lock(&c->journal.flush_write_lock);
   433          if (c->journal.btree_flushing) {
   434                  spin_unlock(&c->journal.flush_write_lock);
   435                  return;
   436          }
   437          c->journal.btree_flushing = true;
   438          spin_unlock(&c->journal.flush_write_lock);
   439
   440          /* get the oldest journal entry and check its refcount */
   441          spin_lock(&c->journal.lock);
   442          fifo_front_p = &fifo_front(&c->journal.pin);
   443          ref_nr = atomic_read(fifo_front_p);
   444          if (ref_nr <= 0) {
                    ^^^^^^^^^^^
Unsigned can't be less than zero.

   445                  /*
   446                   * do nothing if no btree node references
   447                   * the oldest journal entry
   448                   */
   449                  spin_unlock(&c->journal.lock);
   450                  goto out;
   451          }
   452          spin_unlock(&c->journal.lock);

As the warning information indicates, local varaible ref_nr in unsigned
int type is wrong, which does not matche atomic_read() and the "<= 0"
checking.

This patch fixes the above error by defining local variable ref_nr as
int type.

Fixes: 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:37:01 +01:00
Coly Li
57a180a630 bcache: explicity type cast in bset_bkey_last()
[ Upstream commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 ]

In bset.h, macro bset_bkey_last() is defined as,
    bkey_idx((struct bkey *) (i)->d, (i)->keys)

Parameter i can be variable type of data structure, the macro always
works once the type of struct i has member 'd' and 'keys'.

bset_bkey_last() is also used in macro csum_set() to calculate the
checksum of a on-disk data structure. When csum_set() is used to
calculate checksum of on-disk bcache super block, the parameter 'i'
data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in
struct cache_sb) the member keys is __u16 type. But bkey_idx() expects
unsigned int (a 32bit width), so there is problem when sending
parameters via stack to call bkey_idx().

Sparse tool from Intel 0day kbuild system reports this incompatible
problem. bkey_idx() is part of user space API, so the simplest fix is
to cast the (i)->keys to unsigned int type in macro bset_bkey_last().

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:37:01 +01:00
Coly Li
374eec8218 bcache: fix memory corruption in bch_cache_accounting_clear()
[ Upstream commit 5bebf7486d4f4940b2a8e4009beb1dff5041853d ]

Commit 83ff9318c4 ("bcache: not use hard coded memset size in
bch_cache_accounting_clear()") tries to make the code more easy to
understand by removing the hard coded number with following change,
	void bch_cache_accounting_clear(...)
	{
		memset(&acc->total.cache_hits,
			0,
	-		sizeof(unsigned long) * 7);
	+		sizeof(struct cache_stats));
	}

Unfortunately the change was wrong (it also tells us the original code
was not easy to correctly understand). The hard coded number 7 is used
because in struct cache_stats,
 15 struct cache_stats {
 16         struct kobject          kobj;
 17
 18         unsigned long cache_hits;
 19         unsigned long cache_misses;
 20         unsigned long cache_bypass_hits;
 21         unsigned long cache_bypass_misses;
 22         unsigned long cache_readaheads;
 23         unsigned long cache_miss_collisions;
 24         unsigned long sectors_bypassed;
 25
 26         unsigned int            rescale;
 27 };
only members in LINE 18-24 want to be set to 0. It is wrong to use
'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the
memory objects behind acc->total is staled by this change.

Сорокин Артем Сергеевич reports that by the following steps, kernel
panic will be triggered,
1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache
2. Run in /sys/fs/bcache/<uuid>:
   echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits

I can reproduce the panic and get following dmesg with KASAN enabled,
[22613.172742] ==================================================================
[22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230
[22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753

[22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11
[22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
[22613.172873] Call Trace:
[22613.172964]  dump_stack+0x8b/0xbb
[22613.172968]  ? sysfs_kf_seq_show+0x117/0x230
[22613.172970]  ? sysfs_kf_seq_show+0x117/0x230
[22613.173031]  __kasan_report+0x176/0x192
[22613.173064]  ? pr_cont_kernfs_name+0x40/0x60
[22613.173067]  ? sysfs_kf_seq_show+0x117/0x230
[22613.173070]  kasan_report+0xe/0x20
[22613.173072]  sysfs_kf_seq_show+0x117/0x230
[22613.173105]  seq_read+0x199/0x6d0
[22613.173110]  vfs_read+0xa5/0x1a0
[22613.173113]  ksys_read+0x110/0x160
[22613.173115]  ? kernel_write+0xb0/0xb0
[22613.173177]  do_syscall_64+0x77/0x290
[22613.173238]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[22613.173241] RIP: 0033:0x7fc2c886ac61
[22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
[22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
[22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
[22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
[22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
[22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
[22613.173255] ==================================================================
[22613.173256] Disabling lock debugging due to kernel taint
[22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000
[22613.178380] #PF: supervisor read access in kernel mode
[22613.180959] #PF: error_code(0x0000) - not-present page
[22613.183444] PGD 0 P4D 0
[22613.184867] Oops: 0000 [#1] SMP KASAN PTI
[22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G    B             5.5.0-rc7-lp151.28.16-default+ #11
[22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
[22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
[22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
[22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
[22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
[22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
[22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
[22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
[22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
[22613.226290] FS:  00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
[22613.229637] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0
[22613.234909] Call Trace:
[22613.235931]  seq_read+0x199/0x6d0
[22613.237259]  vfs_read+0xa5/0x1a0
[22613.239229]  ksys_read+0x110/0x160
[22613.240590]  ? kernel_write+0xb0/0xb0
[22613.242040]  do_syscall_64+0x77/0x290
[22613.243625]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[22613.245450] RIP: 0033:0x7fc2c886ac61
[22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
[22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
[22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
[22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
[22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
[22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
[22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua
[22613.292429] CR2: 0000000000000000
[22613.293563] ---[ end trace a074b26a8508f378 ]---
[22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
[22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
[22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
[22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
[22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
[22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
[22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
[22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
[22613.318116] FS:  00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
[22613.320743] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0

Here this patch fixes the following problem by explicity set all the 7
members to 0 in bch_cache_accounting_clear().

Reported-by: Сорокин Артем Сергеевич <a.sorokin@bank-hlynov.ru>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:37:01 +01:00
Coly Li
b5f6bf0fdd bcache: fix use-after-free in register_bcache()
[ Upstream commit ae3cd299919af6eb670d5af0bc9d7ba14086bd8e ]

The patch "bcache: rework error unwinding in register_bcache" introduces
a use-after-free regression in register_bcache(). Here are current code,
	2510 out_free_path:
	2511         kfree(path);
	2512 out_module_put:
	2513         module_put(THIS_MODULE);
	2514 out:
	2515         pr_info("error %s: %s", path, err);
	2516         return ret;
If some error happens and the above code path is executed, at line 2511
path is released, but referenced at line 2515. Then KASAN reports a use-
after-free error message.

This patch changes line 2515 in the following way to fix the problem,
	2515         pr_info("error %s: %s", path?path:"", err);

Signed-off-by: Coly Li <colyli@suse.de>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:36:57 +01:00
Christoph Hellwig
393b8509be bcache: rework error unwinding in register_bcache
[ Upstream commit 50246693f81fe887f4db78bf7089051d7f1894cc ]

Split the successful and error return path, and use one goto label for each
resource to unwind.  This also fixes some small errors like leaking the
module reference count in the reboot case (which seems entirely harmless)
or printing the wrong warning messages for early failures.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:36:56 +01:00
Liang Chen
f7d8ebf26d bcache: cached_dev_free needs to put the sb page
[ Upstream commit e8547d42095e58bee658f00fef8e33d2a185c927 ]

Same as cache device, the buffer page needs to be put while
freeing cached_dev.  Otherwise a page would be leaked every
time a cached_dev is stopped.

Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:36:56 +01:00
Mikulas Patocka
7f0d9ac262 dm thin: don't allow changing data device during thin-pool reload
[ Upstream commit 873937e75f9a8ea231a502c3d29d9cb6ad91b3ef ]

The existing code allows changing the data device when the thin-pool
target is reloaded.

This capability is not required and only complicates device lifetime
guarantees. This can cause crashes like the one reported here:
	https://bugzilla.redhat.com/show_bug.cgi?id=1788596
where the kernel tries to issue a flush bio located in a structure that
was already freed.

Take the first step to simplifying the thin-pool's data device lifetime
by disallowing changing it. Like the thin-pool's metadata device, the
data device is now set in pool_create() and it cannot be changed for a
given thin-pool.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-24 08:36:49 +01:00
Eric Biggers
e124323186 ANDROID: ufs, block: fix crypto power management and move into block layer
The call to pm_runtime_get_sync() in ufshcd_program_key() can deadlock
because it waits for the UFS controller to be resumed, but it can itself
be reached while resuming the UFS controller via:

- ufshcd_runtime_resume()
  - ufshcd_resume()
    - ufshcd_reset_and_restore()
      - ufshcd_host_reset_and_restore()
        - ufshcd_hba_enable()
          - ufshcd_hba_execute_hce()
            - ufshcd_hba_start()
              - ufshcd_crypto_enable()
                - keyslot_manager_reprogram_all_keys()
                  - ufshcd_crypto_keyslot_program()
                    - ufshcd_program_key()

But pm_runtime_get_sync() *is* needed when evicting a key.  Also, on
pre-4.20 kernels it's needed when programming a keyslot for a bio since
the block layer used to resume the device in a different place.

Thus, it's hard for drivers to know what to do in .keyslot_program() and
.keyslot_evict().  In old kernels it may even be impossible unless we
were to pass more information down from the keyslot_manager.

There's also another possible deadlock: keyslot programming and eviction
take ksm->lock for write and then resume the device, which may result in
ksm->lock being taken again via the above call stack.  To fix this, we
should resume the device before taking ksm->lock.

Fix these problems by moving to a better design where the block layer
(namely, the keyslot manager) handles runtime power management instead
of drivers.  This is analogous to the block layer's existing runtime
power management support (blk-pm), which handles resuming devices when
bios are submitted to them so that drivers don't need to handle it.

Test: Tested on coral with:
        echo 5 > /sys/bus/platform/devices/1d84000.ufshc/rpm_lvl
        sleep 30
        touch /data && sync  # hangs before this fix
  Also verified via kvm-xfstests that blk-crypto-fallback continues
  to work both with and without CONFIG_PM=y.

Bug: 137270441
Bug: 149368295
Change-Id: I6bc9fb81854afe7edf490d71796ee68a61f7cbc8
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-02-21 16:00:25 +00:00
Greg Kroah-Hartman
e736cc6873 This is the 5.4.20 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5HElwACgkQONu9yGCS
 aT6GQBAAxBLl+L518k3/Jm7Fv5VGFtfk7QIJmLKSdI58Gj7aLib2CulB5dJpHu0Z
 uOJXEUKQoUC739MjS6IgrAUoee/GTgyeOS1gyI49IBVvrBgjQop/3FJ4Oe4EF6Wj
 aEy7xA1k1MRUM4XWy3PiMvIuaxWNWoEn22DS703adOKPEx2yS0sPtAf6RRRpzxW+
 oWR9aJv5y+wKRi7frRvTJ8juQoeo67XHNQWBybv7v+th7KqF33EYk/faLJqTbqNd
 caJAG+DuGsu/oLcwlWEE5CZ8rP5OAOh12505J9XG5uXoqA2BrQFCTLW6okG1PUNI
 I+GugtMKWwOSP8dHkfq/jPKInG3H+mCwVW3wWzKfWBJwIi4NWokYK31SQty1BNBe
 if9ytUT97ykgkovVjVbu+X+wMnEes2JMrVyBAzY2cOK01KD2PUR/cLdZZXTil4A0
 rEKXd+tJRN7+ko+z4EJRdstzNtB030tDeEUmwJSIlJoWPRROk69it8d4/OFXe+/u
 Le4T4V6w22tcP0H/2CtDSwTntDbjNoXWpTGzqp2HO0urObqZyX99leyCI8Ee9sRz
 00B6ykAOnOMPdLmAGmpBXnhKRK89VlnfG5A/d609km4EPJuKZyX9KS6tZSwpJIAd
 3W9FWaNyr8Z79BDJyeK0ftS5BD/WNGDLux7lylLzMsPAmF7YNsI=
 =Zp/p
 -----END PGP SIGNATURE-----

Merge 5.4.20 into android-5.4

Changes in 5.4.20
	ASoC: pcm: update FE/BE trigger order based on the command
	hv_sock: Remove the accept port restriction
	IB/mlx4: Fix memory leak in add_gid error flow
	IB/srp: Never use immediate data if it is disabled by a user
	IB/mlx4: Fix leak in id_map_find_del
	RDMA/netlink: Do not always generate an ACK for some netlink operations
	RDMA/i40iw: fix a potential NULL pointer dereference
	RDMA/core: Fix locking in ib_uverbs_event_read
	RDMA/uverbs: Verify MR access flags
	RDMA/cma: Fix unbalanced cm_id reference count during address resolve
	RDMA/umem: Fix ib_umem_find_best_pgsz()
	scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
	PCI/IOV: Fix memory leak in pci_iov_add_virtfn()
	ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe
	PCI/switchtec: Use dma_set_mask_and_coherent()
	PCI/switchtec: Fix vep_vector_number ioread width
	PCI: tegra: Fix afi_pex2_ctrl reg offset for Tegra30
	PCI: Don't disable bridge BARs when assigning bus resources
	PCI/AER: Initialize aer_fifo
	iwlwifi: mvm: avoid use after free for pmsr request
	bpftool: Don't crash on missing xlated program instructions
	bpf, sockmap: Don't sleep while holding RCU lock on tear-down
	bpf, sockhash: Synchronize_rcu before free'ing map
	selftests/bpf: Test freeing sockmap/sockhash with a socket in it
	bpf: Improve bucket_log calculation logic
	bpf, sockmap: Check update requirements after locking
	nfs: NFS_SWAP should depend on SWAP
	NFS: Revalidate the file size on a fatal write error
	NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes()
	NFS: Fix fix of show_nfs_errors
	NFSv4: pnfs_roc() must use cred_fscmp() to compare creds
	NFSv4: try lease recovery on NFS4ERR_EXPIRED
	NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals
	x86/boot: Handle malformed SRAT tables during early ACPI parsing
	rtc: hym8563: Return -EINVAL if the time is known to be invalid
	rtc: cmos: Stop using shared IRQ
	watchdog: qcom: Use platform_get_irq_optional() for bark irq
	ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
	platform/x86: intel_mid_powerbtn: Take a copy of ddata
	arm64: dts: qcom: msm8998: Fix tcsr syscon size
	arm64: dts: uDPU: fix broken ethernet
	ARM: dts: at91: Reenable UART TX pull-ups
	ARM: dts: am43xx: add support for clkout1 clock
	arm64: dts: renesas: r8a77990: ebisu: Remove clkout-lr-synchronous from sound
	arm64: dts: marvell: clearfog-gt-8k: fix switch cpu port node
	ARM: dts: meson8: use the actual frequency for the GPU's 182.1MHz OPP
	ARM: dts: meson8b: use the actual frequency for the GPU's 364MHz OPP
	ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
	ARM: dts: at91: sama5d3: define clock rate range for tcb1
	tools/power/acpi: fix compilation error
	soc: qcom: rpmhpd: Set 'active_only' for active only power domains
	Revert "powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests"
	powerpc/ptdump: Fix W+X verification call in mark_rodata_ro()
	powerpc/ptdump: Only enable PPC_CHECK_WX with STRICT_KERNEL_RWX
	powerpc/papr_scm: Fix leaking 'bus_desc.provider_name' in some paths
	powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning
	powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
	iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA
	ARM: at91: pm: use SAM9X60 PMC's compatible
	ARM: at91: pm: use of_device_id array to find the proper shdwc node
	KVM: arm/arm64: vgic-its: Fix restoration of unmapped collections
	ARM: 8949/1: mm: mark free_memmap as __init
	sched/uclamp: Fix a bug in propagating uclamp value in new cgroups
	arm64: cpufeature: Fix the type of no FP/SIMD capability
	arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly
	arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations
	KVM: arm/arm64: Fix young bit from mmu notifier
	KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests
	KVM: arm: Make inject_abt32() inject an external abort instead
	KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset
	KVM: arm64: pmu: Fix chained SW_INCR counters
	KVM: arm64: Treat emulated TVAL TimerValue as a signed 32-bit integer
	arm64: nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly
	mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock
	mtd: sharpslpart: Fix unsigned comparison to zero
	crypto: testmgr - don't try to decrypt uninitialized buffers
	crypto: artpec6 - return correct error code for failed setkey()
	crypto: atmel-sha - fix error handling when setting hmac key
	crypto: caam/qi2 - fix typo in algorithm's driver name
	drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe
	media: i2c: adv748x: Fix unsafe macros
	dt-bindings: iio: adc: ad7606: Fix wrong maxItems value
	bcache: avoid unnecessary btree nodes flushing in btree_flush_write()
	selinux: revert "stop passing MAY_NOT_BLOCK to the AVC upon follow_link"
	selinux: fix regression introduced by move_mount(2) syscall
	pinctrl: sh-pfc: r8a77965: Fix DU_DOTCLKIN3 drive/bias control
	pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
	regmap: fix writes to non incrementing registers
	mfd: max77650: Select REGMAP_IRQ in Kconfig
	clk: meson: g12a: fix missing uart2 in regmap table
	dmaengine: axi-dmac: add a check for devm_regmap_init_mmio
	mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
	mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
	libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
	libertas: make lbs_ibss_join_existing() return error code on rates overflow
	selinux: fall back to ref-walk if audit is required
	Linux 5.4.20

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I68c0ac72422e279b38324afc91dc52df3eadc0f7
2020-02-19 08:28:27 +01:00
Coly Li
837c36e045 bcache: avoid unnecessary btree nodes flushing in btree_flush_write()
commit 2aa8c529387c25606fdc1484154b92f8bfbc5746 upstream.

the commit 91be66e131 ("bcache: performance improvement for
btree_flush_write()") was an effort to flushing btree node with oldest
btree node faster in following methods,
- Only iterate dirty btree nodes in c->btree_cache, avoid scanning a lot
  of clean btree nodes.
- Take c->btree_cache as a LRU-like list, aggressively flushing all
  dirty nodes from tail of c->btree_cache util the btree node with
  oldest journal entry is flushed. This is to reduce the time of holding
  c->bucket_lock.

Guoju Fang and Shuang Li reported that they observe unexptected extra
write I/Os on cache device after applying the above patch. Guoju Fang
provideed more detailed diagnose information that the aggressive
btree nodes flushing may cause 10x more btree nodes to flush in his
workload. He points out when system memory is large enough to hold all
btree nodes in memory, c->btree_cache is not a LRU-like list any more.
Then the btree node with oldest journal entry is very probably not-
close to the tail of c->btree_cache list. In such situation much more
dirty btree nodes will be aggressively flushed before the target node
is flushed. When slow SATA SSD is used as cache device, such over-
aggressive flushing behavior will cause performance regression.

After spending a lot of time on debug and diagnose, I find the real
condition is more complicated, aggressive flushing dirty btree nodes
from tail of c->btree_cache list is not a good solution.
- When all btree nodes are cached in memory, c->btree_cache is not
  a LRU-like list, the btree nodes with oldest journal entry won't
  be close to the tail of the list.
- There can be hundreds dirty btree nodes reference the oldest journal
  entry, before flushing all the nodes the oldest journal entry cannot
  be reclaimed.
When the above two conditions mixed together, a simply flushing from
tail of c->btree_cache list is really NOT a good idea.

Fortunately there is still chance to make btree_flush_write() work
better. Here is how this patch avoids unnecessary btree nodes flushing,
- Only acquire c->journal.lock when getting oldest journal entry of
  fifo c->journal.pin. In rested locations check the journal entries
  locklessly, so their values can be changed on other cores
  in parallel.
- In loop list_for_each_entry_safe_reverse(), checking latest front
  point of fifo c->journal.pin. If it is different from the original
  point which we get with locking c->journal.lock, it means the oldest
  journal entry is reclaim on other cores. At this moment, all selected
  dirty nodes recorded in array btree_nodes[] are all flushed and clean
  on other CPU cores, it is unncessary to iterate c->btree_cache any
  longer. Just quit the list_for_each_entry_safe_reverse() loop and
  the following for-loop will skip all the selected clean nodes.
- Find a proper time to quit the list_for_each_entry_safe_reverse()
  loop. Check the refcount value of orignial fifo front point, if the
  value is larger than selected node number of btree_nodes[], it means
  more matching btree nodes should be scanned. Otherwise it means no
  more matching btee nodes in rest of c->btree_cache list, the loop
  can be quit. If the original oldest journal entry is reclaimed and
  fifo front point is updated, the refcount of original fifo front point
  will be 0, then the loop will be quit too.
- Not hold c->bucket_lock too long time. c->bucket_lock is also required
  for space allocation for cached data, hold it for too long time will
  block regular I/O requests. When iterating list c->btree_cache, even
  there are a lot of maching btree nodes, in order to not holding
  c->bucket_lock for too long time, only BTREE_FLUSH_NR nodes are
  selected and to flush in following for-loop.
With this patch, only btree nodes referencing oldest journal entry
are flushed to cache device, no aggressive flushing for  unnecessary
btree node any more. And in order to avoid blocking regluar I/O
requests, each time when btree_flush_write() called, at most only
BTREE_FLUSH_NR btree nodes are selected to flush, even there are more
maching btree nodes in list c->btree_cache.

At last, one more thing to explain: Why it is safe to read front point
of c->journal.pin without holding c->journal.lock inside the
list_for_each_entry_safe_reverse() loop ?

Here is my answer: When reading the front point of fifo c->journal.pin,
we don't need to know the exact value of front point, we just want to
check whether the value is different from the original front point
(which is accurate value because we get it while c->jouranl.lock is
held). For such purpose, it works as expected without holding
c->journal.lock. Even the front point is changed on other CPU core and
not updated to local core, and current iterating btree node has
identical journal entry local as original fetched fifo front point, it
is still safe. Because after holding mutex b->write_lock (with memory
barrier) this btree node can be found as clean and skipped, the loop
will quite latter when iterate on next node of list c->btree_cache.

Fixes: 91be66e131 ("bcache: performance improvement for btree_flush_write()")
Reported-by: Guoju Fang <fangguoju@gmail.com>
Reported-by: Shuang Li <psymon@bonuscloud.io>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-14 16:34:19 -05:00
Greg Kroah-Hartman
87acfa0267 This is the 5.4.19 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5Cn6wACgkQONu9yGCS
 aT789BAAkpzYCCHEL2aqDpnZQdu1kVua2nywEJCY0WqSM1lWLeU1Lk9EvS6uu99B
 nHnIgoAGXR1zQy9rlhpKKt62LvCCM94QWlQRDYYeJxbFPn1ogT2/0vmwN7rqNz4M
 Jdszd6gfNKtB3zpZZLJ0KXG8q6YRp5kXOHEzOXNjcVsfKRuNTWWIBV0dMmkCzduQ
 Y5e62+d1FnnRFj28R7wjJfXiZSRnIGcMHohcQGXsWZsh2rktYOYsL6G37I9lCBwx
 RO7/+qVOT+BImqB5fIxB98JOzOlo6uEVqPgXjMHAAZUzzA4KpOkDBn55m5hA9axf
 EG67Ft4vZJc6Q3FTtHdSZZ/x6TBAJ2DUzatpKhCTDB3vlWJ6a+CsTFq3dXj4+bFr
 hFuyi0u91VeudmWR8IH5Er8QaNaOq8m72XAwK22fZptZz0ZHl+Bf1QZyEY0L0P2Q
 DpT/kmZVgSSDusvMtJOwI8Vr4Ibb8o46kFTQN+PCSs0pbPchEJmInHz0mIypK89N
 4YIjcDZZu3WUS13pEsgNAi2FEpwZdn32LYxZg8xTYBtovzuvT1pJUEppiVSMXgKS
 8vF6oCAd7pX9Fal5fYklA7gyQENnHBFI+LE+bHwMR/qwreH/3wBTLnhRPsGOxyZI
 oj57YDdxZCAwEfXGoWA3Le+60lj6bGuRfmCc4VkodaOxMLb1WrE=
 =rUtE
 -----END PGP SIGNATURE-----

Merge 5.4.19 into android-5.4

Changes in 5.4.19
	sparc32: fix struct ipc64_perm type definition
	bnxt_en: Move devlink_register before registering netdev
	cls_rsvp: fix rsvp_policy
	gtp: use __GFP_NOWARN to avoid memalloc warning
	l2tp: Allow duplicate session creation with UDP
	net: hsr: fix possible NULL deref in hsr_handle_frame()
	net_sched: fix an OOB access in cls_tcindex
	net: stmmac: Delete txtimer in suspend()
	bnxt_en: Fix TC queue mapping.
	rxrpc: Fix use-after-free in rxrpc_put_local()
	rxrpc: Fix insufficient receive notification generation
	rxrpc: Fix missing active use pinning of rxrpc_local object
	rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
	tcp: clear tp->total_retrans in tcp_disconnect()
	tcp: clear tp->delivered in tcp_disconnect()
	tcp: clear tp->data_segs{in|out} in tcp_disconnect()
	tcp: clear tp->segs_{in|out} in tcp_disconnect()
	ionic: fix rxq comp packet type mask
	MAINTAINERS: correct entries for ISDN/mISDN section
	netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()
	bnxt_en: Fix logic that disables Bus Master during firmware reset.
	media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
	mfd: dln2: More sanity checking for endpoints
	netfilter: ipset: fix suspicious RCU usage in find_set_and_id
	ipc/msg.c: consolidate all xxxctl_down() functions
	tracing/kprobes: Have uname use __get_str() in print_fmt
	tracing: Fix sched switch start/stop refcount racy updates
	rcu: Use *_ONCE() to protect lockless ->expmask accesses
	rcu: Avoid data-race in rcu_gp_fqs_check_wake()
	srcu: Apply *_ONCE() to ->srcu_last_gp_end
	rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
	nvmet: Fix error print message at nvmet_install_queue function
	nvmet: Fix controller use after free
	Bluetooth: btusb: fix memory leak on fw
	Bluetooth: btusb: Disable runtime suspend on Realtek devices
	brcmfmac: Fix memory leak in brcmf_usbdev_qinit
	usb: dwc3: gadget: Check END_TRANSFER completion
	usb: dwc3: gadget: Delay starting transfer
	usb: typec: tcpci: mask event interrupts when remove driver
	objtool: Silence build output
	usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
	usb: gadget: legacy: set max_speed to super-speed
	usb: gadget: f_ncm: Use atomic_t to track in-flight request
	usb: gadget: f_ecm: Use atomic_t to track in-flight request
	ALSA: usb-audio: Fix endianess in descriptor validation
	ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
	ALSA: dummy: Fix PCM format loop in proc output
	memcg: fix a crash in wb_workfn when a device disappears
	mm/sparse.c: reset section's mem_map when fully deactivated
	mmc: sdhci-pci: Make function amd_sdhci_reset static
	utimes: Clamp the timestamps in notify_change()
	mm/memory_hotplug: fix remove_memory() lockdep splat
	mm: thp: don't need care deferred split queue in memcg charge move path
	mm: move_pages: report the number of non-attempted pages
	media/v4l2-core: set pages dirty upon releasing DMA buffers
	media: v4l2-core: compat: ignore native command codes
	media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
	lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
	irqdomain: Fix a memory leak in irq_domain_push_irq()
	x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
	platform/x86: intel_scu_ipc: Fix interrupt support
	ALSA: hda: Apply aligned MMIO access only conditionally
	ALSA: hda: Add Clevo W65_67SB the power_save blacklist
	ALSA: hda: Add JasperLake PCI ID and codec vid
	arm64: acpi: fix DAIF manipulation with pNMI
	KVM: arm64: Correct PSTATE on exception entry
	KVM: arm/arm64: Correct CPSR on exception entry
	KVM: arm/arm64: Correct AArch32 SPSR on exception entry
	KVM: arm64: Only sign-extend MMIO up to register width
	MIPS: syscalls: fix indentation of the 'SYSNR' message
	MIPS: fix indentation of the 'RELOCS' message
	MIPS: boot: fix typo in 'vmlinux.lzma.its' target
	s390/mm: fix dynamic pagetable upgrade for hugetlbfs
	powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case
	powerpc/ptdump: Fix W+X verification
	powerpc/xmon: don't access ASDR in VMs
	powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
	powerpc/32s: Fix bad_kuap_fault()
	powerpc/32s: Fix CPU wake-up from sleep mode
	tracing: Fix now invalid var_ref_vals assumption in trace action
	PCI: tegra: Fix return value check of pm_runtime_get_sync()
	PCI: keystone: Fix outbound region mapping
	PCI: keystone: Fix link training retries initiation
	PCI: keystone: Fix error handling when "num-viewport" DT property is not populated
	mmc: spi: Toggle SPI polarity, do not hardcode it
	ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards
	ACPI / battery: Deal with design or full capacity being reported as -1
	ACPI / battery: Use design-cap for capacity calculations if full-cap is not available
	ACPI / battery: Deal better with neither design nor full capacity not being reported
	alarmtimer: Unregister wakeup source when module get fails
	fscrypt: don't print name of busy file when removing key
	ubifs: don't trigger assertion on invalid no-key filename
	ubifs: Fix wrong memory allocation
	ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
	ubifs: Fix deadlock in concurrent bulk-read and writepage
	mmc: sdhci-of-at91: fix memleak on clk_get failure
	ASoC: SOF: core: free trace on errors
	hv_balloon: Balloon up according to request page number
	mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
	nvmem: core: fix memory abort in cleanup path
	crypto: api - Check spawn->alg under lock in crypto_drop_spawn
	crypto: ccree - fix backlog memory leak
	crypto: ccree - fix AEAD decrypt auth fail
	crypto: ccree - fix pm wrongful error reporting
	crypto: ccree - fix FDE descriptor sequence
	crypto: ccree - fix PM race condition
	padata: Remove broken queue flushing
	fs: allow deduplication of eof block into the end of the destination file
	scripts/find-unused-docs: Fix massive false positives
	erofs: fix out-of-bound read for shifted uncompressed block
	scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
	scsi: qla2xxx: Fix mtcp dump collection failure
	cpupower: Revert library ABI changes from commit ae2917093f
	power: supply: axp20x_ac_power: Fix reporting online status
	power: supply: ltc2941-battery-gauge: fix use-after-free
	ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
	ovl: fix lseek overflow on 32bit
	f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
	f2fs: fix miscounted block limit in f2fs_statfs_project()
	f2fs: code cleanup for f2fs_statfs_project()
	f2fs: fix dcache lookup of !casefolded directories
	f2fs: fix race conditions in ->d_compare() and ->d_hash()
	PM: core: Fix handling of devices deleted during system-wide resume
	cpufreq: Avoid creating excessively large stack frames
	of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
	ARM: dma-api: fix max_pfn off-by-one error in __dma_supported()
	dm zoned: support zone sizes smaller than 128MiB
	dm space map common: fix to ensure new block isn't already in use
	dm writecache: fix incorrect flush sequence when doing SSD mode commit
	dm crypt: fix GFP flags passed to skcipher_request_alloc()
	dm crypt: fix benbi IV constructor crash if used in authenticated mode
	dm thin metadata: use pool locking at end of dm_pool_metadata_close
	dm: fix potential for q->make_request_fn NULL pointer
	scsi: qla2xxx: Fix stuck login session using prli_pend_timer
	ASoC: SOF: Introduce state machine for FW boot
	ASoC: SOF: core: release resources on errors in probe_continue
	tracing: Annotate ftrace_graph_hash pointer with __rcu
	tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
	ftrace: Add comment to why rcu_dereference_sched() is open coded
	ftrace: Protect ftrace_graph_hash with ftrace_sync
	crypto: pcrypt - Avoid deadlock by using per-instance padata queues
	btrfs: fix improper setting of scanned for range cyclic write cache pages
	btrfs: Handle another split brain scenario with metadata uuid feature
	riscv, bpf: Fix broken BPF tail calls
	selftests/bpf: Fix perf_buffer test on systems w/ offline CPUs
	bpf, devmap: Pass lockdep expression to RCU lists
	libbpf: Fix realloc usage in bpf_core_find_cands
	tc-testing: fix eBPF tests failure on linux fresh clones
	samples/bpf: Don't try to remove user's homedir on clean
	samples/bpf: Xdp_redirect_cpu fix missing tracepoint attach
	selftests/bpf: Fix test_attach_probe
	selftests/bpf: Skip perf hw events test if the setup disabled it
	selftests: bpf: Use a temporary file in test_sockmap
	selftests: bpf: Ignore FIN packets for reuseport tests
	crypto: api - fix unexpectedly getting generic implementation
	crypto: hisilicon - Use the offset fields in sqe to avoid need to split scatterlists
	crypto: ccp - set max RSA modulus size for v3 platform devices as well
	crypto: arm64/ghash-neon - bump priority to 150
	crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
	crypto: atmel-aes - Fix counter overflow in CTR mode
	crypto: api - Fix race condition in crypto_spawn_alg
	crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
	powerpc/futex: Fix incorrect user access blocking
	scsi: qla2xxx: Fix unbound NVME response length
	NFS: Fix memory leaks and corruption in readdir
	NFS: Directory page cache pages need to be locked when read
	nfsd: fix filecache lookup
	jbd2_seq_info_next should increase position index
	ext4: fix deadlock allocating crypto bounce page from mempool
	ext4: fix race conditions in ->d_compare() and ->d_hash()
	Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES
	Btrfs: make deduplication with range including the last block work
	Btrfs: fix infinite loop during fsync after rename operations
	btrfs: set trans->drity in btrfs_commit_transaction
	btrfs: drop log root for dropped roots
	Btrfs: fix race between adding and putting tree mod seq elements and nodes
	btrfs: flush write bio if we loop in extent_write_cache_pages
	btrfs: Correctly handle empty trees in find_first_clear_extent_bit
	ARM: tegra: Enable PLLP bypass during Tegra124 LP1
	iwlwifi: don't throw error when trying to remove IGTK
	mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
	sunrpc: expiry_time should be seconds not timeval
	gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0
	gfs2: move setting current->backing_dev_info
	gfs2: fix O_SYNC write handling
	drm: atmel-hlcdc: use double rate for pixel clock only if supported
	drm: atmel-hlcdc: enable clock before configuring timing engine
	drm: atmel-hlcdc: prefer a lower pixel-clock than requested
	drm/rect: Avoid division by zero
	media: iguanair: fix endpoint sanity check
	media: rc: ensure lirc is initialized before registering input device
	tools/kvm_stat: Fix kvm_exit filter name
	xen/balloon: Support xend-based toolstack take two
	watchdog: fix UAF in reboot notifier handling in watchdog core code
	bcache: add readahead cache policy options via sysfs interface
	eventfd: track eventfd_signal() recursion depth
	aio: prevent potential eventfd recursion on poll
	KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
	KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
	KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
	KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
	KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
	KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
	KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
	KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
	KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
	KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform
	KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
	KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
	kvm/svm: PKU not currently supported
	x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
	x86/kvm: Introduce kvm_(un)map_gfn()
	x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
	x86/kvm: Cache gfn to pfn translation
	x86/KVM: Clean up host's steal time structure
	KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
	KVM: x86: Don't let userspace set host-reserved cr4 bits
	KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
	KVM: x86: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu()
	KVM: x86: Ensure guest's FPU state is loaded when accessing for emulation
	KVM: x86: Revert "KVM: X86: Fix fpu state crash in kvm guest"
	KVM: s390: do not clobber registers during guest reset/store status
	ocfs2: fix oops when writing cloned file
	mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
	arm64: dts: qcom: qcs404-evb: Set vdd_apc regulator in high power mode
	mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush
	clk: tegra: Mark fuse clock as critical
	drm/amd/dm/mst: Ignore payload update failures
	virtio-balloon: initialize all vq callbacks
	virtio-pci: check name when counting MSI-X vectors
	fix up iter on short count in fuse_direct_io()
	broken ping to ipv6 linklocal addresses on debian buster
	percpu: Separate decrypted varaibles anytime encryption can be enabled
	ASoC: meson: axg-fifo: fix fifo threshold setup
	scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
	scsi: csiostor: Adjust indentation in csio_device_reset
	scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
	scsi: ufs: Recheck bkops level if bkops is disabled
	mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
	phy: qualcomm: Adjust indentation in read_poll_timeout
	ext2: Adjust indentation in ext2_fill_super
	powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
	drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
	NFC: pn544: Adjust indentation in pn544_hci_check_presence
	ppp: Adjust indentation into ppp_async_input
	net: smc911x: Adjust indentation in smc911x_phy_configure
	net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
	IB/mlx5: Fix outstanding_pi index for GSI qps
	IB/core: Fix ODP get user pages flow
	nfsd: fix delay timer on 32-bit architectures
	nfsd: fix jiffies/time_t mixup in LRU list
	nfsd: Return the correct number of bytes written to the file
	virtio-balloon: Fix memory leak when unloading while hinting is in progress
	virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
	ubi: fastmap: Fix inverted logic in seen selfcheck
	ubi: Fix an error pointer dereference in error handling code
	ubifs: Fix memory leak from c->sup_node
	regulator: core: Add regulator_is_equal() helper
	ASoC: sgtl5000: Fix VDDA and VDDIO comparison
	bonding/alb: properly access headers in bond_alb_xmit()
	devlink: report 0 after hitting end in region read
	dpaa_eth: support all modes with rate adapting PHYs
	net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
	net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
	net: dsa: microchip: enable module autoprobe
	net: mvneta: move rx_dropped and rx_errors in per-cpu stats
	net_sched: fix a resource leak in tcindex_set_parms()
	net: stmmac: fix a possible endless loop
	net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
	net/mlx5: IPsec, Fix esp modify function attribute
	net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
	net: macb: Remove unnecessary alignment check for TSO
	net: macb: Limit maximum GEM TX length in TSO
	taprio: Fix enabling offload with wrong number of traffic classes
	taprio: Fix still allowing changing the flags during runtime
	taprio: Add missing policy validation for flags
	taprio: Use taprio_reset_tc() to reset Traffic Classes configuration
	taprio: Fix dropping packets when using taprio + ETF offloading
	ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
	qed: Fix timestamping issue for L2 unicast ptp packets.
	drop_monitor: Do not cancel uninitialized work item
	net/mlx5: Fix deadlock in fs_core
	net/mlx5: Deprecate usage of generic TLS HW capability bit
	ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
	mfd: da9062: Fix watchdog compatible string
	mfd: rn5t618: Mark ADC control register volatile
	mfd: bd70528: Fix hour register mask
	x86/timer: Don't skip PIT setup when APIC is disabled or in legacy mode
	btrfs: use bool argument in free_root_pointers()
	btrfs: free block groups after free'ing fs trees
	drm/dp_mst: Remove VCPI while disabling topology mgr
	KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
	KVM: x86: use CPUID to locate host page table reserved bits
	KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
	KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
	KVM: nVMX: vmread should not set rflags to specify success in case of #PF
	KVM: Use vcpu-specific gva->hva translation when querying host page size
	KVM: Play nice with read-only memslots when querying host page size
	cifs: fail i/o on soft mounts if sessionsetup errors out
	x86/apic/msi: Plug non-maskable MSI affinity race
	clocksource: Prevent double add_timer_on() for watchdog_timer
	perf/core: Fix mlock accounting in perf_mmap()
	rxrpc: Fix service call disconnection
	regulator fix for "regulator: core: Add regulator_is_equal() helper"
	powerpc/kuap: Fix set direction in allow/prevent_user_access()
	Linux 5.4.19

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ief6bae336b8e6931810e5b357c0d5e16fbf1c13e
2020-02-11 14:09:41 -08:00
Coly Li
d5d6b58872 bcache: add readahead cache policy options via sysfs interface
commit 038ba8cc1bffc51250add4a9b9249d4331576d8f upstream.

In year 2007 high performance SSD was still expensive, in order to
save more space for real workload or meta data, the readahead I/Os
for non-meta data was bypassed and not cached on SSD.

In now days, SSD price drops a lot and people can find larger size
SSD with more comfortable price. It is unncessary to alway bypass
normal readahead I/Os to save SSD space for now.

This patch adds options for readahead data cache policies via sysfs
file /sys/block/bcache<N>/readahead_cache_policy, the options are,
- "all": cache all readahead data I/Os.
- "meta-only": only cache meta data, and bypass other regular I/Os.

If users want to make bcache continue to only cache readahead request
for metadata and bypass regular data readahead, please set "meta-only"
to this sysfs file. By default, bcache will back to cache all read-
ahead requests now.

Cc: stable@vger.kernel.org
Signed-off-by: Coly Li <colyli@suse.de>
Acked-by: Eric Wheeler <bcache@linux.ewheeler.net>
Cc: Michael Lyle <mlyle@lyle.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:37 -08:00
Mike Snitzer
78cbd2c397 dm: fix potential for q->make_request_fn NULL pointer
commit 47ace7e012b9f7ad71d43ac9063d335ea3d6820b upstream.

Move blk_queue_make_request() to dm.c:alloc_dev() so that
q->make_request_fn is never NULL during the lifetime of a DM device
(even one that is created without a DM table).

Otherwise generic_make_request() will crash simply by doing:
  dmsetup create -n test
  mount /dev/dm-N /mnt

While at it, move ->congested_data initialization out of
dm.c:alloc_dev() and into the bio-based specific init method.

Reported-by: Stefan Bader <stefan.bader@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/1860231
Fixes: ff36ab3458 ("dm: remove request-based logic from make_request_fn wrapper")
Depends-on: c12c9a3c38 ("dm: various cleanups to md->queue initialization code")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:27 -08:00
Mike Snitzer
1426201af0 dm thin metadata: use pool locking at end of dm_pool_metadata_close
commit 44d8ebf436399a40fcd10dd31b29d37823d62fcc upstream.

Ensure that the pool is locked during calls to __commit_transaction and
__destroy_persistent_data_objects.  Just being consistent with locking,
but reality is dm_pool_metadata_close is called once pool is being
destroyed so access to pool shouldn't be contended.

Also, use pmd_write_lock_in_core rather than __pmd_write_lock in
dm_pool_commit_metadata and rename __pmd_write_lock to
pmd_write_lock_in_core -- there was no need for the alias.

In addition, verify that the pool is locked in __commit_transaction().

Fixes: 873f258bec ("dm thin metadata: do not write metadata if no changes occurred")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:26 -08:00
Milan Broz
40d3d8d6eb dm crypt: fix benbi IV constructor crash if used in authenticated mode
commit 4ea9471fbd1addb25a4d269991dc724e200ca5b5 upstream.

If benbi IV is used in AEAD construction, for example:
  cryptsetup luksFormat <device> --cipher twofish-xts-benbi --key-size 512 --integrity=hmac-sha256
the constructor uses wrong skcipher function and crashes:

 BUG: kernel NULL pointer dereference, address: 00000014
 ...
 EIP: crypt_iv_benbi_ctr+0x15/0x70 [dm_crypt]
 Call Trace:
  ? crypt_subkey_size+0x20/0x20 [dm_crypt]
  crypt_ctr+0x567/0xfc0 [dm_crypt]
  dm_table_add_target+0x15f/0x340 [dm_mod]

Fix this by properly using crypt_aead_blocksize() in this case.

Fixes: ef43aa3806 ("dm crypt: add cryptographic data integrity protection (authenticated encryption)")
Cc: stable@vger.kernel.org # v4.12+
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941051
Reported-by: Jerad Simpson <jbsimpson@gmail.com>
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:26 -08:00
Mikulas Patocka
b805ec7d08 dm crypt: fix GFP flags passed to skcipher_request_alloc()
commit 9402e959014a18b4ebf7558733076875808dd66c upstream.

GFP_KERNEL is not supposed to be or'd with GFP_NOFS (the result is
equivalent to GFP_KERNEL). Also, we use GFP_NOIO instead of GFP_NOFS
because we don't want any I/O being submitted in the direct reclaim
path.

Fixes: 39d13a1ac4 ("dm crypt: reuse eboiv skcipher for IV generation")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:26 -08:00
Mikulas Patocka
1781fa54a4 dm writecache: fix incorrect flush sequence when doing SSD mode commit
commit aa9509209c5ac2f0b35d01a922bf9ae072d0c2fc upstream.

When committing state, the function writecache_flush does the following:
1. write metadata (writecache_commit_flushed)
2. flush disk cache (writecache_commit_flushed)
3. wait for data writes to complete (writecache_wait_for_ios)
4. increase superblock seq_count
5. write the superblock
6. flush disk cache

It may happen that at step 3, when we wait for some write to finish, the
disk may report the write as finished, but the write only hit the disk
cache and it is not yet stored in persistent storage. At step 5 we write
the superblock - it may happen that the superblock is written before the
write that we waited for in step 3. If the machine crashes, it may result
in incorrect data being returned after reboot.

In order to fix the bug, we must swap steps 2 and 3 in the above sequence,
so that we first wait for writes to complete and then flush the disk
cache.

Fixes: 48debafe4f ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:26 -08:00