1. 26 Jul, 2019 9 commits
    • Linus Torvalds's avatar
      Merge tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 4792ba1f
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "Two regression fixes:
      
         - hangs caused by a missing barrier in the locking code
      
         - memory leaks of extent_state due to bad handling of a cached
           pointer"
      
      * tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix extent_state leak in btrfs_lock_and_flush_ordered_range
        btrfs: Fix deadlock caused by missing memory barrier
      4792ba1f
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 863fa888
      Linus Torvalds authored
      Pull vfs umount_tree() leak fix from Al Viro:
       "Fix braino introduced in 'switch the remnants of releasing the
        mountpoint away from fs_pin'.
      
        The most visible result is leaking struct mount when mounting btrfs,
        making it impossible to shut down"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix the struct mount leak in umount_tree()
      863fa888
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190726' of git://git.kernel.dk/linux-block · 04412819
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Several io_uring fixes/improvements:
           - Blocking fix for O_DIRECT (me)
           - Latter page slowness for registered buffers (me)
           - Fix poll hang under certain conditions (me)
           - Defer sequence check fix for wrapped rings (Zhengyuan)
           - Mismatch in async inc/dec accounting (Zhengyuan)
           - Memory ordering issue that could cause stall (Zhengyuan)
            - Track sequential defer in bytes, not pages (Zhengyuan)
      
       - NVMe pull request from Christoph
      
       - Set of hang fixes for wbt (Josef)
      
       - Redundant error message kill for libahci (Ding)
      
       - Remove unused blk_mq_sched_started_request() and related ops (Marcos)
      
       - drbd dynamic alloc shash descriptor to reduce stack use (Arnd)
      
       - blkcg ->pd_stat() non-debug print (Tejun)
      
       - bcache memory leak fix (Wei)
      
       - Comment fix (Akinobu)
      
       - BFQ perf regression fix (Paolo)
      
      * tag 'for-linus-20190726' of git://git.kernel.dk/linux-block: (24 commits)
        io_uring: ensure ->list is initialized for poll commands
        Revert "nvme-pci: don't create a read hctx mapping without read queues"
        nvme: fix multipath crash when ANA is deactivated
        nvme: fix memory leak caused by incorrect subsystem free
        nvme: ignore subnqn for ADATA SX6000LNP
        drbd: dynamically allocate shash descriptor
        block: blk-mq: Remove blk_mq_sched_started_request and started_request
        bcache: fix possible memory leak in bch_cached_dev_run()
        io_uring: track io length in async_list based on bytes
        io_uring: don't use iov_iter_advance() for fixed buffers
        block: properly handle IOCB_NOWAIT for async O_DIRECT IO
        blk-mq: allow REQ_NOWAIT to return an error inline
        io_uring: add a memory barrier before atomic_read
        rq-qos: use a mb for got_token
        rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule
        rq-qos: don't reset has_sleepers on spurious wakeups
        rq-qos: fix missed wake-ups in rq_qos_throttle
        wait: add wq_has_single_sleeper helper
        block, bfq: check also in-flight I/O in dispatch plugging
        block: fix sysfs module parameters directory path in comment
        ...
      04412819
    • Linus Torvalds's avatar
      Merge tag 'sound-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 750c930b
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "All relatively small changes:
      
         - a regression fix for PCM link code with CONFIG_REFCOUNT_FULL;
           stumbled on a slight difference between atomic_t and refcount_t
      
         - a couple of HD-audio stabilization patches addressing the too slow
           PM resume seen on some Intel chips
      
         - a series of ALSA compress-offload API fixes, including the
           regression by the previous capture stream support
      
         - trivial LINE6 USB-audio driver fixes, a new Conexant HD-audio chip
           coverage, and a fix in AC97 bus error path"
      
      * tag 'sound-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Add a conexant codec entry to let mute led work
        ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
        ALSA: ac97: Fix double free of ac97_codec_device
        ALSA: compress: Be more restrictive about when a drain is allowed
        ALSA: compress: Don't allow paritial drain operations on capture streams
        ALSA: compress: Prevent bypasses of set_params
        ALSA: compress: Fix regression on compressed capture streams
        ALSA: line6: Fix a typo
        ALSA: pcm: Fix refcount_inc() on zero usage
        ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1
        ALSA: hda - Optimize resume for codecs without jack detection
      750c930b
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · b381c016
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
      
       - revert an Intel VT-d patch that caused boot problems on some machines
      
       - fix AMD IOMMU interrupts with x2apic enabled
      
       - fix a potential crash when Intel VT-d domain allocation fails
      
       - fix crash in Intel VT-d driver when accessing a domain without a
         flush queue
      
       - formatting fix for new Intel VT-d debugfs code
      
       - fix for use-after-free bug in IOVA code
      
       - fix for a NULL-pointer dereference in Intel VT-d driver when PCI
         hotplug is used
      
       - compilation fix for one of the previous fixes
      
      * tag 'iommu-fixes-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Add support for X2APIC IOMMU interrupts
        iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA
        iommu/vt-d: Print pasid table entries MSB to LSB in debugfs
        iommu/iova: Remove stale cached32_node
        iommu/vt-d: Check if domain->pgd was allocated
        iommu/vt-d: Don't queue_iova() if there is no flush queue
        iommu/vt-d: Avoid duplicated pci dma alias consideration
        Revert "iommu/vt-d: Consolidate domain_init() to avoid duplication"
      b381c016
    • Linus Torvalds's avatar
      Merge branch 'for-linus-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft · 55d31aae
      Linus Torvalds authored
      Pull iscsi_ibft fix from Konrad Rzeszutek Wilk:
       "One tiny fix to enable iSCSI IBFT to be compiled under ARM"
      
      * 'for-linus-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft:
        iscsi_ibft: make ISCSI_IBFT depend on ACPI instead of ISCSI_IBFT_FIND
      55d31aae
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v5.3-rc2' of... · 6108cd47
      Linus Torvalds authored
      Merge tag 'hwmon-for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
       "A couple of hwmon bug fixes:
      
         - Update k8temp documentation URL
      
         - Register address fixes in nct6775 driver
      
         - Fix potential division by zero in occ driver"
      
      * tag 'hwmon-for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (k8temp) documentation: update URL of datasheet
        hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
        hwmon: (occ) Fix division by zero issue
      6108cd47
    • Al Viro's avatar
      fix the struct mount leak in umount_tree() · 19a1c409
      Al Viro authored
      	We need to drop everything we remove from the tree, whether
      mnt_has_parent() is true or not.  Usually the bug manifests as a slow
      memory leak (leaked struct mount for initramfs); it becomes much more
      visible in mount_subtree() users, such as btrfs.  There we leak
      a struct mount for btrfs superblock being mounted, which prevents
      fs shutdown on subsequent umount.
      
      Fixes: 56cbb429 ("switch the remnants of releasing the mountpoint away from fs_pin")
      Reported-by: default avatarNikolay Borisov <nborisov@suse.com>
      Tested-by: default avatarNikolay Borisov <nborisov@suse.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      19a1c409
    • Naohiro Aota's avatar
      btrfs: fix extent_state leak in btrfs_lock_and_flush_ordered_range · a3b46b86
      Naohiro Aota authored
      btrfs_lock_and_flush_ordered_range() loads given "*cached_state" into
      cachedp, which, in general, is NULL. Then, lock_extent_bits() updates
      "cachedp", but it never goes backs to the caller. Thus the caller still
      see its "cached_state" to be NULL and never free the state allocated
      under btrfs_lock_and_flush_ordered_range(). As a result, we will
      see massive state leak with e.g. fstests btrfs/005. Fix this bug by
      properly handling the pointers.
      
      Fixes: bd80d94e ("btrfs: Always use a cached extent_state in btrfs_lock_and_flush_ordered_range")
      Reviewed-by: default avatarNikolay Borisov <nborisov@suse.com>
      Signed-off-by: default avatarNaohiro Aota <naohiro.aota@wdc.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      a3b46b86
  2. 25 Jul, 2019 9 commits
  3. 24 Jul, 2019 8 commits
    • Takashi Iwai's avatar
      ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips · 2756d914
      Takashi Iwai authored
      It turned out that the recent Intel HD-audio controller chips show a
      significant stall during the system PM resume intermittently.  It
      doesn't happen so often and usually it may read back successfully
      after one or more seconds, but in some rare worst cases the driver
      went into fallback mode.
      
      After trial-and-error, we found out that the communication stall seems
      covered by issuing the sync after each verb write, as already done for
      AMD and other chipsets.  So this patch enables the write-sync flag for
      the recent Intel chips, Skylake and onward, as a workaround.
      
      Also, since Broxton and co have the very same driver flags as Skylake,
      refer to the Skylake driver flags instead of defining the same
      contents again for simplification.
      
      BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201901Reported-and-tested-by: default avatarTodd Brandt <todd.e.brandt@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      2756d914
    • Masanari Iida's avatar
      aecea57f
    • Linus Torvalds's avatar
      access: avoid the RCU grace period for the temporary subjective credentials · d7852fbd
      Linus Torvalds authored
      It turns out that 'access()' (and 'faccessat()') can cause a lot of RCU
      work because it installs a temporary credential that gets allocated and
      freed for each system call.
      
      The allocation and freeing overhead is mostly benign, but because
      credentials can be accessed under the RCU read lock, the freeing
      involves a RCU grace period.
      
      Which is not a huge deal normally, but if you have a lot of access()
      calls, this causes a fair amount of seconday damage: instead of having a
      nice alloc/free patterns that hits in hot per-CPU slab caches, you have
      all those delayed free's, and on big machines with hundreds of cores,
      the RCU overhead can end up being enormous.
      
      But it turns out that all of this is entirely unnecessary.  Exactly
      because access() only installs the credential as the thread-local
      subjective credential, the temporary cred pointer doesn't actually need
      to be RCU free'd at all.  Once we're done using it, we can just free it
      synchronously and avoid all the RCU overhead.
      
      So add a 'non_rcu' flag to 'struct cred', which can be set by users that
      know they only use it in non-RCU context (there are other potential
      users for this).  We can make it a union with the rcu freeing list head
      that we need for the RCU case, so this doesn't need any extra storage.
      
      Note that this also makes 'get_current_cred()' clear the new non_rcu
      flag, in case we have filesystems that take a long-term reference to the
      cred and then expect the RCU delayed freeing afterwards.  It's not
      entirely clear that this is required, but it makes for clear semantics:
      the subjective cred remains non-RCU as long as you only access it
      synchronously using the thread-local accessors, but you _can_ use it as
      a generic cred if you want to.
      
      It is possible that we should just remove the whole RCU markings for
      ->cred entirely.  Only ->real_cred is really supposed to be accessed
      through RCU, and the long-term cred copies that nfs uses might want to
      explicitly re-enable RCU freeing if required, rather than have
      get_current_cred() do it implicitly.
      
      But this is a "minimal semantic changes" change for the immediate
      problem.
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarPaul E. McKenney <paulmck@linux.ibm.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Jan Glauber <jglauber@marvell.com>
      Cc: Jiri Kosina <jikos@kernel.org>
      Cc: Jayachandran Chandrasekharan Nair <jnair@marvell.com>
      Cc: Greg KH <greg@kroah.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Miklos Szeredi <miklos@szeredi.hu>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d7852fbd
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · bed38c3e
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "An assortment of non-regression fixes that have accumulated since the
        start of the merge window.
      
         - A fix for a user triggerable oops on machines where transactional
           memory is disabled, eg. Power9 bare metal, Power8 with TM disabled
           on the command line, or all Power7 or earlier machines.
      
         - Three fixes for handling of PMU and power saving registers when
           running nested KVM on Power9.
      
         - Two fixes for bugs found while stress testing the XIVE interrupt
           controller code, also on Power9.
      
         - A fix to allow guests to boot under Qemu/KVM on Power9 using the
           the Hash MMU with >= 1TB of memory.
      
         - Two fixes for bugs in the recent DMA cleanup, one of which could
           lead to checkstops.
      
         - And finally three fixes for the PAPR SCM nvdimm driver.
      
        Thanks to: Alexey Kardashevskiy, Andrea Arcangeli, Cédric Le Goater,
        Christoph Hellwig, David Gibson, Gautham R. Shenoy, Michael Neuling,
        Oliver O'Halloran, Satheesh Rajendran, Shawn Anastasio, Suraj Jitindar
        Singh, Vaibhav Jain"
      
      * tag 'powerpc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/papr_scm: Force a scm-unbind if initial scm-bind fails
        powerpc/papr_scm: Update drc_pmem_unbind() to use H_SCM_UNBIND_ALL
        powerpc/pseries: Update SCM hcall op-codes in hvcall.h
        powerpc/tm: Fix oops on sigreturn on systems without TM
        powerpc/dma: Fix invalid DMA mmap behavior
        KVM: PPC: Book3S HV: XIVE: fix rollback when kvmppc_xive_create fails
        powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask()
        powerpc: fix off by one in max_zone_pfn initialization for ZONE_DMA
        KVM: PPC: Book3S HV: Save and restore guest visible PSSCR bits on pseries
        powerpc/pmu: Set pmcregs_in_use in paca when running as LPAR
        KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting
        powerpc/mm: Limit rma_size to 1TB when running without HV mode
      bed38c3e
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 76260774
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Bugfixes, a pvspinlock optimization, and documentation moving"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: X86: Boost queue head vCPU to mitigate lock waiter preemption
        Documentation: move Documentation/virtual to Documentation/virt
        KVM: nVMX: Set cached_vmcs12 and cached_shadow_vmcs12 NULL after free
        KVM: X86: Dynamically allocate user_fpu
        KVM: X86: Fix fpu state crash in kvm guest
        Revert "kvm: x86: Use task structs fpu field for user"
        KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested
      76260774
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.3-2' of git://git.infradead.org/users/hch/dma-mapping · c2626876
      Linus Torvalds authored
      Pull dma-mapping regression fix from Christoph Hellwig:
       "Ensure that dma_addressing_limited doesn't crash on devices without a
        dma mask (Eric Auger)"
      
      * tag 'dma-mapping-5.3-2' of git://git.infradead.org/users/hch/dma-mapping:
        dma-mapping: use dma_get_mask in dma_addressing_limited
      c2626876
    • Wanpeng Li's avatar
      KVM: X86: Boost queue head vCPU to mitigate lock waiter preemption · 266e85a5
      Wanpeng Li authored
      Commit 11752adb (locking/pvqspinlock: Implement hybrid PV queued/unfair locks)
      introduces hybrid PV queued/unfair locks
       - queued mode (no starvation)
       - unfair mode (good performance on not heavily contended lock)
      The lock waiter goes into the unfair mode especially in VMs with over-commit
      vCPUs since increaing over-commitment increase the likehood that the queue
      head vCPU may have been preempted and not actively spinning.
      
      However, reschedule queue head vCPU timely to acquire the lock still can get
      better performance than just depending on lock stealing in over-subscribe
      scenario.
      
      Testing on 80 HT 2 socket Xeon Skylake server, with 80 vCPUs VM 80GB RAM:
      ebizzy -M
                   vanilla     boosting    improved
       1VM          23520        25040         6%
       2VM           8000        13600        70%
       3VM           3100         5400        74%
      
      The lock holder vCPU yields to the queue head vCPU when unlock, to boost queue
      head vCPU which is involuntary preemption or the one which is voluntary halt
      due to fail to acquire the lock after a short spin in the guest.
      
      Cc: Waiman Long <longman@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Signed-off-by: default avatarWanpeng Li <wanpengli@tencent.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      266e85a5
    • Christoph Hellwig's avatar
      Documentation: move Documentation/virtual to Documentation/virt · 2f5947df
      Christoph Hellwig authored
      Renaming docs seems to be en vogue at the moment, so fix on of the
      grossly misnamed directories.  We usually never use "virtual" as
      a shortcut for virtualization in the kernel, but always virt,
      as seen in the virt/ top-level directory.  Fix up the documentation
      to match that.
      
      Fixes: ed16648e ("Move kvm, uml, and lguest subdirectories under a common "virtual" directory, I.E:")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2f5947df
  4. 23 Jul, 2019 14 commits
    • Linus Torvalds's avatar
      Merge branch 'parisc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · ad5e427e
      Linus Torvalds authored
      Pull parisc fixes from Helge Deller:
      
       - Fix build issues when kprobes are enabled
      
       - Speed up ITLB/DTLB cache flushes when running on machines with
         combined TLBs
      
      * 'parisc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Flush ITLB in flush_tlb_all_local() only on split TLB machines
        parisc: add kprobe_fault_handler()
      ad5e427e
    • yangerkun's avatar
      Revert "nvme-pci: don't create a read hctx mapping without read queues" · 8fe34be1
      yangerkun authored
      This reverts commit 0298d543.
      
      With this patch, set 'poll_queues > hard queues' will lead to 'nr_read_queues = 0'
      in nvme_calc_irq_sets. Then poll_queues setting can fail since dev->tagset.nr_maps
      equals to 2 and nvme_pci_map_queues will not do map for poll queues.
      Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      8fe34be1
    • Marta Rybczynska's avatar
      nvme: fix multipath crash when ANA is deactivated · 66b20ac0
      Marta Rybczynska authored
      Fix a crash with multipath activated. It happends when ANA log
      page is larger than MDTS and because of that ANA is disabled.
      The driver then tries to access unallocated buffer when connecting
      to a nvme target. The signature is as follows:
      
      [  300.433586] nvme nvme0: ANA log page size (8208) larger than MDTS (8192).
      [  300.435387] nvme nvme0: disabling ANA support.
      [  300.437835] nvme nvme0: creating 4 I/O queues.
      [  300.459132] nvme nvme0: new ctrl: NQN "nqn.0.0.0", addr 10.91.0.1:8009
      [  300.464609] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
      [  300.466342] #PF error: [normal kernel read fault]
      [  300.467385] PGD 0 P4D 0
      [  300.467987] Oops: 0000 [#1] SMP PTI
      [  300.468787] CPU: 3 PID: 50 Comm: kworker/u8:1 Not tainted 5.0.20kalray+ #4
      [  300.470264] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
      [  300.471532] Workqueue: nvme-wq nvme_scan_work [nvme_core]
      [  300.472724] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core]
      [  300.474038] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48
      [  300.477374] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296
      [  300.478334] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000
      [  300.479784] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258
      [  300.481488] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
      [  300.483203] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0
      [  300.484928] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0
      [  300.486626] FS:  0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000
      [  300.488538] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  300.489907] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0
      [  300.491612] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  300.493303] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  300.494991] Call Trace:
      [  300.495645]  nvme_mpath_add_disk+0x5c/0xb0 [nvme_core]
      [  300.496880]  nvme_validate_ns+0x2ef/0x550 [nvme_core]
      [  300.498105]  ? nvme_identify_ctrl.isra.45+0x6a/0xb0 [nvme_core]
      [  300.499539]  nvme_scan_work+0x2b4/0x370 [nvme_core]
      [  300.500717]  ? __switch_to_asm+0x35/0x70
      [  300.501663]  process_one_work+0x171/0x380
      [  300.502340]  worker_thread+0x49/0x3f0
      [  300.503079]  kthread+0xf8/0x130
      [  300.503795]  ? max_active_store+0x80/0x80
      [  300.504690]  ? kthread_bind+0x10/0x10
      [  300.505502]  ret_from_fork+0x35/0x40
      [  300.506280] Modules linked in: nvme_tcp nvme_rdma rdma_cm iw_cm ib_cm ib_core nvme_fabrics nvme_core xt_physdev ip6table_raw ip6table_mangle ip6table_filter ip6_tables xt_comment iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_CHECKSUM iptable_mangle iptable_filter veth ebtable_filter ebtable_nat ebtables iptable_raw vxlan ip6_udp_tunnel udp_tunnel sunrpc joydev pcspkr virtio_balloon br_netfilter bridge stp llc ip_tables xfs libcrc32c ata_generic pata_acpi virtio_net virtio_console net_failover virtio_blk failover ata_piix serio_raw libata virtio_pci virtio_ring virtio
      [  300.514984] CR2: 0000000000000008
      [  300.515569] ---[ end trace faa2eefad7e7f218 ]---
      [  300.516354] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core]
      [  300.517330] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48
      [  300.520353] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296
      [  300.521229] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000
      [  300.522399] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258
      [  300.523560] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
      [  300.524734] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0
      [  300.525915] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0
      [  300.527084] FS:  0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000
      [  300.528396] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  300.529440] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0
      [  300.530739] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  300.531989] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  300.533264] Kernel panic - not syncing: Fatal exception
      [  300.534338] Kernel Offset: 0x17c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
      [  300.536227] ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      Condition check refactoring from Christoph Hellwig.
      Signed-off-by: default avatarMarta Rybczynska <marta.rybczynska@kalray.eu>
      Tested-by: default avatarJean-Baptiste Riaux <jbriaux@kalray.eu>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      66b20ac0
    • Logan Gunthorpe's avatar
      nvme: fix memory leak caused by incorrect subsystem free · e654dfd3
      Logan Gunthorpe authored
      When freeing the subsystem after finding another match with
      __nvme_find_get_subsystem(), use put_device() instead of
      __nvme_release_subsystem() which calls kfree() directly.
      
      Per the documentation, put_device() should always be used
      after device_initialization() is called. Otherwise, leaks
      like the one below which was detected by kmemleak may occur.
      
      Once the call of __nvme_release_subsystem() is removed it no
      longer makes sense to keep the helper, so fold it back
      into nvme_release_subsystem().
      
      unreferenced object 0xffff8883d12bfbc0 (size 16):
        comm "nvme", pid 2635, jiffies 4294933602 (age 739.952s)
        hex dump (first 16 bytes):
          6e 76 6d 65 2d 73 75 62 73 79 73 32 00 88 ff ff  nvme-subsys2....
        backtrace:
          [<000000007d8fc208>] __kmalloc_track_caller+0x16d/0x2a0
          [<0000000081169e5f>] kvasprintf+0xad/0x130
          [<0000000025626f25>] kvasprintf_const+0x47/0x120
          [<00000000fa66ad36>] kobject_set_name_vargs+0x44/0x120
          [<000000004881f8b3>] dev_set_name+0x98/0xc0
          [<000000007124dae3>] nvme_init_identify+0x1995/0x38e0
          [<000000009315020a>] nvme_loop_configure_admin_queue+0x4fa/0x5e0
          [<000000001a63e766>] nvme_loop_create_ctrl+0x489/0xf80
          [<00000000a46ecc23>] nvmf_dev_write+0x1a12/0x2220
          [<000000002259b3d5>] __vfs_write+0x66/0x120
          [<000000002f6df81e>] vfs_write+0x154/0x490
          [<000000007e8cfc19>] ksys_write+0x10a/0x240
          [<00000000ff5c7b85>] __x64_sys_write+0x73/0xb0
          [<00000000fee6d692>] do_syscall_64+0xaa/0x470
          [<00000000997e1ede>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Fixes: ab9e00cc ("nvme: track subsystems")
      Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      e654dfd3
    • Misha Nasledov's avatar
      nvme: ignore subnqn for ADATA SX6000LNP · 08b903b5
      Misha Nasledov authored
      The ADATA SX6000LNP NVMe SSDs have the same subnqn and, due to this, a
      system with more than one of these SSDs will only have one usable.
      
      [ 0.942706] nvme nvme1: ignoring ctrl due to duplicate subnqn (nqn.2018-05.com.example:nvme:nvm-subsystem-OUI00E04C).
      [ 0.943017] nvme nvme1: Removing after probe failure status: -22
      
      02:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01)
      71:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01)
      
      There are no firmware updates available from the vendor, unfortunately.
      Applying the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk for these SSDs resolves
      the issue, and they all work after this patch:
      
      /dev/nvme0n1     2J1120050420         ADATA SX6000LNP [...]
      /dev/nvme1n1     2J1120050540         ADATA SX6000LNP [...]
      Signed-off-by: default avatarMisha Nasledov <misha@nasledov.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      08b903b5
    • Eric Auger's avatar
      dma-mapping: use dma_get_mask in dma_addressing_limited · 06532750
      Eric Auger authored
      We currently have cases where the dma_addressing_limited() gets
      called with dma_mask unset. This causes a NULL pointer dereference.
      
      Use dma_get_mask() accessor to prevent the crash.
      
      Fixes: b8664554 ("dma-mapping: add a dma_addressing_limited helper")
      Signed-off-by: default avatarEric Auger <eric.auger@redhat.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      06532750
    • Suthikulpanit, Suravee's avatar
      iommu/amd: Add support for X2APIC IOMMU interrupts · 66929812
      Suthikulpanit, Suravee authored
      AMD IOMMU requires IntCapXT registers to be setup in order to generate
      its own interrupts (for Event Log, PPR Log, and GA Log) with 32-bit
      APIC destination ID. Without this support, AMD IOMMU MSI interrupts
      will not be routed correctly when booting the system in X2APIC mode.
      
      Cc: Joerg Roedel <joro@8bytes.org>
      Fixes: 90fcffd9 ('iommu/amd: Add support for IOMMU XT mode')
      Signed-off-by: default avatarSuravee Suthikulpanit <suravee.suthikulpanit@amd.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      66929812
    • Arnd Bergmann's avatar
      drbd: dynamically allocate shash descriptor · 77ce56e2
      Arnd Bergmann authored
      Building with clang and KASAN, we get a warning about an overly large
      stack frame on 32-bit architectures:
      
      drivers/block/drbd/drbd_receiver.c:921:31: error: stack frame size of 1280 bytes in function 'conn_connect'
            [-Werror,-Wframe-larger-than=]
      
      We already allocate other data dynamically in this function, so
      just do the same for the shash descriptor, which makes up most of
      this memory.
      
      Link: https://lore.kernel.org/lkml/20190617132440.2721536-1-arnd@arndb.de/Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarRoland Kammerer <roland.kammerer@linbit.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      77ce56e2
    • Marcos Paulo de Souza's avatar
      block: blk-mq: Remove blk_mq_sched_started_request and started_request · 327fe1d4
      Marcos Paulo de Souza authored
      blk_mq_sched_completed_request is a function that checks if the elevator
      related to the request has started_request implemented, but currently, none of
      the available IO schedulers implement started_request, so remove both.
      Signed-off-by: default avatarMarcos Paulo de Souza <marcos.souza.org@gmail.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      327fe1d4
    • Ding Xiang's avatar
      ALSA: ac97: Fix double free of ac97_codec_device · 607975b3
      Ding Xiang authored
      put_device will call ac97_codec_release to free
      ac97_codec_device and other resources, so remove the kfree
      and other redundant code.
      
      Fixes: 74426fbf ("ALSA: ac97: add an ac97 bus")
      Signed-off-by: default avatarDing Xiang <dingxiang@cmss.chinamobile.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      607975b3
    • Charles Keepax's avatar
      ALSA: compress: Be more restrictive about when a drain is allowed · 3b817994
      Charles Keepax authored
      Draining makes little sense in the situation of hardware overrun, as the
      hardware will have consumed all its available samples. Additionally,
      draining whilst the stream is paused would presumably get stuck as no
      data is being consumed on the DSP side.
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Acked-by: default avatarVinod Koul <vkoul@kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      3b817994
    • Charles Keepax's avatar
      ALSA: compress: Don't allow paritial drain operations on capture streams · a70ab8a8
      Charles Keepax authored
      Partial drain and next track are intended for gapless playback and
      don't really have an obvious interpretation for a capture stream, so
      makes sense to not allow those operations on capture streams.
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Acked-by: default avatarVinod Koul <vkoul@kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      a70ab8a8
    • Charles Keepax's avatar
      ALSA: compress: Prevent bypasses of set_params · 26c3f154
      Charles Keepax authored
      Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call
      snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which
      allow a transition to SNDRV_PCM_STATE_SETUP. The stream should
      only be able to move to the setup state once it has received a
      SNDRV_COMPRESS_SET_PARAMS ioctl. Fix this issue by not allowing
      those ioctls whilst in the open state.
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Acked-by: default avatarVinod Koul <vkoul@kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      26c3f154
    • Charles Keepax's avatar
      ALSA: compress: Fix regression on compressed capture streams · 4475f8c4
      Charles Keepax authored
      A previous fix to the stop handling on compressed capture streams causes
      some knock on issues. The previous fix updated snd_compr_drain_notify to
      set the state back to PREPARED for capture streams. This causes some
      issues however as the handling for snd_compr_poll differs between the
      two states and some user-space applications were relying on the poll
      failing after the stream had been stopped.
      
      To correct this regression whilst still fixing the original problem the
      patch was addressing, update the capture handling to skip the PREPARED
      state rather than skipping the SETUP state as it has done until now.
      
      Fixes: 4f2ab5e1 ("ALSA: compress: Fix stop handling on compressed capture streams")
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Acked-by: default avatarVinod Koul <vkoul@kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      4475f8c4